3049 matches found
CVE-2025-21031
Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs...
SAMSUNG Mobile devices 安全漏洞
SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices versions prior to SMR Sep-2025 Release 1, which stems from improper access control and could...
Exploiting API4 — 8 Real-World Unrestricted Resource Consumption Attack Scenarios (and How to Stop Them)
Unrestricted Resource ConsumptionAPI4:2023 is the only threat category in the OWASP API Security Top 10 explicitly dedicated to Denial of Service DoS and resource abuse. But despite being just one category, attackers can exploit it in many different ways; from large file uploads and expensive...
CVE-2024-57157
Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token...
GHSA-PJ6F-RC94-GW53 Mattermost Fails to Sanitize File Names
Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 10.10.x = 10.10.0, 10.9.x = 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs...
CVE-2025-47700 AI plugin APIs can be triggered using post actions
Mattermost Server versions 10.5.x = 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions...
CVE-2024-57155
Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token...
Jantent 安全漏洞
Jantent is a simple to use website by Jack Tang, an individual developer. A security vulnerability exists in Jantent v1.1, which stems from improper access control and could lead to unauthorized access to sensitive APIs...
CVE-2024-57155
Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token...
Radar 安全漏洞
Radar wind control engine is a lightweight real-time wind control engine by feihu.wang individual developers. A security vulnerability exists in Radar v1.0.8, which stems from improper access control and could lead to unauthorized access to sensitive APIs...
PT-2025-34073 · Jantent · Jantent
Name of the Vulnerable Software and Affected Versions: Jantent version 1.1 Description: Incorrect access control in Jantent version 1.1 allows attackers to bypass authentication and access sensitive APIs without a token. Recommendations: At the moment, there is no information about a newer versio...
MAL-2025-32835 Malicious code in scripts-checkout-apis-temp (npm)
The package scripts-checkout-apis-temp was found to contain malicious code...
Malicious code in scripts-checkout-apis-temp (npm)
The package scripts-checkout-apis-temp was found to contain malicious code...
PT-2025-34571 · Crates.Io · Scratchpad
The get and set methods of the public trait scratchpad::Tracking interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the...
CVE-2025-25231
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests read-only to restricted API endpoints...
BIT-PYTHON-2025-8194 Tarfile infinite loop during parsing with negative member offset
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives...
Exploit for Code Injection in Xwiki
📜 Description A critical RCE vulnerability exists in...
CVE-2025-21016
Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 allows local attackers to use the privileged APIs...
