CVE-2023-24021

Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILESTMPCONTENT collection...

CVE-2022-48279

In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity C language codebase...

CVE-2023-24021

Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILESTMPCONTENT collection...

CVE-2023-24021

CVE-2023-24021 affects ModSecurity’s handling of file uploads via the FILES_TMP_CONTENT collection, due to incorrect handling of '\0' bytes. The vulnerability can enable Web Application Firewall bypasses and buffer over-reads on the WAF when rules read FILES_TMP_CONTENT. Affected product: ModSecu...

Fortinet FortiWeb 注入漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists in several...

CVE-2021-41823

The Web Application Firewall WAF in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism...

CVE-2021-41823

The Web Application Firewall WAF in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism...

Design/Logic Flaw

The Web Application Firewall WAF in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism...

CVE-2021-41823

The Web Application Firewall WAF in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism...

Kemp Load Master 跨站脚本漏洞

Kemp Load Master is a full-featured load balancer and Application Delivery Controller ADC from Kemp USA that supports all major application workloads. A cross-site scripting vulnerability exists in Kemp LoadMaster version 7.2.54.1, which stems from the Web Application Firewall WAF allowing the us...

CVE-2021-41823

The Web Application Firewall WAF in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism...

PT-2023-12380 · Kemp · Kemp Loadmaster

Name of the Vulnerable Software and Affected Versions: Kemp LoadMaster version 7.2.54.1 Description: The issue allows certain uses of onmouseover to bypass an XSS protection mechanism in the Web Application Firewall WAF. Recommendations: For Kemp LoadMaster version 7.2.54.1, consider disabling th...

CVE-2022-45778

https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 = 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in the Hillstone WEB application firewall. An attacker can enter the background of the firewall with super administrator privileges through a...

Design/Logic Flaw

https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 = 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in the Hillstone WEB application firewall. An attacker can enter the background of the firewall with super administrator privileges through a...

Hillstone Networks Firewall 安全漏洞

Hillstone Networks Firewall is a series of firewalls from China-based Hillstone Networks. A security vulnerability exists in Hillstone Networks Firewall SG-6000 5.0.4.0 and prior versions, which stems from a misconfiguration of report.m in its Web Application Firewall that results in an access...

Security Bulletin: Apache Tomcat is vulnerable to HTTP request smuggling (CVE-2022-42252)

Summary Apache Tomcat is vulnerable to HTTP request smuggling, caused by the failure to reject a request containing an invalid Content-Length header when configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false. By sending a specially-crafted request, an attacker could...

Stored XSS - XSS in RSS link href attribute

📜 Description Cross-site scripting XSS is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. The persistent or stored XSS vulnerability is a more devastating variant of a...

NGWAF - First Iteration Of ML Based Feedback WAF

The Motivation | What is the N3XT ST3P? With the explosive growth of web applications since the early 2000s, web-based attacks have progressively become more rampant. One common solution is the Web Application Firewall WAF. However, tweaking rules of current WAFs to improve the detection mechanis...

CVE-2022-38381

An improper handling of malformed request vulnerability CWE-228 exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall WAF protection suc...

CVE-2022-38381

An improper handling of malformed request vulnerability CWE-228 exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall WAF protection suc...