CVE-2020-14456

An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006...

CVE-2018-1000800

zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sysringbufput, sysringbufget that can result in CPU Page Fault error code 0x00000010. This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs system sysringbufget and...

CVE-2013-2304

The Sleipnir Mobile application 2.8.0 and earlier and Sleipnir Mobile Black Edition application 2.8.0 and earlier for Android allow remote attackers to load arbitrary Extension APIs, and trigger downloads or obtain sensitive HTTP response-body information, via a crafted web page...

CVE-2018-21049

An issue was discovered on Samsung mobile devices with N7.x and O8.X Exynos chipsets software. There is an arbitrary memory write in a Trustlet because a secure driver allows access to sensitive APIs. The Samsung ID is SVE-2018-12881 November 2018...

CVE-2019-2315

While invoking the API to copy from fd or local buffer to the secure buffer, Parameters being populated are from non secure environment. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music...

CVE-2019-10561

Improper initialization of local variables which are parameters to sfs api may cause invalid pointer dereference and leads to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon...

CVE-2018-7272

The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file...

CVE-2019-16517

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative...

CVE-2012-6334

The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices does not properly implement Location APIs, which allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."...

CVE-2016-10815

cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs SEC-120...

EulerOS Virtualization 2.12.1 : openssl (EulerOS-SA-2025-1550)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...

Securing the Code: Building a Culture of Credential Protection in Dev Teams

Credential protection is key to preventing breaches. Secure APIs, rotate secrets and train devs to handle credentials safely…...

Malicious code in nayan-imgur-upload-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83086119743263f9bdf6c297c723c4435596eb345ae1346780b6cb9c49e0e597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3842 Malicious code in nayan-apis-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29f6aa37009fdc9a41baec1f7003012ff794de3dc17eaae4aa1c50aadba83bd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3843 Malicious code in nayan-imgur-upload-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83086119743263f9bdf6c297c723c4435596eb345ae1346780b6cb9c49e0e597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nayan-apis-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29f6aa37009fdc9a41baec1f7003012ff794de3dc17eaae4aa1c50aadba83bd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in imran-photo360-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50eee3813bcaa9eb9f2b3a96b47f8822b60b91073e385c5d3161fce029d42287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-21176 · Electron +1 · Electron +1

Name of the Vulnerable Software and Affected Versions: 5ire versions prior to 0.11.1 Description: The issue is related to stored cross-site scripting in chatbot responses due to insufficient sanitization, which can lead to Remote Code Execution RCE via unsafe Electron protocol handling and expose...

Browser Security Posture Analysis: a Client-Side Security Assessment Framework

Modern web browsers have effectively become the new operating system for business applications, yet their security posture is often under-scrutinized. This paper presents a novel, comprehensive Browser Security Posture Analysis Framework1, a browser-based client-side security assessment toolkit...

CVE-2025-37842

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kern...