Blusparkglobal
Monthly
Bluvoyix stores user passwords in plaintext and exposes them through unauthenticated APIs, allowing remote attackers to retrieve credentials without authentication and gain administrative access to customer accounts. This high-severity vulnerability affects all users of the platform and could lead to complete compromise of customer data, with no patch currently available.
BLUVOYIX admin APIs allow unauthenticated creation of admin users, enabling complete platform takeover.
BLUVOYIX exposes internal API documentation publicly, allowing attackers to discover and abuse internal functionality.
BLUVOYIX platform has unauthenticated API access allowing full customer data extraction and platform compromise.
BLUVOYIX's email sending API contains design flaws that permit unauthenticated attackers to send arbitrary emails on behalf of affected organizations through specially crafted HTTP requests. This integrity issue requires no user interaction and could enable large-scale spam or phishing campaigns originating from compromised systems. No patch is currently available for this vulnerability.
Bluvoyix stores user passwords in plaintext and exposes them through unauthenticated APIs, allowing remote attackers to retrieve credentials without authentication and gain administrative access to customer accounts. This high-severity vulnerability affects all users of the platform and could lead to complete compromise of customer data, with no patch currently available.
BLUVOYIX admin APIs allow unauthenticated creation of admin users, enabling complete platform takeover.
BLUVOYIX exposes internal API documentation publicly, allowing attackers to discover and abuse internal functionality.
BLUVOYIX platform has unauthenticated API access allowing full customer data extraction and platform compromise.
BLUVOYIX's email sending API contains design flaws that permit unauthenticated attackers to send arbitrary emails on behalf of affected organizations through specially crafted HTTP requests. This integrity issue requires no user interaction and could enable large-scale spam or phishing campaigns originating from compromised systems. No patch is currently available for this vulnerability.