67988 matches found
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the queryId parameter in the CREST REST API endpoints. An attacker can manipulate LDAP queries by injecting arbitrary LDAP...
GHSA-2VG8-Q4C2-5CW3 OpenAM has LDAP Injection via `_queryId` Parameter
OpenAM Open Identity Platform is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilities. The CREST REST API layer exposes user query endpoints under /json/realm/users. In IdentityResourceV1.queryCollection, the HTTP query parameter queryId is passed to a CrestQue...
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
Summary The Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying a valid transaction ID from a small legitimate purchase, the...
CVE-2026-12249
creationtimestamp| type| source ---|---|--- 2026-06-22 19:32:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movmu4ylmw2q 2026-06-23 16:29:16+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116800366330235493 2026-09-28 17:40:07+00:00| seen|...
CVE-2026-53778
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
MINI-8XFH-W4MG-J9V9
Bulletin has no description...
MINI-P37C-VG6J-35QX
Bulletin has no description...
MINI-V2VG-R633-QGRQ
Bulletin has no description...
MINI-X394-F977-VHXG
Bulletin has no description...
MINI-MWJF-QP8R-7R7H
Bulletin has no description...
MINI-VCMW-H3FR-MC65
Bulletin has no description...
MINI-CF8X-FVQ9-VM6G
Bulletin has no description...
MINI-6PQ3-CRXJ-7P32
Bulletin has no description...
MINI-P2J5-R4J6-FPHW
Bulletin has no description...
MINI-X6QM-78PP-FJQP
Bulletin has no description...
CVE-2026-54267
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered SSR environments, Angular supports Hydration via...
MINI-3FH4-6J6M-P3G5
Bulletin has no description...
CVE-2026-8074
Mattermost versions 11.7.x = 11.7.0, 10.11.x = 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/id/active API...
Document delivery scams: What are they and what’s their goal?
One of Malwarebytes' managers recently received a call from scammers pretending to be a document delivery service. The voicemail sounded official: “I am calling on behalf of document delivery services. We have been retained to schedule and deliver legal documents to you between the hours of 8 AM...