Autorize - Automatic Authorization Enforcement Detection Extension For Burp Suite

Autorize is an automatic authorization enforcement detection extension for Burp Suite. It was written in Python by Barak Tawily, an application security expert, and Federico Dotta, a security expert at Mediaservice.net. Autorize was designed to help security testers by performing automatic...

OWASP Top 10 2017 is Released

The Journey to the New and Improved Ten Most Critical Web Application Security Risks It was not too long ago that protecting your web server infrastructure consisted of simply placing the servers in their own zone behind the firewall and just opening a couple of ports. Outside of endpoint...

CVE-2017-5170

An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path element DLL Hijacking vulnerability has been identified. To exploit this vulnerability, an attacker could rename a malicious DLL to meet the...

CVE-2016-6814

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized...

CVE-2016-6814

CVE-2016-6814 describes arbitrary code execution via Java serialization in Groovy when deserializing untrusted data. Affected are Codehaus Groovy versions 1.7.0–2.4.3 with Apache Groovy 2.4.4–2.4.7 on the classpath. The root cause is unsafe Java serialization/deserialization, allowing an attacker...

Cloud Migration: Technical and Business Considerations

If you’re like many businesses, you’re moving applications into public and private cloud infrastructures. You’ve seen how the cloud’s agility, resiliency, and scalability drives business growth. Fortunately, rolling out new apps in the cloud is easy when you have containers, microservices, and...

Security Strategies for DevOps, APIs, Containers and Microservices

More and more IT professionals see DevSecOps, a practice which integrates security measures earlier in the development process to improve production code quality, as a mainstay for future application development. Much of this stems from the growing trend towards speeding up application developmen...

Cisco Policy Suite Unauthenticated Information Disclosure Vulnerability

A vulnerability in the Policy and Charging Rules Function PCRF of the Cisco Policy Suite CPS could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The attacker would also have to have access ...

Zomato Clone Script - Arbitrary File Upload

Zomato Clone - Arbitrary File Upload Date: 16.01.2018 Vendor Homepage: http://www.phpscriptsmall.com/ Software Link: http://www.exclusivescript.com/product/099S4111872/php-scripts/zomato-clone-script Demo: http://jhinstitute.com/demo/foodpanda/ Version: N/A Category: Webapps Tested on: Windows 10...

It’s Not Magic — It’s AI

New Whitepaper On How Wallarm AI Works “Any sufficiently advanced technology is indistinguishable from magic,” Arthur C. Clarke Ever wanted to look under the covers of deep learning/artificial intelligence engine? While deep learning algorithms are generally based on neurons combined into a neura...

Wallarm Joins NVIDIA AI Virtual Accelerator

We are thrilled to announce that Wallarm has joined the NVIDIA Inception program, which is designed to nurture startups revolutionizing industries with advancements in AI and data sciences. NVIDIA’s Inception program is a virtual accelerator that helps startups during critical stages of product...

Paragon Initiative Enterprises: Airship: Persistent XSS via Comment

Affected: Airship 2.0.0 commit 15bdc0d CVSS ---- Medium 6.1 https://www.first.org/cvss/calculator/3.0CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Description ----------- The "name" field of a comment on a blog post is vulnerable to persistent XSS. When replying to a comment, the comment name is...

Server side request forgery (ssrf)

phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application...

CVE-2017-1000419

phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application...

Fsociety Hacking Tools Pack

Fsociety Menu Information Gathering Password Attacks Wireless Testing Exploitation Tools Sniffing & Spoofing Web Hacking Private Web Hacking Post Exploitation INSTALL & UPDATE Information Gathering : Nmap Setoolkit Port Scanning Host To IP wordpress user CMS scanner XSStracer Dork – Google Dorks...

The State of Web Application Vulnerabilities in 2017

As a web application firewall provider, part of our job at Imperva is constantly monitoring new security vulnerabilities. To do this, we use internal software that collects information from various data sources such as vulnerability databases, newsletters, forums, social media and more, integrate...

est-21.com XSS vulnerability

Open Bug Bounty ID: OBB-458585 Description| Value ---|--- Affected Website:| est-21.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

flareproject.com XSS vulnerability

Open Bug Bounty ID: OBB-456430 Description| Value ---|--- Affected Website:| flareproject.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the SOCKS proxy server of the BIG-IP Websafe security solution, the BIG-IP Policy Enforcement Manager, a system for controlling and managing network traffic, the BIG-IP Application Security Manager, a system for balancing local traffic, the BIG-IP Link Controller, a system for balancing internet traffic, the BIG-IP Application Acceleration Manager, the BIG-IP Advanced Firewall Manager, and the BIG-IP Access Policy Manager—these tools enable a hacker to cause a service failure.

The vulnerabilities of the SOCKS proxy server of the BIG-IP Websafe protection mechanism, the BIG-IP Policy Enforcement Manager, which is a system for controlling and managing network traffic; the BIG-IP Application Security Manager, which is a system for protecting applications; the BIG-IP Local...

Man-in-the-Middle (MitM)

net-ldap is vulnerable to man-in-the-middle MitM. The application does not validate SSL certificates, allowing a malicious user to pass a certificate to the application to steal credentials...