CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

PT-2024-12688 · Easyappointments +2 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "GET, PUT, DELETE /customers/customerId" endpoint allows a low-privileged user to fetch, modify, or delete a customer,...

PT-2024-12687 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in GET, PUT, DELETE "/settings/settingName" allows a low privileged user to fetch, modify or delete the settings of any user,...

PT-2024-12682 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software name or affected versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "GET, PUT, DELETE /providers/providerId" endpoint allows a low-privileged user to fetch, modify, or delete a...

PT-2024-12686 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the API endpoints "GET, PUT, DELETE /admins/adminId" allows a low-privileged user to fetch, modify, or delete a high-privileged...

PT-2024-12344 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: A BOLA vulnerability in the "POST /appointments" endpoint allows a low-privileged user to create an appointment for any user in the system, including administrators. This results in...

GHSA-67RV-QPW2-6QRR Grafana: Users outside an organization can delete a snapshot with its key

Summary The DELETE /api/snapshots/key endpoint allows any Grafana user to delete snapshots if the user is NOT in the organization of the snapshot Details An attacker a user without organization affiliation or with a "no basic role" in an organization other than the one where the dashboard exists,...

Grafana: Users outside an organization can delete a snapshot with its key

Summary The DELETE /api/snapshots/key endpoint allows any Grafana user to delete snapshots if the user is NOT in the organization of the snapshot Details An attacker a user without organization affiliation or with a "no basic role" in an organization other than the one where the dashboard exists,...

PT-2024-3766 · Grafana +6 · Grafana +6

Name of the Vulnerable Software and Affected Versions: Grafana versions 9.5.0 through 9.5.17 Grafana versions 10.0.0 through 10.0.12 Grafana versions 10.1.0 through 10.1.8 Grafana versions 10.2.0 through 10.2.5 Grafana versions 10.3.0 through 10.3.4 Description: The issue is related to a Broken...

Understanding the OWASP API Security Top 10: Why BOLA is the Number One Risk for APIs

Understanding and addressing vulnerabilities is critical in cybersecurity, where APIs serve as the backbone for seamless data exchange. The OWASP API Security Top 10, revised in 2023, provides a comprehensive guide to the critical issues that organizations must tackle to ensure the robust securit...

MAL-2023-8335 Malicious code in agen-sbobet-judi-bola-online-terpercaya-paling-lengkap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a4f992569321418e44d0198225fca97602cc4663908efad4fc4772d1ef27ed7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Beware of BOLA (IDOR) Vulnerabilities in Web Apps and APIs

Introduction In a recent advisory, the Cybersecurity and Infrastructure Security Agency CISA warned vendors, designers, developers, and end-user organizations of web applications about the dangers posed by Insecure Direct Object Reference IDOR vulnerabilities, now commonly referred to as BOLA...

2023 OWASP Top-10 Series: API1:2023 Broken Object Level Authorization

Welcome to the 2nd post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API1:2023 Broken Object Level Authorization. In this series we are taking an in-depth look at each category – the details, the...

Learn from the T-Mobile API Breach to Improve Your API Security Program in 2023

A CISO’s job has never been more challenging. Engineering teams move fast, especially as organizations are accelerating their digital transformation efforts. The tech stack is exploding and varies greatly across the organization. And there is a surge of internal, external, and partner APIs. It’s...

Top 3 APIs Vulnerabilities: Why Apps are Pwned by Cyberattackers

Application programming interfaces APIs have become the glue that holds today’s apps together. There’s an API to turn on the kitchen lights while still in bed. There’s an API to change the song playing on your house speakers. Whether the app is on your mobile device, entertainment system or garag...

Coursera Flunks API Test in Researchers’ Security Exam

Researchers have discovered multiple application programming interface API issues in Coursera, the online learning platform used by 82 million learners and hundreds of Fortune 500 companies. On Thursday, the Checkmarx Security Research Team published a report on its findings, which included user...

mHealth Apps Expose Millions to Cyberattacks

Some 23 million mobile health mHealth application users are exposed to application programming interface API attacks that could expose sensitive information, according to researchers. Generally speaking, APIs are an intermediary between applications that defines how they can talk to one another a...