air-agency.co.jp XSS vulnerability

Open Bug Bounty ID: OBB-718992 Description| Value ---|--- Affected Website:| air-agency.co.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

ijermce.com XSS vulnerability

Open Bug Bounty ID: OBB-718535 Description| Value ---|--- Affected Website:| ijermce.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

hamdantradingco.com XSS vulnerability

Open Bug Bounty ID: OBB-718183 Description| Value ---|--- Affected Website:| hamdantradingco.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

play-off.ru XSS vulnerability

Open Bug Bounty ID: OBB-717994 Description| Value ---|--- Affected Website:| play-off.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

olade.ru XSS vulnerability

Open Bug Bounty ID: OBB-717684 Description| Value ---|--- Affected Website:| olade.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

climatepolicyinitiative.org XSS vulnerability

Open Bug Bounty ID: OBB-717180 Description| Value ---|--- Affected Website:| climatepolicyinitiative.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

CVE-2018-20595

Summary: The CSRF vulnerability CVE-2018-20595 affects hsweb 3.0.4 in the file web/authorization/oauth2/controller/OAuth2ClientController.java. The issue arises because the request’s state parameter is not compared against the session’s state parameter after successful authentication, enabling po...

noor-realestate.com XSS vulnerability

Open Bug Bounty ID: OBB-714078 Description| Value ---|--- Affected Website:| noor-realestate.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

us.webnode.com XSS vulnerability

Open Bug Bounty ID: OBB-713712 Description| Value ---|--- Affected Website:| us.webnode.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Hackathon is over: Here are our winners!

A few weeks ago Wallarm has launched a hackathon to create a machine learning / AI model to detect attacks among normal web requests. The competition was run on Kaggle as InClass. In this competition, Kagglers were asked to develop models that identify injections among neutral input vectors using...

Welcome, Brooke Motta!

By Ivan Novikov I am excited to announce a great addition to our Go-To-Market team. Brooke Motta has joined Wallarm as Vice President of Sales. Brooke brings 15 years of Cyber Security Sales Experience to the team. She has experience selling up and down the organization from an individual securit...

Novidade Exploit Kit Landing Page

Novidade exploit kit is a web exploit kit that operates by delivering malicious payload to the victim's computer. Successful infection will allow the attacker to download additional malware to the target...

admin.bet9ja.com XSS vulnerability

Open Bug Bounty ID: OBB-711806 Description| Value ---|--- Affected Website:| admin.bet9ja.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Facebook And Google Reviews System For Businesses 1.1 SQL Injection

Exploit Title: Facebook And Google Reviews System For Businesses 1.1 - SQL Injection Dork: N/A Date: 2018-12-14 Exploit Author: Ihsan Sencan Vendor Homepage: https://codecanyon.net/item/facebook-and-google-reviews-system-for-businesses/22793559 Version: 1.1 Category: Webapps Tested on:...

CVE-2018-5411

Pixar’s Tractor software, version 2.2 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the note field of a node. The attacker can inject JavaScript into the note, which is saved and later displayed to authenticated users, potentially enabling redirects, session cookie hi...

Cisco Web Security Appliance Privilege Escalation

The vulnerability of the account management subsystem of Cisco Web Security Appliance WSA is related to implementation errors in access control elements. Exploiting this vulnerability could allow a malicious actor to execute system commands with root privileges remotely...

Cisco Web Security Appliance Web Upload Code Injection

The vulnerability of the Cisco Web Security Appliance web interface relates to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the loaded web page through a specially crafted link using the DOM...

Cross Site Request Forgery (CSRF)

phpmyadmin is vulnerable to cross site request forgery CSRF. When an authenticated user is tricked into visiting a malicious web page, an attacker is able to perform unwanted actions on behalf of the victim such as rename databases, create new tables/routines, delete designer pages, add/delete...

PYSEC-2018-32

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...

CVE-2018-20061

CVE-2018-20061 affects ERPNext 10.x and 11.x up to 11.0.3-beta.29. The issue is a SQL injection caused by calling a server-side Python function via JavaScript, enabling an attacker with a user account (no special privileges) to craft SQL queries and retrieve arbitrary columns from any tables. The...