Understanding the OWASP API Security Top 10: Why BOLA is the Number One Risk for APIs

Understanding and addressing vulnerabilities is critical in cybersecurity, where APIs serve as the backbone for seamless data exchange. The OWASP API Security Top 10, revised in 2023, provides a comprehensive guide to the critical issues that organizations must tackle to ensure the robust securit...

WordPress Zippy Plugin <= 1.6.9 is vulnerable to Arbitrary File Upload

Software Zippy Type Plugin Vulnerable versions = 1.6.9 Fixed in 1.6.10 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2024-27964 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID f32b93d01376 Credits stealthcopter Required...

GHSA-8P25-3Q46-8Q2P ESPHome vulnerable to remote code execution via arbitrary file write

Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...

ESPHome vulnerable to remote code execution via arbitrary file write

Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...

CVE-2024-27081

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration...

Design/Logic Flaw

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration...

CVE-2024-27081 ESPHome remote code execution via arbitrary file write

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration...

CVE-2024-27081

CVE-2024-27081 concerns ESPHome, where a security misconfiguration in the dashboard’s edit-configuration API (affecting the 2023.12.9 CLI installation) allowed authenticated remote attackers to read and write arbitrary files under the configuration directory, potentially yielding remote code exec...

CVE-2024-27081 ESPHome remote code execution via arbitrary file write

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration...

CVE-2024-27081 ESPHome remote code execution via arbitrary file write

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration...

IBM Security Verify Access Elevation of Privilege Vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

WordPress CP Polls Plugin <= 1.0.71 is vulnerable to Bypass Vulnerability

Software CP Polls Type Plugin Vulnerable versions = 1.0.71 Fixed in 1.0.72 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-24873 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b041270a0860 Credits Kyle Sanchez Required privilege...

CVE-2023-31005

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767...

IBM Security Verify Access 安全漏洞

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

WordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software FreshMail For WordPress Type Plugin Vulnerable versions = 2.3.2 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-22304 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5469e612590a Credits Skalucy...

Vulnerability of the blkcgdestroy_blkgs() function (block/blk-cgroup.c) in the Linux kernel, allowing a malicious actor to cause service failure

The vulnerability of the blkcgdestroyblkgs function block/blk-cgroup.c in the Linux kernel is related to security configuration errors. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the Microsoft.Data.Sqlclient (MDS) and System.Data.Sqlclient (SDS) libraries in Microsoft.NET Framework and.NET programming platforms is related to security configuration errors. This vulnerability allows attackers to bypass security restrictions and execute a type of “man-in-the-middle” attack.

The vulnerability of the Microsoft.Data.Sqlclient MDS and System.Data.Sqlclient SDS libraries in Microsoft.NET Framework and.NET programming platforms is related to security configuration errors. Exploiting this vulnerability can allow an attacker to bypass security restrictions and execute a...

WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Twitter Feeds Tweets Widget Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.2 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-52136 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5f069383b9f0 Credit...

WordPress Rate my Post – WP Rating System Plugin <= 3.4.2 is vulnerable to Broken Access Control

Software Rate my Post – WP Rating System Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A5: Security Misconfiguration Classification Broken Access Control CVE CVE-2023-51667 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 327f1bb4bf15 Credits Brandon...

WordPress Branda Plugin <= 3.4.14 is vulnerable to Bypass Vulnerability

Software Branda Type Plugin Vulnerable versions = 3.4.14 Fixed in 3.4.15 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-51542 Patch priority Low CVSS severity Low 5.3 Developer WPMU DEV PSID 6298c3f8ebb2 Credits Brandon Roldan Required privilege...