Authentication flaw

An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device...

CVE-2021-28506

CVE-2021-28506 affects Arista EOS via gNOI APIs (OpenConfig gNMI/gNOI and TerminAttr) where authentication/authorization can be skipped, potentially allowing a device factory reset. The Arista advisory lists affected software trains and versions, with remediation by upgrading to remediated releas...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), apis-ampel (=0.1.0) +51 more potentially affected by CVE-2021-45116 via django (>=3.2.0 <=3.2.10)

django PYPI version =3.2.0, =1.0.1a0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =22.0.0.dev30 - autoreduce-utils =0.1.0 - common-framework =2021.4.1 - directory-validators =9.0.0 - django-admin-taggit-ui =0.1.0.dev0 - django-blocklist =1.0.0 - django-brazilian-zipcode =0.1.0 -...

CVE-2021-34086

In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests...

Cross site request forgery (csrf)

In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests...

The vulnerability of Google Chrome’s web APIs, related to the use of memory after it is freed, allows attackers to circumvent existing security restrictions by using a specially created HTML page.

The vulnerability of Google Chrome’s web APIs is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by using a specially created HTML page...

CVE-2021-39998

CVE-2021-39998 affects Huawei HarmonyOS HwConnectivityExService in smartphones. The vulnerability arises from APIs being concurrently called multiple times, which can cause the system to crash and restart. NVD notes a HIGH severity (CVSSv3.1: 7.5) with network attack vector, low authentication/co...

SQL Injection

codeigniter4/framework is vulnerable to SQL injection. The old function in system/Common.php does not properly sanitize the user input, which allows a remote attacker to inject arbitrary SQL commands to the APIs...

CVE-2021-37134

Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface of location-related components...

Race condition

Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface of location-related components...

CVE-2021-37134

CVE-2021-37134 affects HarmonyOS where a race condition in location-related APIs could allow a process to invoke interfaces with higher permissions. The available descriptions identify the vulnerability as a race condition in location components, enabling elevated access, but do not provide produ...

SQLite report about CVE-2022-35737

This bug is an array-bounds overflow. The bug is only accessible when using some of the C-language APIs provided by SQLite. The bug cannot be reached using SQL nor can it be reached by providing SQLite with a corrupt database file. The bug only comes up when very long string inputs greater than 2...

CVE-2021-20050

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data...

CVE-2021-20050

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data...

CVE-2021-20050

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data...

Improper access control

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data...

PT-2021-13743 · Unknown · Sma 100 Series

Name of the Vulnerable Software and Affected Versions: SMA100 series affected versions not specified Description: The issue is related to an improper access control, allowing multiple restricted management APIs to be accessible without requiring a user login. This could potentially expose...

How to Get Started With Application Security

With a comprehensive security stack, Akamai’s application security solutions defend your entire ecosystem from threats. But before you can reap the benefits that come with application security, you need to create a configuration with Akamai’s APIs. Our Developer Advocacy team is here to walk you...

SMA100 Improper Access Control Vulnerability allowed restricted management APIs accessible

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.IMPORTANT: There is no evidence that these vulnerabilities are being exploited in the wild. CVE:...

ALSA-2021:5238 Low: virt:rhel and virt-devel:rhel security update

Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...