1662 matches found
EUVD-2022-5499
Malicious code in bioql PyPI...
EUVD-2024-0396
Malicious code in bioql PyPI...
EUVD-2024-53950
Malicious code in bioql PyPI...
EUVD-2023-2803
Malicious code in bioql PyPI...
EUVD-2022-24353
Malicious code in bioql PyPI...
EUVD-2023-0855
Malicious code in bioql PyPI...
EUVD-2023-43129
Malicious code in bioql PyPI...
EUVD-2022-36372
Malicious code in bioql PyPI...
EUVD-2022-26103
Malicious code in bioql PyPI...
EUVD-2024-16749
Malicious code in bioql PyPI...
API Attack Awareness: Broken Object Level Authorization (BOLA) – Why It Tops the OWASP API Top 10
For this Cybersecurity Awareness Month, we thought it important to draw attention to some of the most common and dangerous API vulnerabilities. This week, we’re starting with Broken Object Level Authorization BOLA. BOLA vulnerabilities top the OWASP API Top Ten. And for good reason: they’re...
CVE-2025-59833
Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...
CVE-2025-10080
The CVE affects the API component of running-elephant Datart up to version 1.0.0-rc3, specifically the getTokensecret function in datart/security/src/main/java/datart/security/util/AESUtil.java, which uses a hard-coded cryptographic key. The issue is remotely exploitable with high complexity; exp...
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could have been leveraged to execute arbitrary code. This vulnerability affects Firefox < 115.
...
Linux Distros Unpatched Vulnerability : CVE-2021-3148
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.genthin command injection...
CVE-2025-20347
Cisco Nexus Dashboard and Nexus Dashboard Fabric Controller (NDFC) have missing authorization controls on certain REST API endpoints. An authenticated, low-privileged attacker could view sensitive information or upload/modify files via crafted API requests, potentially executing limited Administr...
CVE-2025-20347 Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability
A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller NDFC could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on an affected device. This vulnerability exists because of...
CVE-2025-32010
A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead to arbitrary code execution. An attacker can send an HTTP response to trigger this vulnerability...
CVE-2025-51058
Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...