Tabit vulnerabilities
We track 5 vulnerabilities in Tabit products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 22, 2022.
Latest Tabit vulnerabilities
- 7.5 High severity
Tabit: Exposure of Sensitive Information to an Unauthorized Actor
Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described APIs, has in its UR
- 7.5 High severity
Tabit: Authorization Bypass Through User-Controlled Key
Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservation
- 9.8 Critical severity
Tabit: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of OWASP:API8 – Injection.
- 8.8 High severity
Tabit: Weak Password Requirements
Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting.
- 7.5 High severity
Tabit: Authorization Bypass Through User-Controlled Key
Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described API