api manager vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the *...

Owasp Enterprise Security Api Oracle Weblogic Server 12.2.1.3.0 Oracle Weblogic Server 12.2.1.4.0 Oracle Weblogic Server 14.1.1.0.0 Netapp Oncommand Workflow Automation -Netapp Active Iq Unified Manager -

1 Github repository

7.5

CVSSv2

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a ...

Owasp Enterprise Security Api Oracle Weblogic Server 12.2.1.3.0 Oracle Weblogic Server 12.2.1.4.0 Oracle Weblogic Server 14.1.1.0.0 Netapp Oncommand Workflow Automation -Netapp Active Iq Unified Manager -

10

CVSSv2

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/ser...

Wso2 Identity Server Analytics 5.5.0 Wso2 Identity Server Analytics 5.4.1 Wso2 Identity Server Analytics 5.6.0 Wso2 Identity Server Analytics 5.4.0 Wso2 Api Manager Wso2 Identity Server Wso2 Enterprise Integrator Wso2 Identity Server As Key Manager

31 Github repositories

7.5

CVSSv2

Cisco Clean Access (CCA) 3.3.0 to 3.3.9, 3.4.0 to 3.4.5, and 3.5.0 to 3.5.3 does not properly authenticate users when invoking API methods, which could allow remote malicious users to bypass security checks, change the assigned role of a user, or disconnect users.

Cisco Network Admission Control Manager And Server System Software 3.3.3 Cisco Network Admission Control Manager And Server System Software 3.3.4 Cisco Network Admission Control Manager And Server System Software 3.4.1 Cisco Network Admission Control Manager And Server System Software 3.4.2 Cisco Network Admission Control Manager And Server System Software 3.4.3 Cisco Network Admission Control Manager And Server System Software 3.3 Cisco Network Admission Control Manager And Server System Software 3.3.7 Cisco Network Admission Control Manager And Server System Software 3.3.8 Cisco Network Admission Control Manager And Server System Software 3.5 Cisco Network Admission Control Manager And Server System Software 3.5.1 Cisco Network Admission Control Manager And Server System Software 3.3.5 Cisco Network Admission Control Manager And Server System Software 3.3.6 Cisco Network Admission Control Manager And Server System Software 3.4.4 Cisco Network Admission Control Manager And Server System Software 3.4.5 Cisco Network Admission Control Manager And Server System Software 3.3.1 Cisco Network Admission Control Manager And Server System Software 3.3.2 Cisco Network Admission Control Manager And Server System Software 3.3.9 Cisco Network Admission Control Manager And Server System Software 3.4 Cisco Network Admission Control Manager And Server System Software 3.5.2 Cisco Network Admission Control Manager And Server System Software 3.5.3

4.6

CVSSv2

In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation can result in unauthorized information disclosure, deletion, or modification if the local computer also processes PI Syste...

Osisoft Pi Api Osisoft Pi Buffer Subsystem Osisoft Pi Connector Osisoft Pi Connector Relay Osisoft Pi Data Archive Osisoft Pi Data Collection Manager Osisoft Pi Integrator Osisoft Pi Interface Configuration Utility Osisoft Pi To Ocs

4.6

CVSSv2

In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in un...

Osisoft Pi Api Osisoft Pi Buffer Subsystem Osisoft Pi Connector Osisoft Pi Connector Relay Osisoft Pi Data Archive Osisoft Pi Data Collection Manager Osisoft Pi Integrator Osisoft Pi Interface Configuration Utility Osisoft Pi To Ocs

7.2

CVSSv2

In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, ...

Osisoft Pi Api Osisoft Pi Buffer Subsystem Osisoft Pi Connector Osisoft Pi Connector Relay Osisoft Pi Data Archive Osisoft Pi Data Collection Manager Osisoft Pi Integrator Osisoft Pi Interface Configuration Utility Osisoft Pi To Ocs

7.5

CVSSv2

A flaw exists in FasterXML jackson-databind in all versions prior to 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping(...

Fasterxml Jackson-databind Netapp Steelstore Cloud Integrated Storage -Netapp Oncommand Api Services -Oracle Goldengate Stream Analytics

NA

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) prior to 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecif...

Synology Router Manager

7.5

CVSSv2

FasterXML jackson-databind 2.0.0 up to and including 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Fasterxml Jackson-databind Debian Debian Linux 8.0 Netapp Steelstore Cloud Integrated Storage -Netapp Oncommand Workflow Automation -Netapp Service Level Manager -Netapp Oncommand Api Services -Huawei Oceanstor 9000 Firmware V300r006c20 Huawei Oceanstor 9000 Firmware V300r006c20spc100 Huawei Oceanstor 9000 Firmware V300r006c20spc200 Huawei Oceanstor 9000 Firmware V300r006c20spc300 Oracle Global Lifecycle Management Opatch

9 Github repositories

Get Started

« PREV 1 2 3 4 5 6 7 8 9 10 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook