CVE-2026-87801

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

CVE-2026-87801

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

CVE-2026-87801

Synology DiskStation Manager (DSM) is vulnerable to an insertion of sensitive information into sent data within the API framework . This flaw allows remote authenticated users to read arbitrary files on the affected system. The vulnerability impacts versions prior to 7.3.2-86009-5 and 7.4.1-90080...

EUVD-2026-124191

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

PT-2026-145695

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

CVE-2026-87801: Synology DiskStation Manager (DSM): An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager…

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

CVE-2026-92887

A flaw was found in Apache OFBiz. The REST API framework parser incorrectly defaults authentication to disabled when the auth attribute is omitted from an endpoint definition. A remote, unauthenticated attacker can exploit this vulnerability to invoke REST API operations without providing valid...

CVE-2026-92887: Apache Software Foundation Apache OFBiz: Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz…

Incorrect default value in the REST API framework's .rest.xml definition parser ModelApiReader in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation...

Apache OFBiz configuration error vulnerability

Apache OFBiz versions 24.09.07 and earlier contain a security vulnerability. This vulnerability stems from incorrect default values in the REST API framework’s .rest.xml definition parser ModelApiReader. When the auth attribute is omitted, it is erroneously parsed as false instead of the true...

CVE-2020-24623

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...

CVE-2024-45538

Cross-Site Request Forgery CSRF vulnerability in WebAPI Framework in Synology DiskStation Manager DSM before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller DSMUC before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors...

PT-2025-49024

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-2 Synology DiskStation Manager DSM versions 7.2.1-69057-2 through 7.2.2-72806 Synology Unified Controller DSMUC versions prior to 3.1.4-23079 Description A Cross-Site Request Forge...

EUVD-2020-17339

Malware in sbrugna...

EUVD-2020-24388

Malware in sbrugna...

Our New Carbon Calculator Report Supports 400 Days of Data

The new Carbon Calculator is supported by the latest reporting API framework, improves performance, and allows customers to monitor up to 400 days of data...

CVE-2020-3117

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient...

Input validation

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient...

CVE-2020-3117 Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient...

Hewlett Packard Enterprise Universal API Framework uaf_token SQL Injection Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Hewlett Packard Enterprise Universal API Framework. Authentication is not required to exploit this vulnerability. The specific flaw exists within the connections resource. A crafted...

CVE-2020-24623

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...