1104 matches found
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
Impact An open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirect to any URL. To reproduce, open /xwiki/bin/view/Main/?foo=bar&foosyntax=invalid&RequiresHTMLConversion=foo&xerror=https://www.example.com/ where is the...
NetScaler-13.1- Missing Web App Firewall Logs in NetScaler
Missing Web App Firewall Logs in NetScaler...
Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2025-12796)
Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content...
Fortinet FortiWeb Path Traversal Vulnerability
Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...
Consistent Security Everywhere: Akamai Makes Leading WAF Technology CDN-Agnostic
...
Fortinet FortiWeb 路径遍历漏洞
Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...
Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028
This module enables users to log in using a short access code instead of providing a username/password combination. The module doesn't sufficiently protect against brute force attacks to guess a user's access code. This vulnerability is mitigated by the fact that access code based logins are off ...
The 2025 WAF Wave from the Other Side
Forrester just published its 2025 Web application Firewall Wave. As a former industry analyst, and as a contributor on the vendor side for Imperva cough, a leader in the report, cough, let me share some reactions on the shape of this report. The Center of the Universe The first top level header H...
SUSE CVE-2025-29914
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUESTFILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUESTFILENAME will be...
Exploit for CVE-2025-30208
Blog Recommendations https://w8ay.fun/toc Recently, a po...
PT-2025-12427
Name of the Vulnerable Software and Affected Versions Next.js versions 1.11.4 through 12.3.4 Next.js versions 12.3.5 through 13.5.8 Next.js versions 13.5.9 through 14.2.24 Next.js versions 14.2.25 through 15.2.2 Description An issue in the handling of the x-middleware-subrequest header allows...
Imperva Named a Leader in Forrester Wave™: Web Application Firewall (WAF) Solutions: A Continued Legacy of Excellence
In today’s digital-first environment, protecting web applications and APIs is a critical priority for businesses. Organisations seek trusted solutions that balance robust protection, scalability, and ease of use. It’s no surprise that Imperva has been named a Leader in the Forrester Wave: Web...
CVE-2025-29914
OWASP Coraza WAF (Go library, modsecurity-compatible) is affected by a parser confusion that yields a wrong REQUEST_FILENAME when the URI starts with //, enabling a potential rules bypass. The issue stems from how the parser maps // URIs to filesystem paths and is fixed in Coraza 3.3.3. Connected...
Akamai Named a Leader in the Latest Forrester Report for WAF Solutions
...
OWASP Coraza WAF 安全漏洞
OWASP Coraza WAF is a golang modsecurity-compatible web application firewall library from Coraza open source. A security vulnerability exists in OWASP Coraza WAF versions prior to 3.3.3, which stems from mishandling of URI requests that begin with //, which could lead to rule bypass...
Fortinet FortiWeb Web application firewall rules bypass by using an empty filename (FG-IR-23-115)
The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-23-115 advisory. - Two improper handling of syntactically invalid structure vulnerabilities CWE-228 in FortiWeb may allowan...
Linux Distros Unpatched Vulnerability : CVE-2022-48279
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is...
The vulnerability of the TMOS Shell configuration tool’s IControl REST interface allows attackers to execute arbitrary commands. This vulnerability relates to the BIG-IP Access Policy Manager, as well as software programs such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibility and Reporting (AVR), BIG-IP Camer-Grade NAT (CGNAT), BIG-IP DDos Hybrid Defender, BIG-IP Domain Name System, BIG-IP Edge Gateway, BIG-IP Fraud Protection Service, BIG-IP Global Traffic Manager, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Inforcement Manager, BIG-IP SSL Orchestrator, BIG-IP Webaccelerator, and BIG-IP WebSafe.
The vulnerability of the TMOS Shell configuration tool’s IControl REST interface exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2025-03519)
Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content...
