Cross Site Scripting (XSS)

org.opencrx: opencrx-core-models is vulnerable to HTML Injection. The vulnerability is due to a lack of proper input sanitization in the Activity Saved Search Creation. This allows an attacker to inject malicious HTML into the application...

json-web-token library is vulnerable to a JWT algorithm confusion attack

Summary The json-web-token library is vulnerable to a JWT algorithm confusion attack. Details On line 86 of the 'index.js' file, the algorithm to use for verifying the signature of the JWT token is taken from the JWT token, which at that point is still unverified and thus shouldn't be trusted. To...

GHSA-4XW9-CX39-R355 json-web-token library is vulnerable to a JWT algorithm confusion attack

Summary The json-web-token library is vulnerable to a JWT algorithm confusion attack. Details On line 86 of the 'index.js' file, the algorithm to use for verifying the signature of the JWT token is taken from the JWT token, which at that point is still unverified and thus shouldn't be trusted. To...

The Importance of Continuous Security Monitoring for a Robust Cybersecurity Strategy

In 2023, the global average cost of a data breach reached $4.45 million. Beyond the immediate financial loss, there are long-term consequences like diminished customer trust, weakened brand value, and derailed business operations. In a world where the frequency and cost of data breaches are...

Cross site scripting

An XSS vulnerability has been discovered in ICS Business Manager affecting version 7.06.0028.7066. A remote attacker could send a specially crafted string exploiting the obddact parameter, allowing the attacker to steal an authenticated user's session, and perform actions within the application...

Cross site scripting

Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script JavaScript, VBScript in the context of the application...

CVE-2022-48192 Cross-site scripting vulnerability in Softing smartLink SW-HT

Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script JavaScript, VBScript in the context of the application...

Google Play Store Highlights 'Independent Security Review' Badge for VPN Apps

Google is rolling out a new banner to highlight the "Independent security review" badge in the Play Store's Data safety section for Android VPN apps that have undergone a Mobile Application Security Assessment MASA audit. "We've launched this banner beginning with VPN apps due to the sensitive an...

SUSE SLES12 Security Update : gcc13 (SUSE-SU-2023:4287-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4287-1 advisory. - A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer...

doc-x.de Improper Access Control vulnerability OBB-3768209

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Sql injection

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/listonlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed ...

CVE-2023-5826 Netentsec NS-ASG Application Security Gateway list_onlineuser.php sql injection

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/listonlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed ...

CVE-2023-5826

CVE-2023-5826 affects Netentsec NS-ASG Application Security Gateway 6.3. The issue arises in the unknown functionality of the file /admin/list_onlineuser.php where manipulating the SessionId parameter leads to a SQL injection. Public disclosures exist and the vulnerability has been widely reporte...

CVE-2023-5826 Netentsec NS-ASG Application Security Gateway list_onlineuser.php sql injection

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/listonlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed ...

Unlocking API Security Excellence: Wallarm at OWASP Global AppSec DC 2023

If you're involved in securing APIs, applications and web applications, or looking to learn about these, then the OWASP Global AppSec DC Conference next week is a must-attend event. Wallarm, the experts in API and application security, will be there, and we're excited to connect with you on Octob...

CVE-2023-5826: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/listonlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed ...

PT-2023-32358 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical issue was found in the Netentsec NS-ASG Application Security Gateway, affecting some unknown functionality of the file /admin/list onlineuser.php. The...

praxis-dr-adalbert-pohl.de Improper Access Control vulnerability OBB-3766345

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-41966

The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter...

CVE-2023-41966

Summary of CVE-2023-41966 (Sielco hardware): Privilege escalation in Sielco Analog FM Transmitters and Radio Link devices via HTTP POST that sets a parameter, enabling a user with read permissions to elevate privileges (Write/Admin). Affected versions span multiple revisions including 2.12 EXC500...