CITSmart Injection Vulnerability

CITSmart is an application from CITSmart Portugal. It provides all the processes for designing an organization. An injection vulnerability exists in CITSmart versions prior to 9.1.2.23, which arises from a lack of proper validation of user input data by a networked system or product during the...

CVE-2020-5016

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to vi...

Anatomy of a Security Super Bowl Dynasty, Part 2: The Offense

Imperva’s Directors of Technology in the Office of the CTO, Brian Anderson and Craig Burlingame, recently conducted an informal education session titled Creating a Security Super Bowl Dynasty. In this presentation, they used examples of how teams create consistent, sustainable success in American...

General Overview of Vulnerability Management

In a world where most companies take nearly six months to detect a data breach, establishing a comprehensive and continuous process for identifying, classifying, mitigating and preventing security vulnerabilities within an organization can help prevent current cybersecurity challenges...

Weak password vulnerability in Tianqing web application security gateway (CNVD-2021-16888)

Tianqing Web Application Security Gateway is a new-generation Web Application Firewall WAF and application delivery network security product developed by Qisda. Tianqing Web Application Security Gateway has a weak password vulnerability, which can be exploited by attackers to obtain sensitive...

PayloadsAllTheThings

This repository is an offensive tool for Web Application Security and Pentest/CTF. It contains a list of useful payloads and bypass for various web application security vulnerabilities. The repository includes tools and exploits for vulnerabilities such as CRLF injection, CSRF injection, and CORS...

Building a Holistic VRM Strategy That Includes the Web Application Layer

Building security into your overall vulnerability risk management VRM strategy is a must-do in the age of the all-important web app. Between security and IT-Ops teams, there are a number of steps in the VRM process, including asset identification, enumeration, prioritization, and remediation. How...

SQL Injection Vulnerability in Application Security Gateway Financial Business Management of Beijing Xinan Century Technology Co.

hereinafter referred to as Principal Century was founded in August 2001, and is committed to the security realization of traditional Internet, internal network of organizations and mobile network in the fields of communication transmission, transaction process and network resource protection. A S...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2021-13211)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. F5 BIG-IP suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client data by th...

F5 BIG-IP Buffer Overflow Vulnerability (CNVD-2021-13226)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A buffer overflow vulnerability exists in BIG-IP, which originates when a network system or product performs an operation in...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2021-48896)

Microsoft SharePoint is a suite of enterprise business collaboration platforms from Microsoft Corporation. A remote code execution vulnerability exists in Microsoft SharePoint, which can be exploited by a remote attacker to execute arbitrary code in the context of the application...

CVE-2021-27351

The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session...

NeDi <= 1.9C, 2.0 Multiple Vulnerabilities

NeDi is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

CVE-2021-27233

Mutare Voice (EVM) 3.x before 3.3.8 has an information disclosure on the admin portal Settings.asp where password information for external systems is visible in cleartext. Affected component: admin UI/settings page. Root cause: cleartext exposure of credentials in the admin portal. Impact: confid...

CVE-2021-22984

On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM...

SolarWinds Serv-U FTP Server 15.2.1 Cross Site Scripting

Title: Stored XSS Product: SolarWinds Serv-U FTP Server Vendor Homepage: https://www.solarwinds.com/ Vulnerable Version: 15.2.1 and lower Fixed Version: 15.2.2 CVE Number: CVE-2020-28001 Author: Jack Misiura from The Missing Link Website: https://www.themissinglink.com.au Timeline: 2020-10-30...

The Weakest Link in Your Security Posture: Misconfigured SaaS Settings

In the era of hacking and malicious actors, a company's cloud security posture is a concern that preoccupies most, if not all, organizations. Yet even more than that, it is the SaaS Security Posture Management SSPM that is critical to today's company security. Recently Malwarebytes released a...

BIG-IP 跨站脚本漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in BIG-IP, which stems from the lack of proper validation of client-side data by t...

BIG-IP Advanced WAF and ASM Resource Management Error Vulnerability

F5 BIG-IP ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A resource management error vulnerability exists in BIG-IP Advanced WAF and ASM, which arises from...

U.S. Dept Of Defense: Course Registration Form Allowing an attacker to dump all the candidate name who had enrolled for the course

The application allowed an attacker to enumerate all candidate names who had applied for various courses by cycling a numeric parameter in the application's URL...