Rest Api
Monthly
Sensitive information disclosure in Hiperdino's REST v1.0 API lets a caller holding a valid static bearer token query the public 'customer/check' endpoint with a phone number or email and confirm whether it belongs to a registered customer, returning that customer's email and telephone. The endpoint enforces no per-user authentication beyond a shared static token, applies no rate limiting, and returns distinguishable responses, enabling bulk enumeration of contact details. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sensitive information disclosure in Hiperdino's REST v1.0 API lets a caller holding a valid static bearer token query the public 'customer/check' endpoint with a phone number or email and confirm whether it belongs to a registered customer, returning that customer's email and telephone. The endpoint enforces no per-user authentication beyond a shared static token, applies no rate limiting, and returns distinguishable responses, enabling bulk enumeration of contact details. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.