CVE-2021-25834

Cosmos Network Ethermint = v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application...

Fortinet FortiWeb Stack Buffer Overflow Vulnerability

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

API Security Checks in the Post-Pandemic World

The digital transformation journeys of many enterprises have been accelerated by the COVID-19 pandemic. For 2020, IT resources shifted to support WFH policies with mobile and remote productivity solutions, while simultaneously managing multiple datacenter migration projects to the cloud for scale...

Modernizing your network security strategy

From the global pandemic to recent cyberattacks, our world has faced many challenges during the past 12 months. Some of these challenges we can’t change. However, I’m pleased about the ones we can, and are changing across the cybersecurity landscape. For example, to facilitate remote work and...

Weak Password Vulnerability in Mingus Web Application Firewall

Web Application Firewall WAF is a professional application security protection product that focuses on providing security protection for websites, APPs and other web business systems. Weak password vulnerability exists in MingGuard Web Application Firewall, which can be exploited by attackers to...

SQL injection vulnerability in pr***.asp page of website building system of Shenyang Numerical Information Technology Co.

Shenyang Numerical Information Technology Co., Ltd. is a new technology enterprise engaged in Internet information service, e-commerce application and enterprise application system development. Shenyang number industry information technology limited company building system pr.asp page there is a...

CVE-2020-28403

A Cross-Site Request Forgery CSRF vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of any user of the application. This can be used to grant himself administrative role or remove the administrative account of the application...

Egavilanmedia User Registration & Login System SQL Injection Vulnerability (CNVD-2021-08881)

Egavilanmedia User Registration & Login System is a management platform for user registration and login from Egavilanmedia, USA. A SQL injection vulnerability exists in EgavilanMedia User Registration & Login System 1.0, which can be exploited by an attacker to execute SQL statements due to the...

When Destiny is Knocking on Your Door Again - Data Mining CDN Logs to Refine and Optimize Web Attack Detection

A few years ago, I wrote a blog post trying to explain, with humor, why choosing application security as a career path is destiny derived by my parents calling me "Or", and why a personal name that is a conditional word can sometimes be challenging in daily routines, since some attack payloads...

Design/Logic Flaw

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application...

Code injection

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

writeups

It is an offensive tool for web application security. The reposi...

CVE-2020-35581

CVE-2020-35581 details (Envira Gallery Lite) : A stored XSS vulnerability in Envira Gallery Lite versions before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML via a POST to /wp-admin/admin-ajax.php with the meta[title] parameter. Impact is user-side script execution. Remedia...

Denial Of Service (DoS)

tar is vulnerable to denial of service. A NULL pointer dereference in paxdecodeheader in sparse.c when parsing certain archives that contain malicious extended headers allows an attacker to crash the application...

CVE-2021-21457

SAP 3D Visual Enterprise Viewer (version 9) is affected by CVE-2021-21457 through a vulnerable IFF file parsing path. The issue stems from improper input validation, enabling memory corruption that can crash the application and, per ZDI, allow remote code execution with user interaction required ...

What’s New in InsightAppSec and tCell: Q4 2020 in Review

It’s crazy to believe 2020 has come to an end, and we’re sure we’re not alone in our excitement for 2021! Without a doubt, 2020 has presented some challenges for us all in the security world, as many companies quickly adopted a work-from-home model and pivoted from an in-store experience quickly ...

Curfew e-Pass Management System 1.0 Cross Site Scripting

Exploit Title: Curfew e-Pass Management System 1.0 - Stored XSS Date: 2/1/2021 Exploit Author: Arnav Tripathy Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/curfew-e-pass-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Windows 10/Wamp 1 Log into the...

Prepare for more sophisticated security threats in 2021

As computing becomes more distributed to achieve greater optimization and efficiency, the threats posed by cyberattackers are destined to become increasingly more sophisticated. Here are some steps organizations should take in 2021 to mitigate such sophisticated security threats. Start with...

Orangehrm SQL Injection Vulnerability (CNVD-2021-01999)

Orangehrm is a human resource management system HRM from Orangehrm, USA. The system supports personnel information management, leave management, attendance management and recruitment management. OrangeHRM versions prior to 4.6.0.1 suffer from a SQL injection vulnerability that stems from the...

FUEL CMS SQL Injection Vulnerability (CNVD-2021-02034)

FUEL CMS is a content management system based on CodeIgniter. FUEL CMS 1.4.11 suffers from a SQL injection vulnerability. The vulnerability can be exploited by an attacker via the 'name' parameter in /fuel/permissions/create/ to compromise an application, access or modify data, or exploit a...