ISO 27001 Certificate
SOC 1 Type I Certificate
SOC 2 Type II Certificate
PCI DSS
HIPAA
RGPD
Internal validation & live display
Multiple badges & continuous verification
Faster underwriting decisions
ISOSOC2 Type 1SOC2 Type 2PCI DSSHIPAAGDPR

OneBlood is a not-for-profit 501(c)(3) community asset responsible for providing safe, available and affordable blood to more than 200 hospital partners and their patients. The service area of OneBlood includes the Tampa Bay area, the Orlando-metro area and surrounding Central Florida counties, South and Southeast Florida, parts of Southwest Florida, Pensacola, Tallahassee and areas in Southern Georgia and Alabama. The OneBlood name is a constant reminder of the collective power we share to save another person’s life.

OneBlood A.I CyberSecurity Scoring

OneBlood

Company Details

Linkedin ID:

oneblood

Employees number:

1,661

Number of followers:

11,272

NAICS:

62

Industry Type:

Hospitals and Health Care

Homepage:

oneblood.org

IP Addresses:

0

Company ID:

ONE_6274016

Scan Status:

In-progress

AI scoreOneBlood Risk Score (AI oriented)

Between 650 and 699

https://images.rankiteo.com/companyimages/oneblood.jpeg
OneBlood Hospitals and Health Care
Updated:
  • Powered by our proprietary A.I cyber incident model
  • Insurance preferes TPRM score to calculate premium
globalscoreOneBlood Global Score (TPRM)

XXXX

https://images.rankiteo.com/companyimages/oneblood.jpeg
OneBlood Hospitals and Health Care
  • Instant access to detailed risk factors
  • Benchmark vs. industry & size peers
  • Vulnerabilities
  • Findings

OneBlood Company CyberSecurity News & History

Past Incidents
2
Attack Types
2
EntityTypeSeverityImpactSeenBlog DetailsIncident DetailsView
OneBlood Inc.Breach8547/2024
Rankiteo Explanation :
Attack with significant impact with customers data leaks

Description: OneBlood Inc. experienced a **data breach** between **July 14–29, 2024**, where an unauthorized third party accessed or potentially accessed **private information of current/former employees and blood donors**. The exposed data led to a **class action lawsuit**, alleging OneBlood failed to adequately protect sensitive information. The company agreed to a **$1 million settlement**, offering affected individuals up to **$2,500 for documented losses** (e.g., fraud-related bank fees, credit monitoring costs, legal fees) or a **flat $60 payment** for undocumented claims. The breach triggered financial and reputational harm, with victims facing risks of identity theft, fraud, and privacy violations. OneBlood denied negligence but settled to avoid prolonged litigation. The incident underscores vulnerabilities in handling **employee and donor data**, with long-term trust and operational impacts.

OneBloodRansomware10077/2024
Rankiteo Explanation :
Attack that could injure or kill people

Description: OneBlood, a vital non-profit blood bank serving over 300 hospitals, was targeted by a ransomware attack, significantly disrupting its medical operations. Due to the attack, OneBlood had to activate manual processes, severely reducing their operational capacity and impacting blood inventory availability. Hospitals across the U.S. Southeast have been asked to initiate critical blood shortage protocols. Although the specific ransomware variant and presence of a data breach were not disclosed, the attack highlights the growing threat to healthcare facilities and the potential risk to patient care.

OneBlood Inc.
Breach
Severity: 85
Impact: 4
Seen: 7/2024
Blog:
Rankiteo Explanation
Attack with significant impact with customers data leaks

Description: OneBlood Inc. experienced a **data breach** between **July 14–29, 2024**, where an unauthorized third party accessed or potentially accessed **private information of current/former employees and blood donors**. The exposed data led to a **class action lawsuit**, alleging OneBlood failed to adequately protect sensitive information. The company agreed to a **$1 million settlement**, offering affected individuals up to **$2,500 for documented losses** (e.g., fraud-related bank fees, credit monitoring costs, legal fees) or a **flat $60 payment** for undocumented claims. The breach triggered financial and reputational harm, with victims facing risks of identity theft, fraud, and privacy violations. OneBlood denied negligence but settled to avoid prolonged litigation. The incident underscores vulnerabilities in handling **employee and donor data**, with long-term trust and operational impacts.

