PT-2022-25144 · Owasp +1 · Owasp Modsecurity Core Rule Set +1

Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions 3.0.x through 3.3.2 Description: The issue concerns a response body bypass in the OWASP ModSecurity Core Rule Set CRS. A client can exploit this by issuing an HTTP Accept header field with an...

CVE-2022-34002

The CVE-2022-34002 issue affects PDS Vista 7 and concerns a Local File Inclusion vulnerability in the /application/documents/display.aspx endpoint, specifically the document parameter. A low-privileged authenticated attacker could leak configuration files and source code of the web application. A...

PCI DSS Tackles Client-Side Attacks: Everything You Need to Know About Complying With PCI 6.4.3

Client-side attacks often referred to as Magecart attacks have been around since as early as 2015 and dramatically gained in popularity when the global pandemic accelerated digital transformation, by driving more people and data online. Now the fight against these attacks is stepping up a notch...

CVE-2022-28742

CVE-2022-28742 affects aEnrich eHRD Learning Management Key Performance Indicator System (version 5+). The vulnerability is improper access control: the web application does not validate user sessions on many pages, allowing an unauthenticated attacker to access sensitive functionality. Impact de...

Design/Logic Flaw

Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL...

PT-2022-4428 · Unknown · Yetiforcecrm

Name of the Vulnerable Software and Affected Versions: yetiforcecrm versions prior to 6.4.0 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability in the YetiFroce CRM system, which is caused by the lack of protection measures for the web page structure. This allow...

CVE-2022-38358

Eyes of Network Web 5.3 is affected by a cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects multiple endpoints, including /module/admin_notifiers/rules.php (parameters rule_notification, rule_name, rule_name_old), /mod...

CVE-2022-34768

insert HTML / js code inside input how to get to the vulnerable input : Workers worker nickname inject in this input the code...

Featured Image from URL < 4.0.1 - Admin+ Stored Cross-Site Scripting

The plugin does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup PoC POST...

CVE-2022-1666

CVE-2022-1666 affects Secheron SEPCOS Control and Protection Relay. The root cause is insufficiently protected credentials: the web app’s root account uses a weak default password, with MD5-based cracking noted. This can allow an attacker with network access to obtain OS/root-level privileges on ...

CVE-2022-32987

CVE-2022-32987 concerns multiple cross-site scripting (XSS) vulnerabilities in Simple Bakery Shop Management System v1.0, specifically in the /bsms/?page=manage_account page. The issue arises from crafted input in the Username or Full Name fields, enabling execution of arbitrary web scripts/HTML....

Four Key Findings from the 2022 Cyberthreat Defense Report

For the ninth year, Imperva is proud to sponsor CyberEdge Group’s annual Cyberthreat Defense Report. In this report, CyberEdge Group delivers a detailed accounting of how IT security professionals perceive cyberthreats today and reveals actionable insights into how they plan to defend their...

Contao 4.13.2 - Cross-Site Scripting (XSS)

Exploit Title: Contao 4.13.2 - Cross-Site Scripting XSS Google Dork: NA Date: 04/28/2022 Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://contao.org/en/ Software Link: https://github.com/contao/contao/releases/tag/4.13.2 Version: 4.13.2 Tested on: KALI OS CVE : CVE-2022-15...

manorpreschool.org Cross Site Scripting vulnerability OBB-2634235

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-22797

CVE-2022-22797 concerns Sysaid/Open Redirect via the parameter redirectURL in the GET request to a path like /CommunitySSORedirect.jsp?redirectURL=... Unvalidated redirects and forwards are possible when input is untrusted, enabling an attacker to redirect users to a malicious site and potentiall...

CVE-2022-24042

CVE-2022-24042 affects Siemens Desigo DXR2, PXC3, PXC4, and PXC5 devices. The vulnerability is that the web application AuthToken does not expire after the defined auto logoff delay, enabling an attacker to capture a token and reuse old session credentials or session IDs for authorization. Affect...

CVE-2022-24891

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the antisamy-esapi.xml configurati...

CVE-2022-24891

CVE-2022-24891 affects ESAPI (antisamy-esapi.xml) where an incorrect regular expression for onsiteURL could allow JavaScript: URLs to escape proper sanitization. The issue is fixed in ESAPI 2.3.0.0; workaround is to manually edit antisamy-esapi.xml to adjust the onsiteURL regex. Connected sources...

CVE-2022-23457

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified...

CVE-2022-23457

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified...