CVE-2019-6992

CVE-2019-6992 is a stored-self XSS in ZoneMinder up to version 1.32.3, via web/skins/classic/views/controlcaps.php. An attacker can inject HTML/JavaScript by exploiting a long NAME or PROTOCOL in index.php?view=controlcaps, resulting in code execution in the vulnerable field. Exploitation details...

Cross site scripting

An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter...

CVE-2019-6777

CVE-2019-6777 affects ZoneMinder v1.32.3 with a reflected XSS in web/skins/classic/views/plugin.php reachable via zm/index.php?view=plugin pl parameter. Root cause: insufficient input sanitization for the pl parameter, allowing injection into reflected output. Impact per sources: partial confiden...

Securing Social / Locking Login / Armoring Authentication

Authentication might be the single biggest hazard for web security over the next decade. It's not that the fundamentals of authentication are particularly challenging; we've understood the basic principles behind password management, push-based authorization, and device certificates for some time...

Webshell Bypass Vulnerability in Web Security Dog (Apache Edition) V4.0

Website Security Dog Apache Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features. Web Security Dog Apache Edition V4.0 has a webshell bypass vulnerability that can be exploited by attackers to execute...

Vanco website builder system has xss vulnerability

Guangzhou Vanke Internet Technology Co., Ltd Vanke for short is an innovative enterprise that specializes in providing Internet marketing services for small and medium-sized enterprises SMEs. An xss vulnerability exists in the Vanke website builder system, which can be exploited by attackers to...

UBUNTU-CVE-2018-6109

readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page...

Microsoft Office SharePoint CVE-2019-0558 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Foxit PDF Reader XFA xdpContent information leak vulnerability

Summary An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software’s PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger an out-of-bounds read, which can disclose sensitive memory content and aid in exploitati...

air-agency.co.jp XSS vulnerability

Open Bug Bounty ID: OBB-718992 Description| Value ---|--- Affected Website:| air-agency.co.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

ijermce.com XSS vulnerability

Open Bug Bounty ID: OBB-718535 Description| Value ---|--- Affected Website:| ijermce.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

hamdantradingco.com XSS vulnerability

Open Bug Bounty ID: OBB-718183 Description| Value ---|--- Affected Website:| hamdantradingco.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

play-off.ru XSS vulnerability

Open Bug Bounty ID: OBB-717994 Description| Value ---|--- Affected Website:| play-off.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

olade.ru XSS vulnerability

Open Bug Bounty ID: OBB-717684 Description| Value ---|--- Affected Website:| olade.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

climatepolicyinitiative.org XSS vulnerability

Open Bug Bounty ID: OBB-717180 Description| Value ---|--- Affected Website:| climatepolicyinitiative.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

CVE-2018-20595

Summary: The CSRF vulnerability CVE-2018-20595 affects hsweb 3.0.4 in the file web/authorization/oauth2/controller/OAuth2ClientController.java. The issue arises because the request’s state parameter is not compared against the session’s state parameter after successful authentication, enabling po...

noor-realestate.com XSS vulnerability

Open Bug Bounty ID: OBB-714078 Description| Value ---|--- Affected Website:| noor-realestate.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

us.webnode.com XSS vulnerability

Open Bug Bounty ID: OBB-713712 Description| Value ---|--- Affected Website:| us.webnode.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Hackathon is over: Here are our winners!

A few weeks ago Wallarm has launched a hackathon to create a machine learning / AI model to detect attacks among normal web requests. The competition was run on Kaggle as InClass. In this competition, Kagglers were asked to develop models that identify injections among neutral input vectors using...

Welcome, Brooke Motta!

By Ivan Novikov I am excited to announce a great addition to our Go-To-Market team. Brooke Motta has joined Wallarm as Vice President of Sales. Brooke brings 15 years of Cyber Security Sales Experience to the team. She has experience selling up and down the organization from an individual securit...