CVE-2023-21637: Improper Restriction of Operations within the Bounds of a Memory Buffer

Memory corruption in Linux while calling system configuration APIs...

New Mockingjay Process Injection Technique Could Let Malware Evade Detection

A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. "The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers...

PT-2023-9601 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A vulnerability has been discovered in the experimental permission model of Node.js, specifically related to improper handling of Buffers in file system APIs, causing a traversal path to bypass when verifying...

CVE-2023-34156

Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied...

CVE-2023-34156

Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied...

CVE-2023-29531

Technical details about CVE-2023-29531 (affected product, root cause, impact, or fix) are not provided in the connected documents. Monitor for updates from Mozilla and security advisories.

CVE-2023-29531

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected. This vulnerability affects Firefox 112, Firefox ESR...

CVE-2023-29531

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected. This vulnerability affects Firefox 112, Firefox ESR...

CVE-2023-34166

Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart...

CVE-2023-34156

CVE-2023-34156 affects Huawei/HarmonyOS due to a vulnerability in the early fingerprint APIs that can cause a denial of service. The NVD entry reports a CVSS v3.1 base score of 5.3 (Network, Low attack complexity, No privileges required, Availability impact: Low). Connected sources confirm Harmon...

PT-2023-24697 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: HarmonyOS affected versions not specified Description: The issue concerns a vulnerability of services denied by early fingerprint APIs on HarmonyOS products. Successful exploitation may cause services to be denied. Recommendations: At the...

CVE-2023-34166

CVE-2023-34166 is linked to Huawei HarmonyOS in the provided documents. The Huawei/CNNVD entry describes a vulnerability in which an interface pass-in exception callback to APIs can cause a system reboot by an attacker. The NVD entry lists a CVSSv3.1 base score of 7.5 (Network, Low attack complex...

CVE-2023-34156: Session Fixation

Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied...

CVE-2023-29531: Out-of-bounds Write

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected. This vulnerability affects Firefox 112, Firefox ESR...

CVE-2023-2787 Collapsed Reply Threads APIs leak message contents from private channels

Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API...

How to Improve Your API Security Posture

APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectivity doesn't come without major risks. Hackers can exploit vulnerabilities in APIs to gain unauthorized access to sensitive data or even ta...

CVE-2022-46308

SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information...

Authorization

SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information...

CVE-2022-46308 SGUDA U-Lock - Broken Access Control

SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information...

PT-2023-14905 · Sguda · Sguda U-Lock

Name of the Vulnerable Software and Affected Versions: SGUDA U-Lock central lock control service affected versions not specified Description: The issue is related to incorrect authorization in the user management function of the SGUDA U-Lock central lock control service. A remote attacker with...