Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)

Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Title: Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Author: Sarthak Saini Date: 2020-01-18 Vendor Link : https://www.adive.es/ Software Link:...

fondtaktak.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1076299 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2019-11763

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML...

Automated Attacks Call for Automated Protection – 2020 Trend #3

In our blog series on security trends, we’ve been diving deeper into the five security predictions for 2020 made by our CTO Kunal Anand during his fireside chat with Imperva CMO David Gee. Watch it here. As I'll discuss in my upcoming blog on defense-in-depth and reducing risk, being “connected”...

Hardcoded credentials

Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to...

CVE-2013-4752

The CVE-2013-4752 issue affects Symfony’s HttpFoundation component across Symfony 2.0.x up to 2.0.24, 2.1.x up to 2.1.12, 2.2.x up to 2.2.5, and 2.3.x up to 2.3.3. The vulnerability arises because the Host header can be manipulated when the framework generates an absolute URL, enabling a remote a...

CVE-2019-19983

The CVE-2019-19983 vulnerability affects the WordPress plugin Fast Velocity Minify (before 2.7.7). The issue arises from the plugin exposing the full web root path of the WordPress installation, enabling an attacker to discover sensitive filesystem information when FVM Debug Mode is enabled and a...

Top 5 Essential Features of Effective Cybersecurity for Web Apps

There's hardly any business nowadays that don't use computers and connect to the Internet. Companies maintain an online presence through their official websites, blogs, and social media pages. People use online services to conduct day to day activities like banking. And of course, there are many...

The authentication system’s vulnerability for web applications related to incorrect authorization allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of the authentication system for web applications provided by LemonLDAP::NG stems from improper authorization conditions. This occurs when the relay party using OIDC has weaker access control rules than the target RP, and there is no URI filtering. Exploiting this vulnerability...

Telerik UI for ASP.NET AJAX RadChart Path Traversal Vulnerability

Telerik UI for ASP.NET AJAX is an HTML editor. RadChart is one of the charting components. A path traversal vulnerability exists in RadChart in Telerik UI for ASP.NET AJAX. The vulnerability stems from a failure of a network system or product to properly filter special elements in the path of a...

CVE-2019-13943

CVE-2019-13943 affects Siemens EN100 Ethernet Module variants (DNP3, IEC61850

CVE-2019-19018

TitanHQ WebTitan (before 5.18) is affected. The issue exposes a database configuration file under /include/dbconfig.ini via the web administration interface, revealing which database backend the web application uses. The vulnerability is a information disclosure in the admin interface. Exploitati...

CVE-2019-18793

CVE-2019-18793 affects Parallels Plesk Panel 9.5 with a stored/reflected XSS in target/locales/tr-TR/help/index.htm? via the fileName parameter. The issue is a cross-site scripting flaw in that specific page, allowing injected script to be treated as part of the web page. Several connected source...

Code injection

DISPUTED An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an...

CheerWeb has a file upload vulnerability

CheerWeb is a general-purpose website system designed with PHP+MySQL architecture, which is simple, lightweight, practical, free and shared. CheerWeb suffers from a file upload vulnerability, which can be exploited by an attacker to upload arbitrary files and gain webmaster privileges...

Openfire 4.4.1 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in Openfire 4.4.1 Affected Software: Openfire Affected Versions: 4.4.1 Vendor Homepage: https://www.igniterealtime.org/ Vulnerability Type: Cross-site Scripting Severity: Medium Status: Fix...

Default credentials

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal...

Chunked Transmission Bypass Vulnerability in Netnifty Web Application Security Protection System

Beijing Netnifty Information Technology Co., Ltd. was renamed from Lenovo Netnifty Technology Beijing Co., Ltd. which was formerly known as Lenovo Group's Information Security Division. A chunked transmission bypass vulnerability exists in the NetGuard Web Application Security Protection System,...

CVE-2019-0195

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...

CVE-2019-3761

The CVE-2019-3761 entry describes a stored cross-site scripting vulnerability in RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products released before 7.1.0 P08, specifically in the Access Request module. A remote authenticated attacker could store malicious HTML or ...