Rapid7 Announces Release of New tCell Amazon CloudFront Agent

Cloud-native approaches to building, hosting, and delivering web applications are growing rapidly. Content delivery networks CDNs such as Amazon CloudFront are on the rise, pushing content closer to end users to improve the performance of web applications. To protect web applications security tea...

How Akamai Can Help You Fight the Latest Exploitation Attempts Against Microsoft Exchange

Co-authored by Ryan Barnett. AppSec Protections for Microsoft Exchange CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 On March 2, 2021, the Microsoft Security Response Center alerted its customers to several critical security updates to Microsoft Exchange Server, addressing...

Microsoft Exchange and Verkada Hacks: Isolate Your Apps and APIs from the Internet Cesspool

It's been an interesting start to March in terms of public security incidents. This month kicked off with multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server. And, as if that wasn't enough, that attack was quickly followed by the news that a hacktivis...

A Tip For Easy SQL-based Big Data Analysis: Use a Temporary Dataset

Every once in a while we’re required to analyze big data on a wide time range. Here’s a common example: “Can you analyze what happened during 2020? And don’t forget to compare it to 2019”. Questions like this are hard to answer in the big data world: Queries may take a long time to process - and...

Code injection

web/upload/UploadHandler.php in Vesta Control Panel aka VestaCP through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin...

The vulnerability of the `check_forbidden` function in the rack/directory.rb module interface between web servers and Rack web applications allows a violator to access confidential data.

The vulnerability of the checkforbidden function in the rack/directory.rb module of the Rack framework, which is used between web servers and web applications, relates to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain...

XWiki >= 11.4-rc-1, < 11.10.1, 12.x < 12.6.3, 12.7.x Privilege Escalation Vulnerability

XWiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Akamai Offers Free Tier for Client-Side Edge Security

In March of 2020, Akamai saw a dramatic 30% rise in internet traffic --- equivalent to an entire year of growth 1. Post-pandemic, Akamai believes there will be a return to normal internet traffic growth, but many things will never be the same. In general, we particularly expect to see greater...

CVE-2020-24983

CVE-2020-24983 affects Quadbase EspressReports ES 7 Update 9. A CSRF flaw allows an unauthenticated attacker to craft a malicious HTML file containing a POST to the DashboardBuilder that uses the victim’s admin session to rename a Dashboard, i.e., the attacker can trigger authenticated changes vi...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Activemq

CVE-2016-3088 Apache ActiveMQ Remote Code Execution Exploit...

CVE-2021-21363 Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directory

swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary...

Six Apart Movable Type Cross-Site Scripting Vulnerability (CNVD-2022-22653)

Six Apart Movable Type is an application of Six Apart, Inc. Six Apart Movable Type has a cross-site scripting vulnerability in several of its products, which stems from the lack of proper validation of client data in the WEB application and can be exploited to inject arbitrary scripts via...

IBM Engineering Requirements Management DOORS Next Cross-Site Scripting Vulnerability (CNVD-2021-17198)

IBM Engineering Requirements Management DOORS Next is a scalable solution from International Business Machines Corporation IBM. The solution helps you capture, track, analyze, and manage systems and advanced IT application development. A cross-site scripting vulnerability exists in IBM Engineerin...

Progress Software Telerik UI for ASP.NET AJAX 安全漏洞

Progress Software Telerik UI for ASP.NET AJAX is an HTML editor from Progress Software. A security vulnerability exists in Progress Software Telerik UI for ASP.NET AJAX 2021.1.224, which can be exploited by an attacker to gain unauthorized access to the server and execute code...

Six Apart Movable Type Cross-Site Scripting Vulnerability (CNVD-2022-22652)

Six Apart Movable Type is an application of Six Apart, Inc. Six Apart Movable Type has a cross-site scripting vulnerability in several of its products, which stems from the lack of proper validation of client data in the WEB application and can be exploited to inject arbitrary scripts via...

WEBIM 10.2.55 Cross Site Scripting

Exploit Title: XSS in WEBIM web application Date: 10.08.2021 Exploit Author: ASCII Vendor Homepage: HTTPS://WEBIM.RU Version: 10.2.55 Tested on: 10.2.55 Webim messanger XSS POC...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. F5 BIGIP AWAF/ASM Cache Overflow Vulnerability, malicious http response packets can lead to memory leakage when passing throug...

CVE-2020-28150

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

Input validation

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

CVE-2020-28150

CVE-2020-28150 affects I-Net Software Clear Reports 20.10.136 Web application. The vulnerability arises because a user-controlled input is used to specify a link to an external site and is subsequently used in a Redirect, enabling possible open-redirect behavior. Root cause: untrusted input used ...