EUVD-2023-41875

Malicious code in bioql PyPI...

Closing the Loop on API Security: How Imperva Helps You Expose, Contain, and Mitigate Business Logic Threats

In a world powered by APIs, waiting for an attack is waiting too long. Business logic risks like Broken Object Level Authorization BOLA don’t announce themselves with obvious signatures or malware. They hide in plain sight within normal-looking traffic and by the time a BOLA exploit turns into a...

CVE-2023-38054

A BOLA vulnerability in GET, PUT, DELETE /customers/customerId allows a low privileged user to fetch, modify or delete a low privileged user customer. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38051

A BOLA vulnerability in GET, PUT, DELETE /secretaries/secretaryId allows a low privileged user to fetch, modify or delete a low privileged user secretary. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38055

A BOLA vulnerability in GET, PUT, DELETE /services/serviceId allows a low privileged user to fetch, modify or delete the services of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3286

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

CVE-2023-3289

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3288

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2023-3287

A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user admin in the system. This results in privilege escalation...

CVE-2023-3290

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...

CVE-2024-50633

Summary: CVE-2024-50633 describes a Broken Object Level Authorization (BOLA) in Indico through 3.3.5, where a crafted POST to /api/principals can cause attackers to read information from other user accounts. Affected scope (supported by documents): Indico in versions up to 3.3.5 (notably includin...

CVE-2024-50633: Insertion of Sensitive Information Into Sent Data

A Broken Object Level Authorization BOLA vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain...

CVE-2023-38055

A BOLA vulnerability in GET, PUT, DELETE /services/serviceId allows a low privileged user to fetch, modify or delete the services of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3287

A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user admin in the system. This results in privilege escalation...

CVE-2023-3290

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...

CVE-2023-3286

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

CVE-2023-3288

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2023-3289

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-38050

A BOLA vulnerability in GET, PUT, DELETE /webhooks/webhookId allows a low privileged user to fetch, modify or delete a webhook of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38051

A BOLA vulnerability in GET, PUT, DELETE /secretaries/secretaryId allows a low privileged user to fetch, modify or delete a low privileged user secretary. This results in unauthorized access and unauthorized data manipulation...