Improper access control

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability...

CVE-2019-1000011

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability...

CVE-2019-1000011: Undefined Security Weakness

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability...

Improper Access Control

API Platform contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized...

PT-2019-11264

Name of the Vulnerable Software and Affected Versions: API Platform versions 2.2.0 through 2.3.5 Description: The issue is related to an Incorrect Access Control vulnerability in GraphQL delete mutations. This allows a user who is authorized to delete a resource to delete any resource. The attack...

OSINT Chrome Extension: ThreatPinch Lookup

OSINT Chrome Extension ThreatPinch was designed to enable information security professionals quick reference checks for commonly looked up indicators without having to leave the comfort of their current webpage. Be it, IPv4 addresses, MD5/SHA2 hashes, these indicators are usually copied and paste...

Legal Robot: Near-duplicate accounts allowed with ignored email mutations

A security researcher discovered that near-duplicate accounts like [email protected], [email protected], and [email protected] were all treated as separate accounts, while some email services, like gmail and google apps, treat these as the same account. This issue could lead to excess ema...

[Mutator v0.2.2.1] Wordlist mutator

This project aims to be a wordlist mutator with hormones, which means that some mutations will be applied to the result of the ones that have been already done, resulting in something like: corporation - C0rp0r4t10n2012 This software is usefull when applied to a few words, like company name and/o...

Google Caja V8 JavaScript VM未明远程代码执行漏洞

Google Caja是一个旨在制订一个JavaScript语言的子集和最佳编程指导方针,约束JavaScript程序员编写的代码,符合一个更加安全,更加合理的JS代码 Google Caja相关冻结V8 Javascript虚拟机上陈列变异array mutations存在一个未明安全漏洞，允许攻击者利用漏洞执行任意代码 0 Google Caja r5550 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： http://code.google.com/p/google-caja/wiki/SecurityAdvisory201308013...