Tags
Masked FVE record: a data API with no authentication or authorization returned real-name rosters of residents' association officers, facility staff contacts and employee numbers in bulk.
Read full articleMasked FVE record: a null accessToken was accepted and order IDs increased sequentially, so anyone could read other customers' phone numbers, names and payment methods without authentication.
Read full articleMasked FVE record: a missing authentication-level check let an anonymous session read a victim's resident-number-based linking information (CI) and identity details.
Read full articleMasked FVE record: an object-level authorization flaw let anyone change another member's password with nothing but an integer member number.
Read full articleAnalysis of HTTP Request Smuggling (HTTP DeSync Attack): how CL.TE and TE.CL deserialization vulnerabilities bypass frontend security controls and poison the backend request queue
Read full article