3009 matches found
CVE-2022-48300
CVE-2022-48300 affects Huawei HarmonyOS WMS module where certain APIs lack authentication, enabling potential data confidentiality impact. The issue is documented with CVSS v3.1 base score 7.5 (Network vector, Low attack complexity, No privileges required, Confidentiality impact High). Connected ...
EulerOS 2.0 SP8 : java-1.8.0-openjdk (EulerOS-SA-2023-1319)
According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported...
The 2022 State of Spring Survey Report
Hi, Spring fans! You're awesome! I know you're awesome. You know you're awesome. And the Spring team works for you. We like working for you because you dream awesome dreams and build awesome things. And we can't work effectively with and for you if we don't know where everyone stands. Every year ...
Everything You Need To Know About The Latest Imperva Online Fraud Prevention Feature Release
It’s a new year and we have lots of fresh features for Imperva Online Fraud Prevention solution, which encompasses Advanced Bot Protection, Account Takeover Protection, and Client-Side Protection. We have been busy adding a host of new advanced fraud detection and prevention capabilities as well ...
Why Attackers Target the Financial Services Industry
This is Part 1 of a new monthly series from Imperva Threat Research exploring attackers’ motivations to target specific industries. Stay tuned for next months’ exploration of the healthcare industry! Key Takeaways Financial services sites are the most targeted , and it’s important to stay ahead o...
Invalid backup configuration: Team chats backup using protected APIs must the enabled to protect Team chats.
Challenge After upgrading Veeam Backup for Microsoft 365 from v5 to v6a, during the next backup run, or when editing the job or organization, the following error occurs: Invalid backup configuration: Team chats backup using protected APIs must the enabled to protect Team chats. Issue Prevention...
New Ransomware Mimic Emerges in the Wild, Abusing Legitimate Tool for Faster Encryption
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Mimic is a new ransomware that uses the APIs of a legitimate tool called Everything to encrypt target files and has multiple capabilities such as deleting shadow copies, terminating multiple applications...
GHSA-5465-XC2J-6P84 github.com/openshift/apiserver-library-go Improper Input Validation vulnerability
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context...
New Mimic Ransomware Abuses Everything APIs for its Encryption Process
Trend Micro researchers discovered a new ransomware that abuses the APIs of a legitimate tool called Everything, a Windows filename search engine developed by Voidtools that offers quick searching and real-time updates for minimal resource usage...
Learn from the T-Mobile API Breach to Improve Your API Security Program in 2023
A CISO’s job has never been more challenging. Engineering teams move fast, especially as organizations are accelerating their digital transformation efforts. The tech stack is exploding and varies greatly across the organization. And there is a surge of internal, external, and partner APIs. It’s...
Apache Superset Cross-Site Request Forgery Vulnerability
A cross-site request forgery vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation. The vulnerability stems from the failure of two legacy REST APIs for granting and requesting access to properly validate user input, which could be...
CVE-2022-43719 Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...
.NET 7.0 bugfix update
An update is available for dotnet7.0. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET Core is a managed-software framework. It implements a subset of the .N...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service (CVE-2022-34335)
Summary IBM Sterling Partner Engagement Manager has addressed a vulnerablity in the PCM APIs. Vulnerability Details CVEID:CVE-2022-34335 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a an authenticated user to exhaust server resources which could lead to a denial of service. CV...
Millions of Vehicles at Risk: API Vulnerabilities Uncovered in 16 Major Car Brands
Multiple bugs affecting millions of vehicles from 16 different manufacturers could be abused to unlock, start, and track cars, plus impact the privacy of car owners. The security vulnerabilities were found in the automotive APIs powering Acura, BMW, Ferrari, Ford, Genesis, Honda, Hyundai, Infinit...
Privilege Escalation
github.com/usememos/memos is vulnerable to privilege escalation. Incorrect use of privileged APIs allows an attacker to perform actions on a user's behalf through insecure direct object references resulting in elevated privileges...
SQLite report about CVE-2023-7104
This is a bug in the session extension of SQLite, not in the SQLite core. This bug is only reachable by applications that recompile SQLite using the -DSQLITEENABLESESSION compile-time option and then use the Session C-language APIs to process a changeset that has been subtly corrupted by an...
PT-2025-49714
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to the handling of request queue quality of service rq qos APIs. Specifically, concurrent access to rq qos without proper synchronization...
GHSA-GHX2-6V4G-9WMM usememos/memos makes Incorrect Use of Privileged APIs
In usememos/memos 0.9.0 and prior, a user with login permission can delete all notes of the whole application via API DELETE https://demo.usememos.com/api/memo/$idnote. The vulnerability will lose all user notes data throughout the system, causing damage to user data...
