2301 matches found
CVE-2019-14350
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation...
CVE-2019-14349
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
CVE-2019-14350: Improper Neutralization of Input During Web Page Generation
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation...
CVE-2019-14351: Improper Restriction of Excessive Authentication Attempts
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters...
PT-2019-13628
Name of the Vulnerable Software and Affected Versions EspoCRM version 5.6.4 Description The issue is related to stored XSS due to the lack of filtration of user-supplied data in the "api/v1/Document" functionality for storing documents in the account tab. An attacker can upload a crafted file tha...
PT-2019-13630
Name of the Vulnerable Software and Affected Versions EspoCRM version 5.6.4 Description The issue allows a malicious authenticated attacker to brute-force a user password hash by 1 symbol at a time. This is achieved using specially crafted "api/v1/User?filterList" filters. Recommendations For...
PT-2019-13629
Name of the Vulnerable Software and Affected Versions EspoCRM version 5.6.4 Description The issue is related to stored XSS due to the lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during the...
CVE-2019-14349: Improper Neutralization of Input During Web Page Generation
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
openstack-ironic-inspector: SQL Injection vulnerability when receiving introspection data
A SQL-injection vulnerability was found in openstack-ironic-inspector's nodecache.findnode. This function makes a SQL query using unfiltered data from a server reporting inspection results by a POST to the /v1/continue endpoint. Because the API is unauthenticated, the flaw could be exploited by a...
CVE-2019-13275
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...
CVE-2019-13275: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...
PT-2019-13229
Name of the Vulnerable Software and Affected Versions VeronaLabs wp-statistics plugin versions prior to 12.6.7 Description An issue was discovered in the plugin, where the "v1/hit" endpoint of the API is vulnerable to unauthenticated blind SQL Injection when the non-default "use cache plugin"...
CVE-2018-18839
An issue was discovered in Netdata 1.10.0. Full Path Disclosure FPD exists via api/v1/alarms. NOTE: the vendor says "is intentional...
DEBIAN-CVE-2018-18836
An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data in web/api/webapiv1.c...
CVE-2018-18839
An issue was discovered in Netdata 1.10.0. Full Path Disclosure FPD exists via api/v1/alarms. NOTE: the vendor says "is intentional...
CVE-2018-18839
An issue was discovered in Netdata 1.10.0. Full Path Disclosure FPD exists via api/v1/alarms. NOTE: the vendor says "is intentional...
CVE-2018-18836
An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data in web/api/webapiv1.c...
CVE-2018-18836
An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data in web/api/webapiv1.c...