Session Fixation in https://demo.froxlor.org/

Description The session ID not rotating even after relogin POC 1. Change the PHPSESSID=newsessionchanged and then login 2. Use the same session into new browser and as you can see logged into the account 3. you can try logout and login again the PHPSESSID doesn't change. Video POC:...

CVE-2022-46285

A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library...

CVE-2022-2658 WP Spell Check < 9.13 - Admin+ Stored Cross-Site Scripting

The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Is the FSI innovation rush leaving your data and application security controls behind?

Fuelled by rising consumer expectations for innovative services and easy real-time access to financial products and information, financial services industries FSI and fintech organizations are racing to out-innovate each other and capture market share. The sizeable growth of investments into the...

Law enforcement app SweepWizard leaks data on crime suspects

SweepWizard, an obscure app apparently created by ODIN Intelligence and used by more than 60 law enforcement departments, has a flaw: According to an ethical hacker, a misconfiguration in the app's API application programming interface caused it to unintentionally leak to the open internet a trov...

SAP NetWeaver AS ABAP XSS (3283283)

The ABAP Keyword Documentation of SAP NetWeaver Application Server for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity ...

CVE-2023-0023

Technical details (affected software, exact versions, root cause, exploit specifics) are not publicly available in the provided connected documents. Monitor SAP notes and related advisories for updates.

CVE-2023-0015 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (Web Intelligence)

In SAP BusinessObjects Business Intelligence Platform Web Intelligence user interface - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intelligence DHTML may be vulnerable to XSS...

CVE-2022-36441

CVE-2022-36441 affects Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and access several administrator-restricted apps, creating a local impact. CVSS v3.1 base score 7.1 (HIGH). Root cause is not elaborated beyond the interaction between Gboar...

PT-2023-1013 · Sap · Sap Businessobjects Business Intelligence Analysis Edition For Olap

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Analysis edition for OLAP affected versions not specified Description: The issue allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On...

ntpd_driver 代码注入漏洞

ntpddriver is a library from Vladimir Ermakov's personal developer. Converts ROS TimeReference messages to ntpd shm format. A security vulnerability exists in ntpddriver versions prior to 1.3.0, 2.x series prior to 2.2.0, which stems from the fact that the topic nam depends on the timereftopic...

SimbCo httpster vulnerable to Path Traversal

A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is...

Top 5 Web App Vulnerabilities and How to Find Them

Web applications, often in the form of Software as a Service SaaS, are now the cornerstone for businesses all over the world. SaaS solutions have revolutionized the way they operate and deliver services, and are essential tools in nearly every industry, from finance and banking to healthcare and...

Bypass All Captchas in the application

Description Bypass Captcha while adding a new Proposal for a new FAQ or Add question ,And send unlimited request without submit captcha code. Proof of Concept https://drive.google.com/file/d/140CMe4FLFLBmIUUbI8706bZ4zs4d7N/view?usp=sharing...

Internet Bug Bounty: Rails ActionView sanitize helper bypass leading to XSS using SVG tag.

Loofah versions between 2.1.0 and 2.19.1 were vulnerable to a cross-site scripting XSS attack via the image/svg+xml media type in data URIs. This allowed an attacker to bypass HTML sanitization and execute malicious code. The vulnerability was mitigated by upgrading to Loofah version 2.19.1 or...

Unauthorized Access Vulnerability in Qixing Tianqing WEB Application Security Gateway

Qixing Tianqing Web Application Security Gateway is a Web Application Security Gateway of Qixing Information Technology Group Co. An unauthorized access vulnerability exists in Qixing Tianqing Web Application Security Gateway, which can be exploited by attackers to obtain sensitive information...

CVE-2022-39900

Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the application installed in Secure Folder through Nice Catch...

CVE-2022-38379

Fortinet FortiSOAR is affected by CVE-2022-38379 (CWE-79): improper neutralization of input during web page generation, enabling an authenticated attacker to inject HTML tags through input fields in FortiSOAR versions 7.0.0–7.0.3 and 7.2.0. The connected documents confirm the vulnerability in For...

How the Modern Data Landscape Made the Traditional Cybersecurity Approach Obsolete

From the news headlines, we know that data breaches are on the rise - both in frequency and scale. While this reality is unsettling, it’s not surprising. That is because the volume of data being collected and stored by organizations continues to grow exponentially each year. Every day, the global...

The 5 Core Principles of the Zero-Trust Cybersecurity Model

When even the US Government concludes that to ensure baseline security practices are in place and to realize the security benefits of cloud-based infrastructure while mitigating associated risks, they must migrate to a zero-trust model, every organization should be actively moving in that...