5281 matches found
Information Disclosure
mysql server is vulnerable to information disclosure. An easily exploitable vulnerability allows privileged user to affect the confidentiality of the application...
Denial Of Service (DoS)
mysql server is vulnerable to denial of service. A difficult to exploit vulnerability allows a privileged user to affect the availability of the application...
Cross site scripting
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...
Rockset: Failure to Invalid Session after Password Change
Summary: While conducting my researching I discovered that the application Failure to invalidate session after password. In this scenario changing the password doesn't destroys the other sessions which are logged in with old passwords. Steps To Reproduce: 1. Login with the same account in Chrome...
Car Rental Script Cross Site Scripting
==================================================================== Car Rental Script - Stored XSS ==================================================================== .:. Author : Yussef Dajdaj .:. Contact : .:. Vendor : https://projectworlds.in/ .:. Script :...
Secure and Integrate Your Azure DevOps CI/CD Pipeline
Explore experiments from Chuck Losh, Solution Architect, to explore how Application Security can help protect your applications at runtime as they are built, and integrate with your automated Azure DevOps CI/CD pipeline with automated testing...
Cisco Webex Meetings Token Handling Unauthorized Access (cisco-sa-webex-token-zPvEjKN)
According to its self-reported version, Cisco Webex Meetings is affected by an authorization bypass vulnerability due to improper handling of authentication tokens. An unauthenticated, remote attacker can exploit this, by sending specially crafted requests, to gain the privileges of another...
Siemens SICAM A8000 RTUs
1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SICAM A8000 Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could compromise the confidentiality, integrity, and availability of the web application...
Denial Of Service (DoS)
usrsctp is vulnerable to denial of service. An out-of-bounds read in sctploadaddressesfrominit allows an attacker to crash the application...
Zero Trust: From security option to business imperative overnight
Not long ago when I spoke with customers about Zero Trust, our conversations focused on discussing the principles, defining scope, or sharing our own IT organization’s journey. Zero Trust was something interesting to learn about, and most organizations were very much in the exploratory phase. As...
Vulnerability Spotlight: Microsoft issues security update for Azure Sphere
Claudio Bozzato, Lilith and Dave McDaniel of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos researchers recently discovered seven vulnerabilities in Microsoft’s Azure Sphere, a cloud-connected SoC platform designed specifically with IoT application security in mind...
Black Hat USA 2020: Critical Meetup.com Flaws Reveal Common AppSec Holes
Critical flaws in the popular Meetup platform were revealed Monday as part of research unleashed at this week’s Black Hat USA 2020. The flaws, which have been patched, enable the full takeover of Meetup “Groups” by threat actors, who can also redirects payments and carryout other malicious action...
liderfamily.estate Cross Site Scripting vulnerability OBB-1248355
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Application Security 101
Security issues often arise as a result of applications being rushed for deployment without adequate checks and protections. What are the top security risks to applications and what can organizations do to secure their DevOps pipeline?...
GLib Networking: Improper certificate validation
Background Network-related giomodules for glib Description GTlsClientConnection skips hostname verification of the server’s TLS certificate if the application fails to specify the expected server identity. Impact There may be a breach of integrity or confidentiality in connections made using GLib...
How to Secure Your Azure Container Instances
Want to protect your Azure Container Instances? Chuck Losh, Solutions Architect, gives you all the steps how with Trend Micro Cloud One™ – Application Security and Trend Micro Cloud One™ – Container Security...
CVE-2020-15124 Path traversal in Goobi viewer Core
In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive...
webcarservice.macommerce.it Cross Site Scripting vulnerability OBB-1227802
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Why Application Security Should Be Considered An Enabler For Business
If you ask Alex, he won't admit being old-fashioned. He has been working in the IT industry for a while now and accepts that security is important for the business's health. But reluctant to take security as the business enabler. In today's environment, moving to digitization is a critical step...
Why Application Security Should Be Considered An Enabler For Business
If you ask Alex, he won't admit being old-fashioned. He has been working in the IT industry for a while now and accepts that security is important for the business's health. But reluctant to take security as the business enabler. In today's environment, moving to digitization is a critical step...