GHSA-P7J5-4MWM-HV86 Duplicate Advisory: Cross-site scripting in TinyMCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gm-ghr9-4v95. This link is maintained to preserve external references. Original Description TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin...

Duplicate Advisory: Cross-site scripting in TinyMCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gm-ghr9-4v95. This link is maintained to preserve external references. Original Description TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin...

CVE-2020-35758

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a Authentication Bypass in the Web Interface. This interface does not properly restrict access to internal functionality. Despite presenting a password login page on first access, authentication is not required to access...

CVE-2020-35758

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a Authentication Bypass in the Web Interface. This interface does not properly restrict access to internal functionality. Despite presenting a password login page on first access, authentication is not required to access...

Authentication flaw

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a Authentication Bypass in the Web Interface. This interface does not properly restrict access to internal functionality. Despite presenting a password login page on first access, authentication is not required to access...

CVE-2020-35758

The CVE-2020-35758 entry concerns Libre Wireless LS9 LS1.5/p7040 devices with a web interface authentication bypass. The issue allows unauthenticated access to privileged APIs because access restrictions on internal functionality are not properly enforced, despite a login page appearing. Document...

Imperva to acquire CloudVector: Prioritizing API Protection for Modern Environments

I am excited to announce Imperva has entered into an agreement to acquire CloudVector to advance our mission to protect data and all paths to it. Together, we believe we can change what organizations expect from Web Application and API Protection solutions. There are multiple reasons APIs are at...

CVE-2021-2231

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: APIs. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of...

CVE-2021-2231

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: APIs. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of...

CVE-2021-2231

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: APIs. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of...

Unspecified Vulnerability in Samsung SMR (CNVD-2021-30496)

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in SMR APR-2021 Release 1, which stems from a faulty exception control in softsimd that allows an unprivileged application to access APIs in...

Akamai Recognized as 2021 Gartner Peer Insights Customers' Choice for Web Application Firewalls

Akamai has been named a Gartner Peer Insights Customers' Choice for Web Application Firewalls for the second time. Gartner defines web application firewalls WAFs as "solutions designed to protect web applications and APIs from a variety of attacks, including automated bots, injection and...

Wallarm API Discovery: Discover API endpoints automatically and secure them

What do you know about your APIs? Why are the vulnerable v2 and v3 still exposed if they are deprecated for almost a year? What else is exposed and you don’t even know? Are Swagger specs up to date? Teaser: Surely not. A lot of questions, right? Meet Wallarm’s latest feature for API Discovery and...

GHSA-MMHJ-4W6J-76H7 Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate

Versions of isolated-vm before v4.0.0, and especially before v3.0.0, have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to the underlying reference's full prototype chain. In an...

Uber: Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PII

The security researchers discovered a number of connected IDORs in the Uber business and voucher applications. By chaining these vulnerabilities together, the researchers could retrieve information related to existing voucher policies and modify those policies for monetary gain, such as for free...

How to build a successful application security program

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Tanya Janca, Founder of We Hack Purple...

TIBCO Software TIBCO API Exchange Gateway Clickjacking Vulnerability

TIBCO Software TIBCO API Exchange Gateway is an application from TIBCO Software, Inc. It provides a central access point for managing enterprise APIs and provides an intermediary program between internal and external services, systems and devices. A security vulnerability exists in TIBCO API...

Security update for connman (moderate)

openSUSE Security Update: Security update for connman Announcement ID: openSUSE-SU-2021:0452-1 Rating: moderate References: 1181751 Cross-References: CVE-2021-26675 CVE-2021-26676 CVSS scores: CVE-2021-26675 NVD : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26676 NVD : 6.5...

Securing Containers and Kubernetes-Orchestrated Environments

In a recent Black Hat webcast, “Securing Containers and Kubernetes-Orchestrated Environments,” sponsored by VMware Carbon Black, guest speakers Sheila A. Berta, Offensive Security Specialist, Dreamlab Technologies and Haim Helman, CTO, VMware Carbon Black App Security, VMware Security Business...

OPENSUSE-SU-2021:0416-1 Security update for connman

This update for connman fixes the following issues: Update to 1.39 boo1181751: Fix issue with scanning state synchronization and iwd. Fix issue with invalid key with 4-way handshake offloading. Fix issue with DNS proxy length checks to prevent buffer overflow. CVE-2021-26675 Fix issue with DHCP...