CVE-2019-1672 Cisco Web Security Appliance Decryption Policy Bypass Vulnerability

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorre...

CVE-2019-1672: Uncontrolled Resource Consumption

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorre...

Cisco Web Security Appliance Decryption Policy Bypass Vulnerability

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorre...

PT-2019-1378

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance versions 10.1.x through 10.5.x Description The issue is related to the incorrect handling of SSL-encrypted traffic in the Decryption Policy Default Action functionality. This could allow a remote attacker to bypass...

CVE-2019-7325

CVE-2019-7325 describes a Reflected XSS in ZoneMinder up to version 1.32.3, caused by insecure handling of $_REQUEST['PHP_SELF'] in multiple web/skins/classic/views. The issue allows an attacker to inject scripts via crafted URLs and affects web interfaces that do not filter input. Connected docu...

CVE-2019-7341

CVE-2019-7341 affects ZoneMinder up to and including version 1.32.3. The issue is a reflected XSS in the view_monitor flow (monitor.php) via the newMonitor[LinkedMonitors] parameter due to insufficient input filtering. Root cause: improper filtration of a user-supplied value leads to HTML/JavaScr...

SuiteCRM 7.10.7 SQL Injection

Exploit Title: SuiteCRM 7.10.7 - 'parentTab' SQL Vulnerabilities Dork: N/A Date: 03-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://suitecrm.com/ Software Link: https://suitecrm.com/download/ Version: 7.10.7 Category: Webapps Tested on: Wampp @Win CVE: N/A Software Description:...

CVE-2019-7313

CVE-2019-7313 – Buildbot CRLF Injection : The flaw is in www/resource.py in Buildbot before 1.8.1, allowing CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. Root cause: missing input validation in the redirection code, enabling header manipulation ...

Bolt - CSRF Scanning Suite

Bolt is in beta phase of development which means there can be bugs. Any production use of this tool discouraged. Pull requests and issues are welcome. I also suggest you to put this repo on watch if you are interested in it. Workflow Crawling Bolt crawls the target website to the specified depth...

CVE-2019-6992

A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI...

CVE-2019-6990

CVE-2019-6990 is a stored-self XSS in ZoneMinder up to version 1.32.3, triggered via a crafted Zone NAME in the URL index.php?view=zones&action=zoneImage&mid=1. The vulnerability affects web/skins/classic/views/zones.php. Exploitation could allow HTML/JavaScript execution in the vulnerable field....

CVE-2019-6992

CVE-2019-6992 is a stored-self XSS in ZoneMinder up to version 1.32.3, via web/skins/classic/views/controlcaps.php. An attacker can inject HTML/JavaScript by exploiting a long NAME or PROTOCOL in index.php?view=controlcaps, resulting in code execution in the vulnerable field. Exploitation details...

Cross site scripting

An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter...

CVE-2019-6777

CVE-2019-6777 affects ZoneMinder v1.32.3 with a reflected XSS in web/skins/classic/views/plugin.php reachable via zm/index.php?view=plugin pl parameter. Root cause: insufficient input sanitization for the pl parameter, allowing injection into reflected output. Impact per sources: partial confiden...

Securing Social / Locking Login / Armoring Authentication

Authentication might be the single biggest hazard for web security over the next decade. It's not that the fundamentals of authentication are particularly challenging; we've understood the basic principles behind password management, push-based authorization, and device certificates for some time...

Webshell Bypass Vulnerability in Web Security Dog (Apache Edition) V4.0

Website Security Dog Apache Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features. Web Security Dog Apache Edition V4.0 has a webshell bypass vulnerability that can be exploited by attackers to execute...

Vanco website builder system has xss vulnerability

Guangzhou Vanke Internet Technology Co., Ltd Vanke for short is an innovative enterprise that specializes in providing Internet marketing services for small and medium-sized enterprises SMEs. An xss vulnerability exists in the Vanke website builder system, which can be exploited by attackers to...

UBUNTU-CVE-2018-6109

readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page...

Microsoft Office SharePoint CVE-2019-0558 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Foxit PDF Reader XFA xdpContent information leak vulnerability

Summary An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software’s PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger an out-of-bounds read, which can disclose sensitive memory content and aid in exploitati...