CVE-2021-20027

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls...

Rockwell Automation FactoryTalk Services Platform

1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Exploitable remotely Vendor: Rockwell Automation Equipment: FactoryTalk Services Platform Vulnerability: Protection Mechanism Failure 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote, authenticated users to bypass...

Securing REST with free API Firewall How-to guide

In our modern world, web applications are becoming ever more important. Bad actors know this and they target them more frequently than ever before. This is not likely to stop any time soon as the number of web applications the world needs will only go up with its reliance on technology. To fully...

Securing REST with free API Firewall. How-to guide

In our modern world, web applications are becoming ever more important. Bad actors know this and they target them more frequently than ever before. This is not likely to stop any time soon as the number of web applications the world needs will only go up with its reliance on technology. To fully...

Trusting Locations Bites Us Yet Again

Recently, Microsoft announced the discovery of yet another attack being launched by the now infamous Nobelium group, which has been responsible for numerous successful attacks, including the widespread SolarWinds breach in 2020. Thankfully, this latest attempt was not as impactful as those in the...

GENIVI Alliance DLT

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: GENIVI Alliance Equipment: DLT-Daemon Vulnerability: Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to remote code execution or crash the...

CVE-2002-2438

TCP firewalls could be circumvented by sending a SYN Packets with other flags like e.g. RST flag set, which was not correctly discarded by the Linux TCP stack after firewalling...

CVE-2002-2438

firewalls might let some TCP flags combinations pass e.g. all with RST flag set and the OS e.g. Linux stack would in turn accept a TCP session it might not have accepted otherwise...

CVE-2002-2438

CVE-2002-2438 describes a TCP/IP flaw where Linux TCP stack could bypass firewalls by receiving SYN packets that include additional flags (e.g., SYN+RST). The vulnerability arises because such packets were not consistently discarded by some stacks after firewalling, allowing a potential connectio...

Cassia Networks Access Controller

1. EXECUTIVE SUMMARY CVSS v3 6.2 ATTENTION: Low attack complexity Vendor: Cassia Networks Equipment: Access Controller Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to read any file from the Access Controller server. 3...

pfSense cross-site scripting vulnerability (CNVD-2021-33242)

pfSense is a set of network firewalls based on FreeBSD Linux. A cross-site scripting vulnerability exists in pfsense version 2.5.0, which stems from not sufficiently sanitizing user-supplied data passed to the serviceswoledit.php script via the Description field. An attacker could exploit this...

Akamai Recognized as 2021 Gartner Peer Insights Customers' Choice for Web Application Firewalls

Akamai has been named a Gartner Peer Insights Customers' Choice for Web Application Firewalls for the second time. Gartner defines web application firewalls WAFs as "solutions designed to protect web applications and APIs from a variety of attacks, including automated bots, injection and...

Akamai Recognized as 2021 Gartner Peer Insights Customers' Choice for Web Application Firewalls

Akamai has been named a Gartner Peer Insights Customers' Choice for Web Application Firewalls for the second time...

Palo Alto Networks PAN-OS 日志信息泄露漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in PAN-OS XML that allows local users to access sensitive information...

Weak Password Vulnerability in Multiple Firewall Products of Huawei Technologies Co.

Huawei's USG series firewalls fully support IPv4/IPv6 dual-stack, static routing, RIP, OSPF, BGP and other routing protocols. A weak password vulnerability exists in several Huawei Technologies firewall products, which can be exploited by attackers to obtain sensitive information...

Weintek EasyWeb cMT

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Weintek Equipment: cMT Vulnerabilities: Code Injection, Improper Access Control, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

Weak Password Vulnerability in H3C SecPath F1000 Series Multiple Firewalls

H3C SecPath F1000 series is a firewall from Xinhua San Technologies Co. A weak password vulnerability exists in multiple H3C SecPath F1000 series firewalls, which can be exploited by attackers to obtain sensitive information...

SolarWinds TFTP Server 11.0.4.101 Remote Unauthenticated Reconfiguration Vulnerability

SolarWinds TFTP Server version 11.0.4.101 suffers from a remote unauthenticated reconfiguration vulnerability that could result in code execution. Older versions of SolarWinds' TFTP Server, which could have been installed from a standalone download or bundled with certain paid products, may have...

Why WAFs can’t catch VMware CVE-2021-21972 Remote Code Execution Exploit?

The recent critical security issue in VMware vCenter was discovered this January and fixed on February 23rd . The exploit looks like a simple JSP shell upload, but for some reason, its a blind spot for Web Application Firewalls WAFs. Lets understand why. The CVE-2021-21972 affects vCenter version...

Akamai Identified as a Leader in DDoS Mitigation by Forrester

This week, Akamai was again recognized as a Leader in the latest The Forrester Wave™: DDoS Mitigation Solutions, Q1 2021. Akamai has also been recognized by Forrester as a Leader in its most recent The Forrester Wave™: Zero Trust eXtended Ecosystem Platform Providers, Q3 2020, The Forrester New...