1220 matches found
Security Bulletin: A vulnerability in Go affects IBM Robotic Process Automation for Cloud Pak which could allow an attacker to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. (CVE-2015-5739)
Summary A vulnerability in Go affects IBM Robotic Process Automation for Cloud Pak which could allow an attacker to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. IBM Robotic Process Automation for Cloud Pak uses Go as part of it's operator deployment...
Security Bulletin: Vulnerabilities in Netty affect IBM watsonx.data
Summary Netty is vulnerable to HTTP request smuggling and weaker than expected security. These can affect watsonx.data. Vulnerability Details CVEID:CVE-2019-20444 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw in the HttpObjectDecoder.java. By sending a...
SafeLine - Serve As A Reverse Proxy To Protect Your Web Services From Attacks And Exploits
SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web apps from attacks such as SQL...
CVE-2024-45229
Versa Director exposes certain REST APIs (login, banner, device registration) without authentication. A GET request with invalid arguments can be exploited by Directors connected to the Internet to obtain authentication tokens of other logged-in users, which can be used to call additional APIs on...
Imperva Protects Against Critical Apache OFBiz Vulnerability (CVE-2024-45195)
Recently, a critical vulnerability in the widely used Apache OFBiz framework was disclosed, designated CVE-2024-45195. This vulnerability allows for unauthenticated remote code execution RCE, making it an especially dangerous flaw for organizations using OFBiz in their business operations. An...
CVE-2024-36511
FortiADC Web Application Firewall (WAF) is affected by CVE-2024-36511. The issue stems from an improperly implemented security check (CWE-358) in FortiADC WAF versions 6.0–7.4.4 when the cookie security policy is enabled, potentially allowing an attacker to retrieve the initial encrypted and sign...
CVE-2024-36511
An improperly implemented security check for standard vulnerability CWE-358 in FortiADC Web Application Firewall WAF 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an...
CVE-2024-45312
Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 or 4.2.7 for the 4.x series contain a vulnerability that allows an arbitrary language parameter in client spelling requests to be passed to the aspell executable running on the...
CVE-2024-45312 Arbitrary language parameter can passed to `aspell` executable via spelling requests in overleaf
Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 or 4.2.7 for the 4.x series contain a vulnerability that allows an arbitrary language parameter in client spelling requests to be passed to the aspell executable running on the...
CVE-2024-45312 Arbitrary language parameter can passed to `aspell` executable via spelling requests in overleaf
Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 or 4.2.7 for the 4.x series contain a vulnerability that allows an arbitrary language parameter in client spelling requests to be passed to the aspell executable running on the...
CVE-2024-45312
Summary: CVE-2024-45312 affects Overleaf Community Edition and Server Pro before 5.0.7 (or 4.x before 4.2.7). The issue lets an arbitrary language parameter in client spelling requests reach the server’s aspell process, causing it to load a dictionary file with an arbitrary filename; access is li...
WordPress Web Application Firewall plugin <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass vulnerability
IP Address Spoofing to Protection Mechanism Bypass vulnerability discovered by rezaduty in WordPress Plugin Web Application Firewall – website security versions = 2.1.2...
WordPress Web Application Firewall – website security Plugin <= 2.1.2 is vulnerable to Bypass Vulnerability
Software Web Application Firewall – website security Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2022-4539 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 056e9cc38736 Credits rezaduty...
Barracuda Multiple Product Locale Directory Traversal
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Barracuda Multiple Product "locale" Directory Traversal', 'Description' = %q This module exploits a directory traversal vulnerability present in...
CVE-2022-4539
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4539 Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4539 Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2024-8073
Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.This issue affects Hillstone Networks Web Application Firewall: from 5.5R6-2.6.7 through 5.5R6-2.8.13...
CVE-2024-8073 Command Injection Vulnerability in Hillstone Networks Web Application Firewall
Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.This issue affects Hillstone Networks Web Application Firewall: from 5.5R6-2.6.7 through 5.5R6-2.8.13...
