1216 matches found
Remote File Inclusion (RFI) – Detecting the Undetectable
Intro Remote File Inclusion RFI is an attack exploiting the functionality in web applications which allows the inclusion of external source code without validating its content or origin. An RFI payload is a link that points to a malicious file that an application will include in its code example:...
Why Businesses Should Consider Managed Cloud-Based WAF Protection
The City of Baltimore was under cyber-attack last year, with hackers demanding $76,000 in ransom. Though the city chose not to pay the ransom, the attack still cost them nearly $18 million in damages, and then the city signed up for a $20 million cyber insurance policy. It's very evident that...
When your WAF needs its own WAF
Security products have their own security issues, which can affect products that they were designed to secure. It's not a recursive loop, but the reality. WAFs there are not an exclusion. You can remember CloudFlare self-DoS that happened last year...
Authentication flaw
Barracuda Web Application Firewall WAF 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string...
CVE-2014-2595
Barracuda Web Application Firewall WAF 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string...
CVE-2014-2595
Barracuda Web Application Firewall (WAF) firmware version 7.8.1.013 is affected by an authentication bypass: an attacker can reuse a non-expiring authentication token embedded in a query string to gain access to the WAF interface. The vulnerability originates from a flaw in how the temporary/perm...
Native integrations in Wallarm WAF
How to configure sending reports to email? How to get a notification to the messenger about an event requiring a response? How to connect Wallam and other solutions that use DevOps and the security team? Integrations will help to solve all these issues in Wallam WAF. And today we'll talk about th...
Glassdoor: XSS at https://www.glassdoor.com/Salary/* via filter.jobTitleExact
Summary: There exists a Cross Site Scripting and Content Injection vulnerability at https://www.glassdoor.com/Salary/ via the filter.jobTitleExact query parameter. Using URL encoded HTML entities, it is possible to inject HTML content and break out of the context of a tag. The WAF does a good job...
Imperva Received Top Scores in Gartner’s “Critical Capabilities for Cloud Web Application Firewalls”
The web application landscape is constantly changing, and the tools needed for the best application security protection need to change with the landscape. With Imperva’s recent improvements in API Security, Bot Management, DDoS and Cloud WAF, it’s easy to see why we are among the highest-scored...
WordPress Database Reset Plugin Vulnerability (CVE-2020-7047, CVE-2020-7048)
A vulnerability recently disclosed by Wordfence and published as CVE-2020-7047 and CVE-2020-7048 allows an attacker to take over vulnerable WordPress-based websites. Functionality in the WP Database Reset plugin introduced the vulnerability, which allows any unauthenticated user to reset any tabl...
CVE-2011-5266
Imperva SecureSphere Web Application Firewall WAF before 12-august-2010 allows SQL injection filter bypass...
CVE-2011-5266
Imperva SecureSphere Web Application Firewall WAF before 12-august-2010 allows SQL injection filter bypass...
CVE-2011-5266
CVE-2011-5266 affects Imperva SecureSphere Web Application Firewall (WAF). The vulnerability allows bypass of SQL injection filters in versions prior to 12 August 2010. The CVSS metrics indicate high impact across confidentiality, integrity, and availability (NVD CVSS 2.0: base score 7.5; CVSS 3....
WAFW00F v2.0 - Allows One To Identify And Fingerprint Web Application Firewall (WAF) Products Protecting A Website
The Web Application FirewallFingerprinting Tool. — FromEnable Security How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number of potentially...
Vxscan
This is a Python script called Vxscan, which is a comprehensive scanning tool. It is written in Python 3.6 or later and is designed to perform various scanning tasks, including sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system...
Mail.ru: Reflected XSS with WAF Bypass https://pw.mail.ru
Reflected user-assisted XSS in https://pw.mail.ru...
New Wallarm Dashboard
There is an update in the Wallarm Console, which presents a brand new dashboard that can’t be missed. There are three significant changes that are worth mentioning: New structure. The dashboard has a new, clear structure emphasizing multiple modules of the Wallarm Platform — WAF, Scanner, FAST. T...
Semrush: Content Injection on api.semrush.com to Reflected XSS
The researcher found XSS vulnerability and wrote an awesome summary! : While testing api.semrush.com I've found that some inputs triggered MongoDB error on /reports/v1/projects/:id/siteaudit/page/list endpoint. Contents of url parameter was reflected in error message. Unfortunately WAF blocked my...
How to Maximize Your WAF
Whenever new WAF clients are brought aboard, there’s a procedure they must follow in order to properly configure their servers to work behind the WAF protection. You can find an example of the Imperva Cloud WAF onboarding procedure here. Sometimes, however, customers can miss important procedures...