978 matches found
CVE-2024-46890
A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated remote attacker with high privileges on the application to execute arbitrary code...
Qualys TotalAppSec Delivers AI-powered Unified Application Risk Management for Modern Web Apps and APIs
" If you can’t measure it, you can’t manage it." - This adage rings truer than ever in the world of cybersecurity. Today, the modern attack surface has exploded, fueled by APIs that now drive 83% of all web traffic, powering critical integrations, microservices, and digital experiences. Security...
API Security Is At the Center of OpenAI vs. DeepSeek Allegations
With a high-stakes battle between OpenAI and its alleged Chinese rival, DeepSeek, API security was catapulted to priority number one in the AI community today. According to multiple reports, OpenAI and Microsoft have been investigating whether DeepSeek improperly used OpenAI’s API to train its ow...
Do We Really Need The OWASP NHI Top 10?
The Open Web Application Security Project has recently introduced a new Top 10 project - the Non-Human Identity NHI Top 10. For years, OWASP has provided security professionals and developers with essential guidance and actionable frameworks through its Top 10 projects, including the widely used...
CVE-2024-55925
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...
CVE-2024-55925
CVE-2024-55925 affects Xerox Workplace Suite. The issue is an API access bypass via manipulating the Host header, exploiting improper host validation that can allow forging a value to access restricted API endpoints. Documents confirm the vulnerability impacts Xerox Workplace Suite versions prior...
CVE-2024-55925 API Security bypass through header manipulation
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...
CVE-2024-55925 API Security bypass through header manipulation
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets...
API Security’s Role in Responsible AI Deployment
By now, you will almost certainly be aware of the transformative impact artificial intelligence AI technologies are having on the world. What you may not be aware of, however, is the role Application Programming Interfaces APIs are playing in the AI revolution. The bottom line is that APIs are...
CVE-2024-34579
The evidence in Connected documents identifies Fuji Electric Alpha5 Smart (Alpha5 SMART) as affected by a stack-based buffer overflow in C5V file parsing. The root cause is failure to validate the length of user-supplied data prior to copying it to a stack-based buffer, enabling potential arbitra...
Akamai API Security Release 3.41
...
Effective API Throttling for Enhanced API Security
APIs are the backbone of modern digital ecosystems, but their misuse can expose systems to cyber threats. Effective API throttling not only optimizes performance but also acts as a critical defense mechanism against abuse, such as denial-of-service attacks. Discover how this powerful strategy...
Top Open Source API Security Tools
The modern world relies on Application Programming Interfaces APIs. They allow applications to communicate with each other, servers, and consumers to facilitate data sharing and simplify application development. Without them, the internet would be unrecognizable. However, APIs also present a...
Major Enhancements to Akamai API Security, Q4 2024
The Akamai API Security updates 3.38, 3.39, and 3.40 include configurable blocking, the automatic creation of posture findings from runtime incidents, and more...
CVE-2024-55949
MinIO is affected by a privilege-escalation flaw in the IAM import API. The issue impacts all users since the commit 580d9db85e04f1b63cc2909af50f0ed08afa965f, with a fix introduced in commit f246c9053f9603e610d98439799bdd2a6b293427 and released in RELEASE.2024-12-13T22-19-12Z. There are no workar...
Simulation of Wasmd message can cause crashing
CWA-2024-009 Severity Low Marginal + Likely^1 Affected versions: - wasmd 0.53.1 Patched versions: - wasmd 0.53.2 please note that wasmd 0.53.1 is broken and must not be used Description of the bug Blank for now. We'll add more detail once chains had a chance to upgrade. Mitigations Apart from...
Protecting Against Bot-Enabled API Abuse
APIs have become the backbone of modern digital ecosystems, powering everything from mobile apps to e-commerce platforms. However, as APIs grow in importance, they also become prime targets for malicious actors. Increasingly, bots are being weaponized to exploit vulnerabilities, overwhelm systems...
Akamai Leads the Way in API Security: GigaOm Radar for API Security Report
...
CVE-2024-52523
Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active sessi...
