CVE-2016-10676

rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacke...

solr: Directory traversal via Index Replication HTTP API

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path...

PT-2018-5635 · Moxa · Moxa Edr-810

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 version 4.1 build 17030317 Description: A command injection issue exists in the web server functionality, allowing for privilege escalation to root shell. This can be triggered by injecting OS commands into the remoteNetmask0...

CVE-2018-10168

TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1Windows...

Cross site request forgery (csrf)

TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1Windows...

CVE-2018-10168

TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1Windows...

CVE-2018-10168

CVE-2018-10168 affects TP-Link EAP Controller and Omada Controller (v2.5.4_Windows and v2.6.0_Windows). Root causes include improper privilege management on the Web API (allowing a low-privilege user to perform admin actions), a hard-coded key used to encrypt the backup file enabling decryption/m...

CVE-2018-5799

In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...

Ubiquiti Inc.: UniFi Video Server web interface Configuration Restore CSRF leading to full application compromise

In UniFi Video 3.10.0, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without the user consent, requiring the attacker to lure an authenticated user to access on attacker controlled page...

CVE-2018-7508

A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized...

CVE-2018-7500

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account...

CVE-2018-7508

A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized...

Cross site scripting

A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized...

Design/Logic Flaw

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account...

CVE-2018-7508

The CVE-2018-7508 entry pertains to a Cross-site Scripting vulnerability in OSIsoft PI Web API, affecting versions 2017 R2 and prior. The root cause is improper neutralization of input during web page generation, enabling XSS. The associated ICS/CISA advisory confirms the vulnerability is in PI W...

CVE-2018-7508

A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized...

CVE-2018-7500

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account...

CVE-2018-7500

CVE-2018-7500 affects OSIsoft PI Web API (versions 2017 R2 and prior). The issue is Privileges may be escalated, allowing access to the PI System via the service account. CVSS information in NVD indicates high/critical impact (CS: high for confidentiality, integrity, availability; network vector;...

OSIsoft PI Web API Elevation of Privilege Vulnerability

The OSIsoft PI Web API is a product for accessing PI system data. An elevation of privilege vulnerability exists in OSIsoft PI Web API 2017 R2 and prior versions that could allow an attacker to access the PI System via a service account...

OSIsoft PI Web API

CVSS v3 9.3 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: OSIsoft Equipment: PI Web API Vulnerabilities: Permissions, Privileges, and Access Controls; Cross-site Scripting AFFECTED PRODUCTS OSIsoft reports that the vulnerabilities affect the following PI Web API products: PI...