99 matches found
CVE-2025-13480
Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been...
EUVD-2026-20640
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs...
[SECURITY] Fedora 43 Update: corosync-3.1.10-2.fc43
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
EUVD-2025-209072
HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to attackers, unauthorized access to APIs, and possible data manipulation or leakage. If an attacker to exploit CORS misconfiguration, they...
CVE-2025-71257
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality a...
Apps, APIs, and DDoS 2026: The Industrialization of Cyberattack Campaigns
...
CVE-2026-4312
Affected product: DrangSoft GCB/FCB Audit Software. Vulnerability: Missing Authentication, enabling unauthenticated remote attackers to directly access APIs and create a new administrative account. Impact/risks: High impact on confidentiality, integrity, and availability as per CVSS metrics (CRIT...
CVE-2026-28254 Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs...
OliveTin 安全漏洞
OliveTin is an open-source web application developed by OliveTin. Versions of OliveTin prior to 300.11.1 contained security vulnerabilities. These vulnerabilities were due to authorization flaws, which could allow verified users with the view: false permission to enumerate bindings and metadata...
The vulnerability of the centralized network management system Cisco Catalyst SD-WAN Manager, related to errors in the use of privileged application programming interfaces (APIs), allows a perpetrator to escalate their privileges.
The vulnerability of the centralized network management system, Cisco Catalyst SD-WAN Manager, is related to errors that occur when privileged application programming interfaces APIs are used. Exploiting this vulnerability can allow an attacker to increase their privileges...
Free CRM 授权问题漏洞
Free CRM is a customer relationship management software developed by go2ismail’s individual developers. Free CRM has authorization issues and vulnerabilities; these vulnerabilities arise from improper authorization due to operations on parameters in files, APIs, or Security settings...
HP多款产品 安全漏洞
The HP Samsung MultiXpress SL-X7600LXR, among others, is a color laser digital printer produced by the American company HP. Several HP products have security vulnerabilities; these vulnerabilities stem from insufficient authorization in certain APIs, which may lead to information leaks. The...
CVE-2025-52024
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services,...
CVE-2025-52022
The PHP backend of the Aptsys Gemscms POS Platform (specifically gemsloyalty.aptsys.com.sg) is vulnerable to information exposure through error messages (CWE-209 ). Unauthenticated remote attackers can send specially crafted HTTP GET/POST requests to public API endpoints to trigger detailed error...
CVE-2025-66698
An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints...
Astra Linux – Vulnerability in Firefox
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1...
CVE-2025-67811
Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4...
Your Guide to PCI DSS 4.0.1 Web Application and API Controls with a Simplified Path to Compliance
Executive Summary PCI DSS 4.0.1 compliance mandates stricter security controls for web applications and APIs. Key updates include maintaining an inventory of custom software PCI 6.3.2 and managing payment page scripts to prevent skimming attacks PCI 6.4.3. Organizations must also adopt risk-based...
