Design/Logic Flaw

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

Design/Logic Flaw

The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that have been uninstalled...

Design/Logic Flaw

The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

Design/Logic Flaw

The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

[SECURITY] Fedora 37 Update: tpm2-tss-3.2.2-1.fc37

tpm2-tss is a software stack supporting Trusted Platform ModuleTPM 2.0 syst em APIs. It sits between TPM driver and applications, providing TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers...

CVE-2022-48289

The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48288

The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48289

CVE-2022-48289 affects Huawei HarmonyOS (package management module). Multiple sources describe that the package management module lacks authentication and access control in some APIs, enabling a potential influence on data confidentiality. The NVD record notes a Network attack vector with High se...

CVE-2022-48302

The CVE-2022-48302 issue affects the AMS module in Huawei HarmonyOS. The vulnerability is a lack of permission verification in APIs, enabling a potential attacker to access sensitive data without authentication. According to the provided data, the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)...

CVE-2022-48302

The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48288

CVE-2022-48288 relates to Huawei HarmonyOS, where the bundle management module exposes APIs without authentication/adequate access control. This vulnerability can lead to data confidentiality impacts if an attacker can access or manipulate bundle-related APIs. The available documents do not speci...

CVE-2022-48299

CVE-2022-48299 affects Huawei HarmonyOS: the WMS module exposes APIs without proper authentication. Root cause: insufficient authentication in the WMS interface. Impact: potential data confidentiality loss via network access (CVSS 3.1 base score 7.5). Exploitation status is not detailed in the pr...

CVE-2022-48300

CVE-2022-48300 affects Huawei HarmonyOS WMS module where certain APIs lack authentication, enabling potential data confidentiality impact. The issue is documented with CVSS v3.1 base score 7.5 (Network vector, Low attack complexity, No privileges required, Confidentiality impact High). Connected ...

EulerOS 2.0 SP8 : java-1.8.0-openjdk (EulerOS-SA-2023-1319)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported...

The 2022 State of Spring Survey Report

Hi, Spring fans! You're awesome! I know you're awesome. You know you're awesome. And the Spring team works for you. We like working for you because you dream awesome dreams and build awesome things. And we can't work effectively with and for you if we don't know where everyone stands. Every year ...

Everything You Need To Know About The Latest Imperva Online Fraud Prevention Feature Release

It’s a new year and we have lots of fresh features for Imperva Online Fraud Prevention solution, which encompasses Advanced Bot Protection, Account Takeover Protection, and Client-Side Protection. We have been busy adding a host of new advanced fraud detection and prevention capabilities as well ...

Why Attackers Target the Financial Services Industry

This is Part 1 of a new monthly series from Imperva Threat Research exploring attackers’ motivations to target specific industries. Stay tuned for next months’ exploration of the healthcare industry! Key Takeaways Financial services sites are the most targeted , and it’s important to stay ahead o...

Invalid backup configuration: Team chats backup using protected APIs must the enabled to protect Team chats.

Challenge After upgrading Veeam Backup for Microsoft 365 from v5 to v6a, during the next backup run, or when editing the job or organization, the following error occurs: Invalid backup configuration: Team chats backup using protected APIs must the enabled to protect Team chats. Issue Prevention...

New Ransomware Mimic Emerges in the Wild, Abusing Legitimate Tool for Faster Encryption

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Mimic is a new ransomware that uses the APIs of a legitimate tool called Everything to encrypt target files and has multiple capabilities such as deleting shadow copies, terminating multiple applications...

GHSA-5465-XC2J-6P84 github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context...