The vulnerability of the software for coordinating the operation of security systems and for managing real-time incident responses in Fortinet FortiSOAR is related to improper access control. This allows attackers to gain access to the API gateway.

The vulnerability of the software for coordinating the operation of security systems and for managing incident responses in real-time with Fortinet FortiSOAR is related to improper access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the...

The vulnerability in the implementation of the /cgi-bin/wapopen HTTP-server Boa allows a hacker to gain unauthorized access to protected information.

The vulnerability in the /cgi-bin/wapopen HTTP-server implementation of Boa is related to incorrect restrictions on the path to the restricted directory during processing of the FILECAMERA variable. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected...

quarkus-vertx-http: Security misconfiguration of CORS : OWASP A05_2021 level in Quarkus

A vulnerability was found in Quarkus. The Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest have no event listeners registered on the object returned by the XMLHttpRequest upload property, and have no...

CVE-2022-4098

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by...

CVE-2022-4098 Wiesemann & Theis: Multiple products prone to missing authentication through spoofing

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by...

GHSA-9895-G6X5-XWCP Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in...

Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in...

Cross site request forgery (csrf)

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in...

CVE-2022-4147

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in...

CVE-2022-4147

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in...

Webvendome 路径遍历漏洞

Webvendome is an application from Webvendome, Inc. Webvendome suffers from a path traversal vulnerability that stems from an internal server IP and full path disclosure, which can be exploited by an attacker to send GET requests...

PT-2022-6147 · Cisco · Cisco Firepower Software For Adaptive Security Appliance (Asa) Firepower Module +2

Name of the Vulnerable Software and Affected Versions: Cisco FirePOWER Software for Adaptive Security Appliance ASA FirePOWER module affected versions not specified Cisco Firepower Management Center FMC Software affected versions not specified Cisco Next-Generation Intrusion Prevention System NGI...

SAP Financial Consolidation 跨站脚本漏洞

SAP Financial Consolidation is a financial statement solution from SAP. The product is designed to automate intercompany reconciliations and offsets, currency conversions, and provide financial statement generation. A cross-site scripting vulnerability exists in SAP Financial Consolidation versio...

CVE-2022-43410

An information leak was found in a Jenkins plugin. This issue could allow an unauthenticated remote attacker to issue GET requests. The greatest impact is to confidentiality...

Two Weeks of Monitoring ProxyNotShell (CVE-2022-41040 & CVE-2022-41082) Threat Activity

The Wordfence Threat Intelligence team has been monitoring exploit attempts targeting two zero-day vulnerabilities in Microsoft Exchange Server tracked as CVE-2022-41040 and CVE-2022-41082, collectively known as ProxyNotShell. These vulnerabilities are actively being exploited in the wild. At the...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889 PoC This is Proof of Concept for the vulnerabil...

Threat Advisory: CVE-2022-40684 Fortinet Appliance Auth bypass

This morning, the Wordfence Threat Intelligence team began tracking exploit attempts targeting CVE-2022-40684 on our network of over 4 million protected websites. CVE-2022-40684 is a critical authentication bypass vulnerability in the administrative interface of Fortinet’s FortiGate firewalls,...

PT-2022-25361 · Kfm · Kfm

Name of the Vulnerable Software and Affected Versions: kfm versions through 1.4.7 Description: A cross-site scripting XSS issue exists, allowing for the execution of malicious scripts via a crafted GET request to the "/kfm/index.php" API endpoint. Recommendations: For versions through 1.4.7, upda...

CVE-2022-29061

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests...

CVE-2022-29061

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests...