162 matches found
VulnCheck KEV: CVE-2023-48365
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software...
Input validation
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backe...
CVE-2023-48365
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backe...
CVE-2023-5516
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical detai...
CVE-2023-5516
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical detai...
Design/Logic Flaw
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical detai...
CVE-2023-5516
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical detai...
ldap test randomly fails through SSL_TCP Load Balancing Vserver on NetScaler
The customer configured ldap authentication through NetScaler SSLTCP LB Vserver for backend ldap server. Customer found ldap test fails randomly...
SSLVPN error "Websocket connection failed: Connection closed before receiving a handshake responser"
After VPN tunnel established to NetScaler gateway, user encounter access issue s to backend server with error message: "Websocket connection to 'ws:///ws/notification/site-msg/' failed: Connection closed before receiving a handshake responser"...
TCP option lost when traffic go through TCP type Load Balance(LB) Vserver
TCP option lost when traffic go through TCP type Load BalanceLB Vserver: 1. Clients send TCP syn to NetScaler with TCP option segment: 2. Backend Servers do not receive TCP handshake with TCP option segment from NetScaler:...
Unable to ping backend server from NetScaler with SNIP as source IP address
SNIP, NSIP and backend server are in the same subnet. Unable to ping backend from NetScaler with SNIP as source IP address, can ping backend with NSIP as source IP address...
CVE-2023-41265
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...
Cross site request forgery (csrf)
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...
CVE-2023-41265
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...
Enabling NetScaler to forward original client source IP to backend server
This guide outlines the various methods available to ensure that the backend server is equipped to collect the original client IP through the NetScaler. The focus of this article lies in configuring the NetScaler to effectively forward the original client source IP to the backend server...
How to configure URL Transformation to transform part of URL Path
When accessinghttp://example.com/url1/xxxx, Netscalercan transform /url1/ to /url2/ and preserve other parts, then forward to backend server...
Cross-site Scripting (XSS)
contao/core-bundle is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of a validation in the input unit widget, which allows an attacker to inject and execute malicious Javascript into the browser and backend server...
Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection Vulnerability
Exploit Title: Wifi Soft Unibox Administration 3.0 & 3.1 Login Page - Sql Injection Google Dork: intext:"Unibox Administration 3.1", intext:"Unibox 3.0" Exploit Author: Ansh Jain @sudoark Author Contact : email protected Vendor Homepage: https://www.wifi-soft.com/ Software Link:...
Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection
Exploit Title: Wifi Soft Unibox Administration 3.0 & 3.1 Login Page - Sql Injection Google Dork: intext:"Unibox Administration 3.1", intext:"Unibox 3.0" Date: 07/2023 Exploit Author: Ansh Jain @sudoark Author Contact : [email protected] Vendor Homepage: https://www.wifi-soft.com/ Software Link:...
CVE-2023-31689
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute script...