The vulnerability in the API interfaces of Google Chrome and Microsoft Edge browsers allows attackers to disclose protected information or cause service failures.

The vulnerability of Google Chrome and Microsoft Edge browser extension APIs is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow a malicious actor to disclose protected information or cause service failures through a specially create...

CVE-2022-2023

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4...

CVE-2022-2023

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4...

Code injection

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4...

CVE-2022-2023 Incorrect Use of Privileged APIs in polonel/trudesk

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4...

CVE-2022-2023 Incorrect Use of Privileged APIs in polonel/trudesk

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4...

CVE-2022-2023

CVE-2022-2023 concerns polonel/trudesk before 1.2.4 due to incorrect use of privileged APIs. Affected: polonel/trudesk, prior to 1.2.4. Root cause: improper handling of privileged APIs within the GitHub repo. Impact (as per sources): high severity with network attack vector and partial confidenti...

ASUS Control Center 安全漏洞

ASUS Control Center is a new centralized IT management software from ASUS China. The software can monitor and control ASUS servers, workstations. A security vulnerability exists in ASUS Control Center v1.4.2.5, which stems from a corrupted access control issue in the API. An unauthenticated remot...

GHSA-3JCH-9QGP-4844 Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit...

Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit...

CVE-2022-29247 Exposure of Resource to Wrong Sphere in Electron

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...

CVE-2022-31757

Technical details, affected products, and remediation are not publicly provided in the supplied documents. Monitor updates from Red Hat, NVD, and other sources for concrete impact and fixes.

CVE-2022-31757

The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality...

Cloud data breaches: 4 biggest threats to cloud storage security

Just about anywhere you look, organizations are using the cloud in some form—and they’re not all large enterprises. Small and medium businesses SMBs are also reaping the many benefits that the cloud offers over on-premise software, especially the lowered IT costs, increased scalability, and large...

This Week in Spring - June 7th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Ive just landed in tantalizing Toronto, Canada, for the SpringOne Tour Toronto show. Im so excited to be here, at long last, after so long away from one of my favorite countries. Ill be doing two talks - my usual, Kubernetes...

Privilege Escalation

chromium is vulnerable to privilege escalation. The vulnerability exists through the extension APIs allowing an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page...

Remote Code Execution (RCE)

chromium is vulnerable to remote code execution. An attacker can inject and execute malicious code through the extension APIs allowing an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page...

Mitmproxy2Swagger - Automagically Reverse-Engineer REST APIs Via Capturing Traffic

A tool for automatically converting mitmproxy captures to OpenAPI 3.0 specifications. This means that you can automatically reverse-engineer REST APIs by just running the apps and capturing the traffic. Installation First you will need python3 and pip3. $ pip install mitmproxy2swagger ... or ... ...

IBM InfoSphere BigInsights Invalid Input Vulnerability

Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data...

Improper Verification of Cryptographic Signature in matrix-synapse

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...