2943 matches found
アプリケーションおよびサービス プリンシパル API での Azure Active Directory (AD) keyCredential プロパティの情報漏えいに関するガイダンス
本ブログは、“Guidance for Azure Active Directory AD keyCredential property Information Disclosure in Application and Service Principal APIs” の抄訳版です。最新の情報は、原本...
CVE-2021-42306
creationtimestamp| type| source ---|---|--- 2021-11-17 07:00:00+00:00| seen| https://msrc.microsoft.com/blog/2021/11/guidance-for-azure-active-directory-ad-keycredential-property-information-disclosure-in-application-and-service-principal-apis/ 2021-11-18 13:13:22+00:00| published-proof-of-concep...
SQL Injection
doctrine/dbal is vulnerable to SQL injection. The modifyLimitQuery function in src/Platforms/AbstractPlatform.php does not properly sanitize the input, which allows a remote attacker to inject arbitrary SQL commands to the APIs...
Protecting today’s web applications requires more than a firewall
The way organizations build web applications has changed dramatically over the last several years. As a result, many organizations are considering additional security strategies to augment the Web Application Firewall WAF on which they have relied to protect critical digital business operations...
Mozilla Firefox Security Advisory (MFSA2015-148) - Linux
This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
kernel: mm: memcontrol: slab: fix obtain a reference to a freeing memcg
In the Linux kernel, the following vulnerability has been resolved: mm: memcontrol: slab: fix obtain a reference to a freeing memcg Patch series "Use objcgroup APIs to charge kmem pages", v5. Since Roman's series "The new cgroup slab memory controller" applied. All slab objects are charged with t...
Discovering Shadow APIs with Wallarm API firewall
Shadow APIs can be defined as active endpoints that you are not aware of. Some APIs are deployed but never documented. Others are services that don’t have an owner anymore. Some are even old v2 versions that have been deprecated for years, yet still exposed. Long story short: these APIs are not...
Discovering shadow APIs with a API firewall
Shadow APIs can be defined as active endpoints that you are not aware of. Some APIs are deployed but never documented. Others are services that don’t have an owner anymore. Some are even old v2 versions that have been deprecated for years, yet still exposed. Long story short: these APIs are not...
Akamai App & API Protector: Maximize Security Through Simplicity
Building incredible digital experiences often involves leveraging serverless edge computing, microservices-based architectures, IaaS environments, client-side functionality, and APIs. These modern development practices, while designed to produce highly personalized, fast, and always-on user...
Pentaho Business Analytics / Pentaho Business Server 9.1 Authentication Bypass Vulnerability
Product: Pentaho Business Analytics / Pentaho Business Server Vendor / Manufacturer: Hitachi Vantara Affected Versions: sec:intercept-url pattern="\A/api/.\Z" access="Authent...
PYSEC-2021-617
TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...
CVE-2021-41208
TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...
Pentaho Business Analytics / Pentaho Business Server 9.1 Authentication Bypass
Product: Pentaho Business Analytics / Pentaho Business Server Vendor / Manufacturer: Hitachi Vantara Affected Versions: sec:intercept-url pattern="\A/api/.require-js-cfg.js.\Z" access="Anonymous,...
Code injection
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results i...
CVE-2021-21696
An incorrect permissions validation vulnerability was found in Jenkins. An agent process read/write access to the libs/ directory inside build directories when using the FilePath APIs is not limited. This allows attackers in control of agent processes to replace the code of a trusted library with...
CVE-2021-21696
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results i...
CVE-2021-33210
An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can in the WebUI obtain plant information without authentication by reading the response of APIs from a kiosk view of a plant...
Authentication flaw
An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can in the WebUI obtain plant information without authentication by reading the response of APIs from a kiosk view of a plant...
Nextcloud: SQL injextion via vulnerable doctrine/dbal version
Summary: SQL injection via limit parameter on user facing APIs Steps To Reproduce: Run security scanner: 1. REPORT /remote.php/dav/comments/files/1985 1. XML input oc:filter-comments.oc:limittext was set to 1'" 1. You have an error in your SQL syntax Supporting Material/References: For more detai...