CVE-2021-40959

A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall AIWAF = 4.1.6 and =5.0 was identified on the subpage /processmanagement/processstatus.xhr.php. This vulnerability allows an attacker to inject malicious scripts that execute in the context of...

MONITORAPP Application Insight Web Application Firewall Security Vulnerabilities

MONITORAPP Application Insight Web Application Firewall MONITORAPP AIWAF is a WEB FIREWALL from MONITORAPP USA. A security vulnerability exists in MONITORAPP Application Insight Web Application Firewall. An attacker can exploit this vulnerability to inject malicious scripts...

CVE-2021-40959

A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall AIWAF = 4.1.6 and =5.0 was identified on the subpage /processmanagement/processstatus.xhr.php. This vulnerability allows an attacker to inject malicious scripts that execute in the context of...

CVE-2021-40959

A reflected cross-site scripting (XSS) vulnerability exists in MONITORAPP Application Insight Web Application Firewall (AIWAF) versions <= 4.1.6 and

CVE-2021-40959: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall AIWAF = 4.1.6 and =5.0 was identified on the subpage /processmanagement/processstatus.xhr.php. This vulnerability allows an attacker to inject malicious scripts that execute in the context of...

PT-2024-9675

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description A relative path traversal vulnerability in Fortinet FortiWLM allows an attacker to execute unauthorized code or commands via specially...

What You Should Know About BreakingWAF

BreakingWAF is not a vulnerability stemming from WAF solutions — it is a misconfiguration vulnerability that can be addressed during customer onboarding...

PT-2025-26186

Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.11.11 Description An unauthenticated malicious actor can execute arbitrary code by using the '/locales/locale.json' endpoint with the locale and namespace query parameters. This flaw allows for complete server...

CVE-2024-53264

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated...

CVE-2024-53264 Open Redirect Vulnerability in Loading Page in bunkerweb

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated...

CVE-2024-53264

Summary: CVE-2024-53264 is an open redirect vulnerability in bunkerweb’s loading endpoint. The endpoint accepts an unvalidated the "next" parameter, enabling authenticated users to be redirected to arbitrary external URLs (e.g., /loading?next=https://google.com). This could be leveraged for phish...

GHSA-W5RQ-G9R6-VRCG @dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling

Impact A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to improper sanitization of the URL parameters, allowing the URL bar's contents to be injected and reflected into the HTML page. An attacker could craft a...

CVE-2024-53843 Reflected XSS Vulnerability in Authentication Flow URL Handling in @dapperduckling/keycloak-connector-server

@dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to...

Fortinet FortiWeb Detection Consolidation

Consolidation of Fortinet FortiWeb detections. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; ifdescription...

Fortinet FortiWeb security vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists in Fortinet...

Fortinet FortiADC Web Application Firewall Information Disclosure

The vulnerability of the Fortinet FortiADC application delivery controller’s Web Application Firewall component is related to improper security checks for standard elements. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

Security Bulletin: A vulnerability in Go affects IBM Robotic Process Automation for Cloud Pak which could allow an attacker to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. (CVE-2015-5739)

Summary A vulnerability in Go affects IBM Robotic Process Automation for Cloud Pak which could allow an attacker to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. IBM Robotic Process Automation for Cloud Pak uses Go as part of it's operator deployment...

Security Bulletin: Vulnerabilities in Netty affect IBM watsonx.data

Summary Netty is vulnerable to HTTP request smuggling and weaker than expected security. These can affect watsonx.data. Vulnerability Details CVEID:CVE-2019-20444 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw in the HttpObjectDecoder.java. By sending a...

SafeLine - Serve As A Reverse Proxy To Protect Your Web Services From Attacks And Exploits

SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web apps from attacks such as SQL...

CVE-2024-45229

Versa Director exposes certain REST APIs (login, banner, device registration) without authentication. A GET request with invalid arguments can be exploited by Directors connected to the Internet to obtain authentication tokens of other logged-in users, which can be used to call additional APIs on...