53 matches found
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to the absence of authentication and authorization checks in the UPI management interface. An attacker can gain unauthorized access to read, modify, or delete UP-node and link topology data by sending...
GHSA-44QJ-CGHF-9P97 free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)
Summary free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware same root cause as free5gc/free5gc887. The POST /upi/v1/upNodesLinks create-or-update handler accepts attacker-controlled JSON and passes it directly into UpNodesFromConfiguration, which calls...
PT-2026-39259
Name of the Vulnerable Software and Affected Versions free5GC version 4.2.1 Description The Session Management Function SMF mounts the UPI management route group without OAuth2 or bearer-token authorization middleware. This allows a network attacker with access to the Service Based Interface SBI ...
PT-2026-39251
Name of the Vulnerable Software and Affected Versions free5GC versions prior to 4.2.2 Description The Session Management Function SMF in free5GC mounts the UPI management route group without inbound OAuth2 middleware, allowing unauthenticated access. The POST endpoint '/upi/v1/upNodesLinks' accep...
CVE-2025-67969 WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through = 1.5.1...
CVE-2025-67969 WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through = 1.5.1...
CVE-2025-67969
CVE-2025-67969 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin UPI QR Code Payment Gateway for WooCommerce (upi-qr-code-payment-for-woocommerce)
PT-2026-21043
Name of the Vulnerable Software and Affected Versions knitpay UPI QR Code Payment Gateway for WooCommerce versions through 1.5.1 Description The software contains a missing authorization issue related to incorrectly configured access control security levels. This allows for exploitation of the...
WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by NumeX in WordPress Plugin UPI QR Code Payment Gateway for WooCommerce versions = 1.5.1...
EUVD-2022-39576
Malicious code in bioql PyPI...
CVE-2025-56467
An issue was discovered in AXIS BANK LIMITED Axis Mobile App 9.9 that allows attackers to obtain sensitive information without a UPI PIN, such as account information, balances, transaction history, and unspecified other information. NOTE: the Supplier's perspective is that this is an intended...
CVE-2025-56467
An issue was discovered in AXIS BANK LIMITED Axis Mobile App 9.9 that allows attackers to obtain sensitive information without a UPI PIN, such as account information, balances, transaction history, and unspecified other information. NOTE: the Supplier's perspective is that this is an intended...
CVE-2025-56467
An issue was discovered in AXIS BANK LIMITED Axis Mobile App 9.9 that allows attackers to obtain sensitive information without a UPI PIN, such as account information, balances, transaction history, and unspecified other information. NOTE: the Supplier's perspective is that this is an intended...
CVE-2022-36876
Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication...
kernel: intel: Fix NULL pointer dereference issue in upi_fill_topology()
A vulnerability was discovered in the Linux kernel in which certain CPU topologies could result in a null pointer dereference, affecting system stability...
kernel: intel: Fix NULL pointer dereference issue in upi_fill_topology()
A vulnerability was discovered in the Linux kernel in which certain CPU topologies could result in a null pointer dereference, affecting system stability...
The vulnerability of the upi_fill_topology() function in the arch/x86/events/intel/uncore_snbep.c module of the Linux kernel’s performance evaluation subsystem allows a hacker to cause a service failure.
The vulnerability of the upifilltopology function in the arch/x86/events/intel/uncoresnbep.c module, belonging to the CPU performance evaluation subsystem of the Linux operating system, involves reading memory beyond the allocated buffer, followed by the assignment of a null pointer. Exploiting...
How Cybercriminals are Exploiting India's UPI for Money Laundering Operations
Cybercriminals are using a network of hired money mules in India using an Android-based application to orchestrate a massive money laundering scheme. The malicious application, called XHelper, is a "key tool for onboarding and managing these money mules," CloudSEK researchers Sparsh Kulshrestha,...
SUSE CVE-2023-52450
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upifilltopology Get logical socket id instead of physical id in discoverupitopology to avoid out-of-bound access on 'upi = &type-topologynididx;' line that leads to NUL...
UBUNTU-CVE-2023-52450
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upifilltopology Get logical socket id instead of physical id in discoverupitopology to avoid out-of-bound access on 'upi = &type-topologynididx;' line that leads to NUL...