5289 matches found
CVE-2020-15158 Heap buffer overflow in libIEC61850
In libIEC61850 before version 1.4.3, when a message with COTP message length field with value 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remote code. If your application is used in...
CVE-2020-5928
In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF protection token can be reused multiple times...
CVE-2020-5927
In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, BIG-IP ASM Configuration utility Stored-Cross Site Scripting...
CVE-2020-5914
In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed server cookie scenario may cause BD to restart under some circumstances...
WAF and RASP: Best Practice for Defense in Depth
Why do you need a RASP solution if WAFs layer of defense is so powerful? The simple answer is that no single security product can provide protection for all threat vectors. A comprehensive IT security strategy includes risk-appropriate controls implemented where they can provide maximum efficacy,...
Imperva mitigates largest DDoS attacks of 2020… so far…
The word “unprecedented” has never been used so much as it has during 2020. And in the latest of many unprecedented events, July saw the two largest recorded DDoS attacks of the year so far. As revealed in our July 2020 Cyber Threat Index Report, published today, Imperva Research Labs recorded tw...
CVE-2019-20150
CVE-2019-20150 affects TreasuryXpress 19191105. A logged-in user can reveal saved SSH/SFTP credentials by manipulating the app’s editor to point the SFTP Host IP at a malicious host and then invoking Check Connectivity, causing the application to send saved credentials to the attacker-controlled ...
Information Disclosure
mysql server is vulnerable to information disclosure. An easily exploitable vulnerability allows privileged user to affect the confidentiality of the application...
Denial Of Service (DoS)
mysql server is vulnerable to denial of service. A difficult to exploit vulnerability allows a privileged user to affect the availability of the application...
Cross site scripting
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...
Rockset: Failure to Invalid Session after Password Change
Summary: While conducting my researching I discovered that the application Failure to invalidate session after password. In this scenario changing the password doesn't destroys the other sessions which are logged in with old passwords. Steps To Reproduce: 1. Login with the same account in Chrome...
Car Rental Script Cross Site Scripting
==================================================================== Car Rental Script - Stored XSS ==================================================================== .:. Author : Yussef Dajdaj .:. Contact : .:. Vendor : https://projectworlds.in/ .:. Script :...
Secure and Integrate Your Azure DevOps CI/CD Pipeline
Explore experiments from Chuck Losh, Solution Architect, to explore how Application Security can help protect your applications at runtime as they are built, and integrate with your automated Azure DevOps CI/CD pipeline with automated testing...
Cisco Webex Meetings Token Handling Unauthorized Access (cisco-sa-webex-token-zPvEjKN)
According to its self-reported version, Cisco Webex Meetings is affected by an authorization bypass vulnerability due to improper handling of authentication tokens. An unauthenticated, remote attacker can exploit this, by sending specially crafted requests, to gain the privileges of another...
Siemens SICAM A8000 RTUs
1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SICAM A8000 Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could compromise the confidentiality, integrity, and availability of the web application...
Denial Of Service (DoS)
usrsctp is vulnerable to denial of service. An out-of-bounds read in sctploadaddressesfrominit allows an attacker to crash the application...
Zero Trust: From security option to business imperative overnight
Not long ago when I spoke with customers about Zero Trust, our conversations focused on discussing the principles, defining scope, or sharing our own IT organization’s journey. Zero Trust was something interesting to learn about, and most organizations were very much in the exploratory phase. As...
Vulnerability Spotlight: Microsoft issues security update for Azure Sphere
Claudio Bozzato, Lilith and Dave McDaniel of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos researchers recently discovered seven vulnerabilities in Microsoft’s Azure Sphere, a cloud-connected SoC platform designed specifically with IoT application security in mind...
Black Hat USA 2020: Critical Meetup.com Flaws Reveal Common AppSec Holes
Critical flaws in the popular Meetup platform were revealed Monday as part of research unleashed at this week’s Black Hat USA 2020. The flaws, which have been patched, enable the full takeover of Meetup “Groups” by threat actors, who can also redirects payments and carryout other malicious action...
liderfamily.estate Cross Site Scripting vulnerability OBB-1248355
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...