CVE-2022-48288

The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48288

CVE-2022-48288 relates to Huawei HarmonyOS, where the bundle management module exposes APIs without authentication/adequate access control. This vulnerability can lead to data confidentiality impacts if an attacker can access or manipulate bundle-related APIs. The available documents do not speci...

CVE-2022-48289

CVE-2022-48289 affects Huawei HarmonyOS (package management module). Multiple sources describe that the package management module lacks authentication and access control in some APIs, enabling a potential influence on data confidentiality. The NVD record notes a Network attack vector with High se...

CVE-2022-48299

CVE-2022-48299 affects Huawei HarmonyOS: the WMS module exposes APIs without proper authentication. Root cause: insufficient authentication in the WMS interface. Impact: potential data confidentiality loss via network access (CVSS 3.1 base score 7.5). Exploitation status is not detailed in the pr...

EulerOS 2.0 SP8 : java-1.8.0-openjdk (EulerOS-SA-2023-1319)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported...

The 2022 State of Spring Survey Report

Hi, Spring fans! You're awesome! I know you're awesome. You know you're awesome. And the Spring team works for you. We like working for you because you dream awesome dreams and build awesome things. And we can't work effectively with and for you if we don't know where everyone stands. Every year ...

Everything You Need To Know About The Latest Imperva Online Fraud Prevention Feature Release

It’s a new year and we have lots of fresh features for Imperva Online Fraud Prevention solution, which encompasses Advanced Bot Protection, Account Takeover Protection, and Client-Side Protection. We have been busy adding a host of new advanced fraud detection and prevention capabilities as well ...

Why Attackers Target the Financial Services Industry

This is Part 1 of a new monthly series from Imperva Threat Research exploring attackers’ motivations to target specific industries. Stay tuned for next months’ exploration of the healthcare industry! Key Takeaways Financial services sites are the most targeted , and it’s important to stay ahead o...

Invalid backup configuration: Team chats backup using protected APIs must the enabled to protect Team chats.

Challenge After upgrading Veeam Backup for Microsoft 365 from v5 to v6a, during the next backup run, or when editing the job or organization, the following error occurs: Invalid backup configuration: Team chats backup using protected APIs must the enabled to protect Team chats. Issue Prevention...

New Ransomware Mimic Emerges in the Wild, Abusing Legitimate Tool for Faster Encryption

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Mimic is a new ransomware that uses the APIs of a legitimate tool called Everything to encrypt target files and has multiple capabilities such as deleting shadow copies, terminating multiple applications...

GHSA-5465-XC2J-6P84 github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context...

New Mimic Ransomware Abuses Everything APIs for its Encryption Process

Trend Micro researchers discovered a new ransomware that abuses the APIs of a legitimate tool called Everything, a Windows filename search engine developed by Voidtools that offers quick searching and real-time updates for minimal resource usage...

Learn from the T-Mobile API Breach to Improve Your API Security Program in 2023

A CISO’s job has never been more challenging. Engineering teams move fast, especially as organizations are accelerating their digital transformation efforts. The tech stack is exploding and varies greatly across the organization. And there is a surge of internal, external, and partner APIs. It’s...

Apache Superset Cross-Site Request Forgery Vulnerability

A cross-site request forgery vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation. The vulnerability stems from the failure of two legacy REST APIs for granting and requesting access to properly validate user input, which could be...

CVE-2022-43719 Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...

.NET 7.0 bugfix update

An update is available for dotnet7.0. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET Core is a managed-software framework. It implements a subset of the .N...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service (CVE-2022-34335)

Summary IBM Sterling Partner Engagement Manager has addressed a vulnerablity in the PCM APIs. Vulnerability Details CVEID:CVE-2022-34335 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a an authenticated user to exhaust server resources which could lead to a denial of service. CV...

Millions of Vehicles at Risk: API Vulnerabilities Uncovered in 16 Major Car Brands

Multiple bugs affecting millions of vehicles from 16 different manufacturers could be abused to unlock, start, and track cars, plus impact the privacy of car owners. The security vulnerabilities were found in the automotive APIs powering Acura, BMW, Ferrari, Ford, Genesis, Honda, Hyundai, Infinit...

Privilege Escalation

github.com/usememos/memos is vulnerable to privilege escalation. Incorrect use of privileged APIs allows an attacker to perform actions on a user's behalf through insecure direct object references resulting in elevated privileges...

PT-2025-49714

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to the handling of request queue quality of service rq qos APIs. Specifically, concurrent access to rq qos without proper synchronization...