Applicure dotDefender 4.01-3 - Persistent Cross-Site Scripting

An advisory by EnableSecurity. ID: ES-20100601 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt Affected Versions: version 4.0 Fixed versions: 4.01-3 and later Description: Applicure dotDefender is a Web Application Firewall that can be installed on Window...

Applicure dotDefender 4.0 Cross Site Scripting

Applicure dotDefender 4.0 administrative interface cross site scripting An advisory by EnableSecurity. ID: ES-20100601 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt Affected Versions: version 4.0 Fixed versions: 4.01-3 and later Description: Applicure...

Applicure dotDefender 4.0 administrative interface cross site scripting

Applicure dotDefender 4.0 administrative interface cross site scripting An advisory by EnableSecurity. ID: ES-20100601 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt Affected Versions: version 4.0 Fixed versions: 4.01-3 and later Description: Applicure...

Flash Tag Cloud Control Cross Site Scripting

Hello Bugtraq! I want to warn you about security vulnerability in Flash Tag Cloud control for ASP.NET. ----------------------------- Advisory: Vulnerability in widget Flash Tag Cloud for Blogsa and other ASP.NET engines ----------------------------- URL: http://websecurity.com.ua/4213/...

Vulnerabilities in t3m_cumulus_tagcloud for TYPO3

Здравствуйте 3APA3A! Сообщаю вам о Cross-Site Scripting и Full path disclosure уязвимостях в плагине t3mcumulustagcloud для TYPO3. Данная XSS уязвимость идентична XSS уязвимости в Tagcloud для DLE http://websecurity.com.ua/3927/. Про миллионы флешек tagcloud.swf уязвимых к XSS атакам я упоминал в...

Design/Logic Flaw

Imperva SecureSphere Web Application Firewall and Database Firewall 5.0.0.5082 through 7.0.0.7078 allow remote attackers to bypass intrusion-prevention functionality via a request that has an appended long string containing an unspecified manipulation...

CVE-2010-1329

Imperva SecureSphere Web Application Firewall and Database Firewall 5.0.0.5082 through 7.0.0.7078 allow remote attackers to bypass intrusion-prevention functionality via a request that has an appended long string containing an unspecified manipulation...

CVE-2010-1329

CVE-2010-1329 affects Imperva SecureSphere Web Application Firewall and Database Firewall, with vulnerable versions ranging from 5.0.0.5082 to 7.0.0.7078. The issue allows remote attackers to bypass intrusion-prevention functionality by sending a request that includes an appended long string cont...

Joomla JVClouds3D Cross Site Scripting / HTML Injection

Hello Bugtraq! I want to warn you about Cross-Site Scripting vulnerability in JVClouds3D modjvclouds3D plugin for Joomla. Which I found at 08.01.2010. It is similar to XSS vulnerability in Joomulus for Joomla http://websecurity.com.ua/3801/. About millions of flash files tagcloud.swf which are...

dotDefender 3.8-5 - Remote Command Execution

Problem Description =================== A remote command execution vulnerability exists in the dotDefender 3.8-5 Site Management. dotDefender 1 is a web appliaction firewall WAF which 'prevents hackers from attacking your website.' Technical Details ================= The Site Management applicati...

CVE-2009-3457

Cisco ACE XML Gateway AXG and ACE Web Application Firewall WAF before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by 1 an OPTIONS request or 2 a crafted GET request, leading to a Message-handling Errors message containing a...

CVE-2009-3457

Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) prior to version 6.1 are affected by an information-disclosure vulnerability. An HTTP request that lacks a handler (e.g., an OPTIONS request or a crafted GET request) can trigger a Message-handling Errors message that exposes a cl...

CVE-2009-3457: Exposure of Sensitive Information to an Unauthorized Actor

Cisco ACE XML Gateway AXG and ACE Web Application Firewall WAF before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by 1 an OPTIONS request or 2 a crafted GET request, leading to a Message-handling Errors message containing a...

[ONSEC-09-014] 1C Bitrix WAF multiple XSS

Цель: 1C Bitrix WAF =8.0.5 Тип: Межсайтовый скриптинг Угроза: Средняя Дата обнаружения: 29.08.2009 Дата оповещения разработчика: 29.08.2009 Дата выхода исправления: 01.09.2009 Автор: Vladimir Vorontsov OnSec Russian Security Group onsec dot ru Описание: Проактивный фильтр WAF системы управления...

[ONSEC-09-013] 1C Bitrix 8.0.5 Admin Console XSS

ONSEC-09-013 1C Bitrix 8.0.5 Admin Console XSS Цель: 1C Bitrix 8.0.5 Тип: Межсайтовый скриптинг Угроза: Средняя Дата обнаружения: 25.08.2009 Дата оповещения разработчика: 30.08.2009 Дата выхода исправления: 01.09.2009 Автор: Vladimir Vorontsov OnSec Russian Security Group onsec dot ru Описание:...

Artofdefence Hyperguard Web Application Firewall DoS

Denial of service via memory exhaustion...

Artofdefence Hyperguard Web Application Firewall: Remote Denial of Service

Security Advisory --------------------------------------- Vulnerable Software: Artofdefence Hyperguard Web Application Firewall Vulnerable Version: 3 branches: prior to 3.1.1-11637; prior to 3.0.3-11636; prior to 2.5.5-11635 Apache Plug-in Homepage: http://www.artofdefence.com/ Found by: Michael...

Design/Logic Flaw

The Artofdefence Hyperguard Web Application Firewall WAF module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service memory consumption via an HTTP request with a large Content-Length valu...

CVE-2009-2301

The radware AppWall Web Application Firewall WAF 1.0.2.6, with Gateway 4.6.0.2, allows remote attackers to read source code via a direct request to 1 funcs.inc, 2 defines.inc, or 3 msg.inc in Management/...

CVE-2009-2299

The CVE-2009-2299 entry concerns the Artofdefence Hyperguard WAF module for Apache. Affected versions include 2.5.5-11635 and earlier 3.0.3-11636 and 3.1.1-11637, where a remote attacker can cause a denial of service via an HTTP request that specifies a large Content-Length value but provides no ...