OneBlood
Ransomware
Severity: 100
Impact: 7
Seen: 7/2024
Blog:
Rankiteo Explanation
Attack that could injure or kill people

Description: OneBlood, a vital non-profit blood bank serving over 300 hospitals, was targeted by a ransomware attack, significantly disrupting its medical operations. Due to the attack, OneBlood had to activate manual processes, severely reducing their operational capacity and impacting blood inventory availability. Hospitals across the U.S. Southeast have been asked to initiate critical blood shortage protocols. Although the specific ransomware variant and presence of a data breach were not disclosed, the attack highlights the growing threat to healthcare facilities and the potential risk to patient care.

Ailogo

OneBlood Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒
Incident Predictions locked
Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒
A.I. Risk Score Predictions locked
Access Monitoring Plan
statics

Underwriter Stats for OneBlood

Incidents vs Hospitals and Health Care Industry Average (This Year)

No incidents recorded for OneBlood in 2025.

Incidents vs All-Companies Average (This Year)

No incidents recorded for OneBlood in 2025.

Incident Types OneBlood vs Hospitals and Health Care Industry Avg (This Year)

No incidents recorded for OneBlood in 2025.

Incident History — OneBlood (X = Date, Y = Severity)

OneBlood cyber incidents detection timeline including parent company and subsidiaries

OneBlood Company Subsidiaries

SubsidiaryImage

OneBlood is a not-for-profit 501(c)(3) community asset responsible for providing safe, available and affordable blood to more than 200 hospital partners and their patients. The service area of OneBlood includes the Tampa Bay area, the Orlando-metro area and surrounding Central Florida counties, South and Southeast Florida, parts of Southwest Florida, Pensacola, Tallahassee and areas in Southern Georgia and Alabama. The OneBlood name is a constant reminder of the collective power we share to save another person’s life.

Loading...
similarCompanies

OneBlood Similar Companies

NSW Health

​​​​​​​With more than 170,000 staff and 228 hospitals, there are millions of ways we are enriching the health of the NSW community every day. In front of a patient, working in a kitchen, developing new treatments, or at a desk, each one of our staff is a vital member of the largest health organisat

Sanford Health

Sanford Health is the largest rural health system in the U.S. Our organization is dedicated to transforming the health care experience and providing access to world-class health care in America’s heartland. Headquartered in Sioux Falls, South Dakota, we serve more than one million patients and 220,0

St. Luke's Health System

As the only Idaho-based, not-for-profit health system, St. Luke’s Health System is dedicated to our mission “To improve the health of people in the communities we serve.” Today that means not only treating you when you’re sick or hurt, but doing everything we can to help you be as healthy as possibl

Hapvida NotreDame Intermédica

Com cerca de 80 anos de experiência, a Hapvida é hoje a maior empresa de saúde integrada da América Latina. A companhia, que possui mais de 69 mil colaboradores, atende quase 16 milhões de beneficiários de saúde e odontologia espalhados pelas cinco regiões do Brasil. Todo o aparato foi construído a

EsSalud

El Seguro Social de Salud, EsSalud, es un organismo público descentralizado, con personería jurídica de derecho público interno, adscrito al Sector Trabajo y Promoción Social. Tiene por finalidad dar cobertura a los asegurados y sus derechohabientes, a través del otorgamiento de prestaciones de pre

Encompass Health

Encompass Health is the largest owner and operator of rehabilitation hospitals in the United States. With a national footprint that includes 158 hospitals in 37 states and Puerto Rico, the Company provides high-quality, compassionate rehabilitative care for patients recovering from a major injury or

Health Care Service Corporation

Health Care Service Corporation serves nearly 23 million people across the United States through its portfolio of health benefit solutions. HCSC provides health coverage options for employers large and small, individuals and families, and Medicare and Medicaid plans. HCSC also offers related health

Nova Scotia Health Authority

We are Nova Scotia Health. We are rural and urban. We are in hospitals, health centres and community. We serve individuals and communities from Yarmouth to Cape Breton, from Amherst to Halifax, and everything in between. We are researchers and learners, looking for new ways to prevent and treat dis

MultiCare Health System

MultiCare’s roots in the Pacific Northwest go back to 1882, with the founding of Tacoma’s first hospital. Over the years, we’ve grown from a Tacoma-centric, hospital-based organization into the largest, community-based, locally governed health system in the state of Washington. Today, our comprehe

newsone

OneBlood CyberSecurity News

September 22, 2025 07:00 AM
OneBlood agrees to settle data breach class action lawsuit for $1 million

Individuals who received written notice stating the OneBlood data breach compromised their private info may qualify to claim a class action...

March 19, 2025 07:00 AM
Mission Interrupted: The Devastating Impact Of Ransomware

(Image From Deposit Photos). By Erich Kron. Nonprofit organizations are not immune to modern ransomware demands as demonstrated last year...

January 30, 2025 08:00 AM
Ransomware attack on New York Blood Center forces workarounds, drive cancellations

One of the largest independent blood centers serving over 75 million people across the US has been hit by a ransomware attack, forcing officials to reschedule...

January 24, 2025 08:00 AM
Cyber Expert weighs in on Oneblood Cyberattack

Cyber experts stress the importance of vigilance and proactive steps to protect personal data after a ransomware breach that exposed...

January 21, 2025 08:00 AM
Blood Donation Service Confirms July 2024 Ransomware Attack Resulted in Personal Data Breach

Blood donation service OneBlood has confirmed that the July 2024 ransomware attack claimed by the Russian RansomHub cybercrime group...

January 15, 2025 08:00 AM
OneBlood Notifying Donors Affected by 2024 Ransomware Hack

Six months after a ransomware attack temporarily crippled its blood donation and distribution activities, Florida-based nonprofit OneBlood...

January 15, 2025 08:00 AM
OneBlood Data Breach Class Action

This data breach was disclosed following a cyber security incident at OneBlood, which exposed names and Social Security numbers.

January 14, 2025 02:04 PM
OneBlood Ransomware Attack in July Exposes Donors’ Personal Data

Non-profit blood donation organization OneBlood suffered a ransomware attack last summer, exposing donors' personal information.

November 18, 2024 08:00 AM
Mitigating risk as healthcare supply chain attacks prevail

A focus on cyber resilience is essential for mitigating the risk of healthcare supply chain attacks, which have the potential to cause widespread disruptions.

faq

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

OneBlood CyberSecurity History Information

Official Website of OneBlood

The official website of OneBlood is http://www.oneblood.org.

OneBlood’s AI-Generated Cybersecurity Score

According to Rankiteo, OneBlood’s AI-generated cybersecurity score is 652, reflecting their Weak security posture.

How many security badges does OneBlood’ have ?

According to Rankiteo, OneBlood currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Does OneBlood have SOC 2 Type 1 certification ?

According to Rankiteo, OneBlood is not certified under SOC 2 Type 1.

Does OneBlood have SOC 2 Type 2 certification ?

According to Rankiteo, OneBlood does not hold a SOC 2 Type 2 certification.

Does OneBlood comply with GDPR ?

According to Rankiteo, OneBlood is not listed as GDPR compliant.

Does OneBlood have PCI DSS certification ?

According to Rankiteo, OneBlood does not currently maintain PCI DSS compliance.

Does OneBlood comply with HIPAA ?

According to Rankiteo, OneBlood is not compliant with HIPAA regulations.

Does OneBlood have ISO 27001 certification ?

According to Rankiteo,OneBlood is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of OneBlood

OneBlood operates primarily in the Hospitals and Health Care industry.

Number of Employees at OneBlood

OneBlood employs approximately 1,661 people worldwide.

Subsidiaries Owned by OneBlood

OneBlood presently has no subsidiaries across any sectors.

OneBlood’s LinkedIn Followers

OneBlood’s official LinkedIn profile has approximately 11,272 followers.

NAICS Classification of OneBlood

OneBlood is classified under the NAICS code 62, which corresponds to Health Care and Social Assistance.

OneBlood’s Presence on Crunchbase

No, OneBlood does not have a profile on Crunchbase.

OneBlood’s Presence on LinkedIn

Yes, OneBlood maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/oneblood.

Cybersecurity Incidents Involving OneBlood

As of December 06, 2025, Rankiteo reports that OneBlood has experienced 2 cybersecurity incidents.

Number of Peer and Competitor Companies

OneBlood has an estimated 30,508 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at OneBlood ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach and Ransomware.

What was the total financial impact of these incidents on OneBlood ?

Total Financial Loss: The total financial loss from these incidents is estimated to be $0.

How does OneBlood detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an recovery measures with activated manual processes, and communication strategy with asked hospitals to initiate critical blood shortage protocols, and written notifications with true, settlement claim process with {'online_claim_form': true, 'mail_in_pdf_form': true, 'deadline': '2025-12-04', 'payout_options': ['electronic payment', 'paper check']}..

Incident Details

Can you provide details on each incident ?

Incident : Ransomware Attack

Title: Ransomware Attack on OneBlood Blood Bank

Description: OneBlood, a vital non-profit blood bank serving over 300 hospitals, was targeted by a ransomware attack, significantly disrupting its medical operations. Due to the attack, OneBlood had to activate manual processes, severely reducing their operational capacity and impacting blood inventory availability. Hospitals across the U.S. Southeast have been asked to initiate critical blood shortage protocols. Although the specific ransomware variant and presence of a data breach were not disclosed, the attack highlights the growing threat to healthcare facilities and the potential risk to patient care.

Type: Ransomware Attack

Incident : Data Breach

Title: OneBlood Data Breach (July 2024)

Description: An unauthorized third party accessed or potentially accessed private information of certain OneBlood employees and donors between July 14 and July 29, 2024. The breach led to a class action lawsuit, resulting in a $1 million settlement fund for affected individuals. OneBlood denied allegations of inadequate protection but settled to avoid litigation costs.

Date Detected: 2024-07-14

Type: Data Breach

Threat Actor: Unauthorized third party

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Breach.

Impact of the Incidents

What was the impact of each incident ?

Incident : Ransomware Attack ONE000080124

Systems Affected: Operational Systems

Operational Impact: Severely reduced operational capacity

Incident : Data Breach ONE3893538092225

Customer Complaints: True

Legal Liabilities: Class Action Lawsuit: True, Settlement Agreement: True,

Identity Theft Risk: True

What is the average financial loss per incident ?

Average Financial Loss: The average financial loss per incident is $0.00.

What types of data are most commonly compromised in incidents ?

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Private information (specific types unspecified and likely PII).

Which entities were affected by each incident ?

Incident : Ransomware Attack ONE000080124

Entity Name: OneBlood

Entity Type: Non-profit Blood Bank

Industry: Healthcare

Location: U.S. Southeast

Size: Serving over 300 hospitals

Incident : Data Breach ONE3893538092225

Entity Name: OneBlood Inc.

Entity Type: Non-profit organization

Industry: Healthcare (Blood donation services)

Location: United States

Customers Affected: Current and former employees and donors (exact number unspecified)

Response to the Incidents

What measures were taken in response to each incident ?

Incident : Ransomware Attack ONE000080124

Recovery Measures: Activated manual processes

Communication Strategy: Asked hospitals to initiate critical blood shortage protocols

Incident : Data Breach ONE3893538092225

Communication Strategy: Written Notifications: True, Settlement Claim Process: {'online_claim_form': True, 'mail_in_pdf_form': True, 'deadline': '2025-12-04', 'payout_options': ['electronic payment', 'paper check']}.

Data Breach Information

What type of data was compromised in each breach ?

Incident : Data Breach ONE3893538092225

Type of Data Compromised: Private information (specific types unspecified, likely PII)

Sensitivity of Data: High (includes personally identifiable information)

Data Exfiltration: Accessed or potentially accessed

Ransomware Information

How does the company recover data encrypted by ransomware ?

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Activated manual processes, .

Regulatory Compliance

Were there any regulatory violations and fines imposed for each incident ?

Incident : Data Breach ONE3893538092225

Legal Actions: Source: Settlement Administrator (Kroll Settlement Administration LLC),

References

Where can I find more information about each incident ?

Incident : Data Breach ONE3893538092225

Source: Class Action Settlement Notice (Newberry v. OneBlood, Inc.)

Incident : Data Breach ONE3893538092225

Source: Settlement Administrator (Kroll Settlement Administration LLC)

Where can stakeholders find additional resources on cybersecurity best practices ?

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Class Action Settlement Notice (Newberry v. OneBlood, Inc.), and Source: Settlement Administrator (Kroll Settlement Administration LLC).

Investigation Status

What is the current status of the investigation for each incident ?

Incident : Data Breach ONE3893538092225

Investigation Status: Settled (class action lawsuit resolved with $1M fund)

How does the company communicate the status of incident investigations to stakeholders ?

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Asked hospitals to initiate critical blood shortage protocols, Deadline: 2025-12-04, Payout Options: ['electronic payment' and 'paper check']..

Stakeholder and Customer Advisories

Were there any advisories issued to stakeholders or customers for each incident ?

Incident : Data Breach ONE3893538092225

Stakeholder Advisories: Written Notifications To Affected Individuals: True, Settlement Claim Instructions: True.

Customer Advisories: Eligibility Criteria: ['Individuals whose private information was compromised between July 14–29, 2024', 'Recipients of written notification from OneBlood'], Claim Process: ['Submit claim form online or by mail', 'Deadline: December 4, 2025', 'Required: Class Member ID from settlement notice', 'Documentation required for losses over $60'], Payout Timeline: Approximately 90 days after final court approval (expected Dec 9, 2025).

What advisories does the company provide to stakeholders and customers following an incident ?

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were written_notifications_to_affected_individuals: True, settlement_claim_instructions: True, , eligibility_criteria: ['Individuals whose private information was compromised between July 14–29, 2024', 'Recipients of written notification from OneBlood'], claim_process: ['Submit claim form online or by mail', 'Deadline: December 4, 2025', 'Required: Class Member ID from settlement notice', 'Documentation required for losses over $60'], payout_timeline: Approximately 90 days after final court approval (expected Dec 9, 2025) and .

Post-Incident Analysis

What were the root causes and corrective actions taken for each incident ?

Incident : Data Breach ONE3893538092225

Corrective Actions: Settlement Agreement: True, Financial Compensation For Affected Individuals: True,

What corrective actions has the company taken based on post-incident analysis ?

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: settlement_agreement: True, financial_compensation_for_affected_individuals: True, .

Additional Questions

General Information

Who was the attacking group in the last incident ?

Last Attacking Group: The attacking group in the last incident was an Unauthorized third party.

Incident Details

What was the most recent incident detected ?

Most Recent Incident Detected: The most recent incident detected was on 2024-07-14.

Impact of the Incidents

What was the highest financial loss from an incident ?

Highest Financial Loss: The highest financial loss from an incident was {'settlement_fund': '$1,000,000', 'attorneys_fees': 'Up to $450,000', 'service_awards': 'Up to $1,500 per named plaintiff', 'claim_payouts': {'documented_losses': 'Up to $2,500 per claimant', 'alternate_cash': '$60 per claimant'}, 'administration_costs': 'To be determined'}.

What was the most significant system affected in an incident ?

Most Significant System Affected: The most significant system affected in an incident was Operational Systems.

Data Breach Information

Regulatory Compliance

What was the most significant legal action taken for a regulatory violation ?

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was class_action_lawsuit: True, settlement_agreement: True, .

References

What is the most recent source of information about an incident ?

Most Recent Source: The most recent source of information about an incident are Class Action Settlement Notice (Newberry v. OneBlood, Inc.) and Settlement Administrator (Kroll Settlement Administration LLC).

Investigation Status

What is the current status of the most recent investigation ?

Current Status of Most Recent Investigation: The current status of the most recent investigation is Settled (class action lawsuit resolved with $1M fund).

Stakeholder and Customer Advisories

What was the most recent stakeholder advisory issued ?

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was written_notifications_to_affected_individuals: True, settlement_claim_instructions: True, .

What was the most recent customer advisory issued ?

Most Recent Customer Advisory: The most recent customer advisory issued were an eligibility_criteria: ['Individuals whose private information was compromised between July 14–29, 2024', 'Recipients of written notification from OneBlood'], claim_process: ['Submit claim form online or by mail', 'Deadline: December 4, 2025', 'Required: Class Member ID from settlement notice', 'Documentation required for losses over $60'], payout_timeline: Approximately 90 days after final court approval (expected Dec 9, 2025) and .

cve

Latest Global CVEs (Not Company-Specific)

Description

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.

Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description

Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).

Risk Information
cvss4
Base: 7.1
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.

Risk Information
cvss3
Base: 7.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Description

Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox._verifyBatches (packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678) advanced the local tid to whatever transition matched the current blockHash before knowing whether that batch would actually be verified. When the loop later broke (e.g., cooldown window not yet passed or transition invalidated), the function still wrote that newer tid into batches[lastVerifiedBatchId].verifiedTransitionId after decrementing batchId. Result: the last verified batch could end up pointing at a transition index from the next batch (often zeroed), corrupting the verified chain pointer.

Risk Information
cvss4
Base: 8.0
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description

A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Risk Information
cvss2
Base: 6.5
Severity: LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
cvss3
Base: 6.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
cvss4
Base: 5.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Access Data Using Our API

SubsidiaryImage

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=oneblood' -H 'apikey: YOUR_API_KEY_HERE'

What Do We Measure ?

revertimgrevertimgrevertimgrevertimg
Incident
revertimgrevertimgrevertimgrevertimg
Finding
revertimgrevertimgrevertimgrevertimg
Grade
revertimgrevertimgrevertimgrevertimg
Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network Security

Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)

Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)

Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat Intelligence

Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Top LeftTop RightBottom LeftBottom Right
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
Users Love Us Badge