Qualys Cloud Platform 2.39 New Features

This release of the Qualys Cloud Platform version 2.39 includes updates and new features for Out-of-Band Configuration Assessment OCA, Vulnerability Management, and Web Application Scanning, highlights as follows. Vulnerability Management Trending uses Include/Exclude Filters in Dashboard – Widge...

ikiwiki < 3.20170111.1, 3.2018x < 3.20190228 SSRF Vulnerability

ikiwiki is prone to a server-side request forgery SSRF vulnerability via the aggregate plugin. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Symantec Data Loss Prevention Cross-Site Scripting Vulnerability

Symantec Data Loss Prevention DLP is a set of data leakage prevention solutions from Symantec Symantec. The product is mainly used to discover, monitor and protect sensitive data and so on. A cross-site scripting vulnerability exists in Symantec DLP 15.5 MP1 and earlier versions. The vulnerabilit...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2019-18595)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Netdata Web application information disclosure vulnerability

Netdata Web application is a web-based host monitoring application. An information disclosure vulnerability exists in Netdata Web application version 1.10.0. The vulnerability arises from a configuration or other error in the operation of a network system or product. An unauthorized attacker coul...

UBUNTU-CVE-2018-18837

An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of webclientapirequestv1data in web/api/webapiv1.c...

Konan - Advanced Web Application Dir Scanner

Konan is an advanced open source tool designed to brute force directories and files names on web/application servers. Installation Download Konan by cloning the Git repository: git clone https://github.com/m4ll0k/Konan.git konan Install requirements with pip cd konan && pip install -r...

Host Header Attack

spring-security-web is vulnerable to Host header attacks. Lack of validation and whitelisting on the host header value could result in successful host header attacks that potentially leads to cache poisoning or phishing attacks, depending on the behavior of the web application...

biopappel.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8544 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting biopappel.com website and its users. Following coordinated...

Discourse < 2.3.0.beta3 Multiple Vulnerabilities

Discourse is prone to an information disclosure and a bypass vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Discourse < 2.3.0.beta2 XSS Vulnerability

Discourse is prone to a cross-site scripting vulnerability in dashboard report tables. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Discourse < 2.3.0.beta9 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities in 3rdparty components. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ruby-openid SSRF via claimed_id request

Ruby OpenID aka ruby-openid through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible...

GHSA-FQFJ-CMH6-HJ49 ruby-openid SSRF via claimed_id request

Ruby OpenID aka ruby-openid through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2019-34745)

SAP BusinessObjects Business Intelligence Platform is a suite of bookstore intelligence software and enterprise performance solutions from Germany's SAP. The product features report generation, analytics and data visualization. A cross-site scripting vulnerability exists in SAP BusinessObjects...

Joomla! < 3.9.7 Multiple Vulnerabilities

Joomla! is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Adobe ColdFusion Code Injection Vulnerability (APSB19-27)

Adobe ColdFusion is prone to a code injection vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:coldfusion"; i...

CVE-2019-3413

The CVE-2019-3413 entry concerns an XSS vulnerability in ZTE NetNumen DAP. All versions up to V20.18.40.R7.B1 are affected due to insufficient validation of client data in Web applications, which can lead to user account hijacking. The connected documents confirm the issue and reiterate the same ...

CVE-2019-3410

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

Command Execution Vulnerability in DM Enterprise Website System

DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. DM enterprise website building system has a command execution vulnerability , attackers can use the vulnerability to obtain server privilege...