1045 matches found
Major Enhancements to Akamai API Security, Q4 2024
The Akamai API Security updates 3.38, 3.39, and 3.40 include configurable blocking, the automatic creation of posture findings from runtime incidents, and more...
CVE-2024-55949
MinIO is affected by a privilege-escalation flaw in the IAM import API. The issue impacts all users since the commit 580d9db85e04f1b63cc2909af50f0ed08afa965f, with a fix introduced in commit f246c9053f9603e610d98439799bdd2a6b293427 and released in RELEASE.2024-12-13T22-19-12Z. There are no workar...
Simulation of Wasmd message can cause crashing
CWA-2024-009 Severity Low Marginal + Likely^1 Affected versions: - wasmd 0.53.1 Patched versions: - wasmd 0.53.2 please note that wasmd 0.53.1 is broken and must not be used Description of the bug Blank for now. We'll add more detail once chains had a chance to upgrade. Mitigations Apart from...
Protecting Against Bot-Enabled API Abuse
APIs have become the backbone of modern digital ecosystems, powering everything from mobile apps to e-commerce platforms. However, as APIs grow in importance, they also become prime targets for malicious actors. Increasingly, bots are being weaponized to exploit vulnerabilities, overwhelm systems...
Akamai Leads the Way in API Security: GigaOm Radar for API Security Report
...
CVE-2024-52523
Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active sessi...
Custom defined credentials of external storages are sent back to the frontend
None...
CVE-2024-50647
The pythonfood ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through https://ip:port/api/myapp/index/user/info?id=1 And modify the ID value to obtain sensitive user information beyond authorization...
Your AppSec Journey Demystified: Driving Effective API Security with Wallarm and StackHawk
There is no doubt that attackers have shifted their attention to APIs. Wallarm’s API ThreatStats research identifies that 70% of attacks now target APIs instead of Web Applications. While APIs have become the backbone of innovation and connectivity for businesses, they have also introduced a vast...
Context is King: Using API Sessions for Security Context
There’s no doubt that API security is a hot topic these days. The continued growth in API-related breaches and increase in publicized API vulnerabilities has pushed API security to the top of CISO’s lists. The tools in the market for API security still have room for improvement, of course. One of...
Qualys Web Application Scanning (WAS) Recognized as a Leader in 2024 GigaOm Radar Report for Application Security Testing (AST)
In the ever-evolving cybersecurity landscape, securing web applications and APIs is no longer an option—it’s a necessity. As organizations face increasingly complex threats, ensuring the integrity of these digital assets has become paramount. However, it’s easy to feel overwhelmed by the sheer...
CVE-2024-50334
Scoold
Reducing False Positives in API Security: Advanced Techniques Using Machine Learning
False positives in API security are a serious problem, often resulting in wasted results and time, missing real threats, alert fatigue, and operational disruption. Fortunately, however, emerging technologies like machine learning ML can help organizations minimize false positives and streamline t...
How Security Edge Revolutionizes API Security
Wallarm’s Security Edge is setting a new standard in API security—far beyond the reach of traditional Content Delivery Networks CDNs. Let’s get it straight: Security Edge is not just a new addition to the API security market; it’s a disruption. Designed to deliver fast, effective, and advanced AP...
GHSA-6H64-G7CJ-HJ56 Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
A path traversal vulnerability exists in the api openpersonalityfolder endpoint of parisneo/lollms. This vulnerability allows an attacker to read any folder in the personalityfolder on the victim's computer, even though sanitizepath is set. The issue arises due to improper sanitization of the...
Beyond the Edge: Complementing WAAP with Always-On API Security
Learn best practices for API security — and explore why WAAP on its own isn’t enough...
Choosing the Right Deployment Option for Your API Security Solution
You need an API security solution. That much is a given although some may argue it isn’t!. While essential for business growth and innovation, APIs, or Application Programming Interfaces, expose the organizations that use them to cyber threats. Attackers are both aware of and actively exploiting...
Vulnerable APIs and Bot Attacks Costing Businesses Up to $186 Billion Annually
Organizations are losing between $94 - $186 billion annually to vulnerable or insecure APIs Application Programming Interfaces and automated abuse by bots. That's according to The Economic Impact of API and Bot Attacks report from Imperva, a Thales company. The report highlights that these securi...
PT-2024-31846 · Solvait · Solvait
Name of the Vulnerable Software and Affected Versions: Solvait version 24.4.2 Description: A security flaw has been discovered that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in "/AssignToMe/SetAction" API endpoint, an attacker can...