CVE-2021-21424

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. ...

Sun Life Financial Turns to Imperva to Stop Vulnerabilities and Zero-Day Threats In Application Development Environments

Canadian financial services company saves time and money by relying on Imperva Runtime Protection RASP Sun Life Financial, a Canadian financial services company, discovered a critical vulnerability in nearly 600 of their WebLogic servers in production. With so much at risk, the financial firm...

Adobe Media Encoder Out-of-Bounds Read Vulnerability (CNVD-2021-49602)

Adobe Media Encoder is a video and audio encoding application. An out-of-bounds read vulnerability exists in Adobe Media Encoder 15.1 and earlier versions. An attacker can exploit the vulnerability to elevate privileges...

What is Vulnerability Assessment and How to Prevent Them❓

A vulnerability assessment is an essential starting step to surveying your association’s receptiveness to security challenges, including physical and computerized security. It can likewise be portrayed as a lot of specific tests planned to recognize deficiencies in your network and its key...

Privilege escalation in spring security

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen it must be programmed in...

VerityStream MSOW Solutions Information Disclosure Vulnerability

VerityStream MSOW Solutions is an application from VerityStream, Inc. A medical system. An information disclosure vulnerability exists in Primary Source Verification in VerityStream MSOW Solutions versions prior to 3.1.1, which can be exploited by an attacker to discover the Social Security Numbe...

The Evolution of DevOps in 2021

DevOps has long been a key tool in helping organizations reliably and rapidly deliver systems into production. While in the past, IT and software development teams suffered from lengthy processes and struggled to resolve incompatible priorities, now DevOps allows for easier collaboration, as well...

Aruba ClearPass Policy Manager Information Disclosure Vulnerability (CNVD-2021-33523)

Aruba ClearPass Policy Manager is an application that provides a wireless network security access management system. An information disclosure vulnerability exists in Aruba ClearPass Policy Manager versions prior to 6.9.5, 6.8.9, and 6.7.14-HF1, which can be exploited by a remote attacker to subm...

b2evolution 7-2-2 - (cf_name) SQL Injection Exploit

Exploit Title: b2evolution 7-2-2 - 'cfname' SQL Injection Author: @nu11secur1ty Vendor: https://b2evolution.net/ Link: https://b2evolution.net/downloads/7-2-2 CVE: CVE-2021-28242 Proof: https://streamable.com/x51kso + Exploit Source: !/usr/bin/python3 Author: @nu11secur1ty CVE-2021-28242 from...

CVE-2021-21541

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser...

F5 BIG-IP Licensing Issue Vulnerability (CNVD-2022-26845)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. An authorization issue vulnerability exists in BIG-IP Advanced WAF, which is caused by improper internal authorization. A remote attacker cou...

Man-in-the-middle (MITM)

In GNOME glib-networking is vulnerable to man-in-the-middle attack. GTlsClientConnection of the library skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail th...

F5 BIG-IP ASM 输入验证错误漏洞

F5 BIG-IP ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. An input validation error vulnerability exists in BIG-IP ASM that stems from insufficient...

Cacti 1.2.12 SQL Injection / Remote Code Execution

Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution Date: 04/28/2021 Exploit Author: Leonardo Paiva Vendor Homepage: https://www.cacti.net/ Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz Version: 1.2.12 Tested on: Ubuntu 20.04 CVE : CVE-2020-14295...

Logic Flaw Vulnerability in Mingus Web Application Firewall

MingGuard Web Application Firewall is a professional application security protection product that focuses on providing security protection for websites, APPs and other Web business systems, providing multi-dimensional and deep-level security detection and protection for website and APP business...

Weak Password Vulnerability in Tianqing Web Application Security Gateway Web Page Tampering Prevention System

Tianqing Web Application Security Gateway hereinafter referred to as: Tianqing WAG anti-tampering is an application layer security product developed by Qishen based on Web security protection and application delivery. There is a weak password vulnerability in Tianqing WAG anti-tamper system...

Unauthorized Access Vulnerability in Tianqing Web Application Security Gateway Web Page Tampering Prevention System

Tianqing Web Application Security Gateway hereinafter referred to as: Tianqing WAG anti-tampering is an application layer security product developed by Qishen based on Web security protection and application delivery. There is an unauthorized access vulnerability in Tianqing Web Application...

CVE-2021-29455 Missing validation of JWT signature in `grassrootza/grassroot-platform`

Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT...

CVE-2021-29455

Grassroot Platform (Grassroot Platform) has a JWT signature verification flaw during refresh, allowing forging a valid JWT. Root cause: JWTs are not properly verified when refreshing an existing token. Impact stated as enabling partial integrity compromise, with no confidentiality breach noted in...

Potential sensitive data exposure in applications using Vaadin 15

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController - https://vaadin.com/security/cve-2020-36319...