Denial Of Service (DoS)

dnsmasq is vulnerable to denial of service. A memory leak in the createhelper function in /src/helper.c allows an attacker to crash the application...

CVE-2020-16242

CVE-2020-16242 applies to GE Reason S20 Ethernet Switch. Affected products: S2020 and S2024 firmware versions prior to 07A06. Vulnerability: cross-site scripting (XSS) due to improper neutralization of input during web page generation (CWE-79) in the device’s WEB interface, potentially enabling a...

Sql injection

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injecti...

Secure Cloud Infrastructures with Application Security

Watch this video to see how applications can be simplified with serverless technologies and how security and monitoring controls can be seamlessly maintained in these constrained environments...

Applied ThreadFix: Application Portfolio Tracking

Asset management is a serious issue across the information security space. A very common challenge we see for organizations running an application security program is just getting an idea of what applications they have available and what infrastructure has been deployed to support them. You cant...

Stripo Inc: weak password poilicy in signup password leak to account takeover

Summary: add summary of the vulnerability i create account with weak password Steps To Reproduce: add details for how we can reproduce the issue 1.i create account with weak password qwerty123 2- account create done without validation 3- it should have protected users from attack and have policy...

Putting Your Data Security at the Center of our Mission

We’re more than just an industry-leading Web Application Firewall! For a long time now, Imperva has been known in the cyber security industry as ‘the WAF company’. The go-to brand for Application Security and Web Application Firewalls. But this is only possible due to our data protection DNA. Thi...

vulhub

It is an offensive tool for web application security training. The repository contains a collection of pre-built vulnerable docker environments for web application security training. The tool is designed to be easy to use, requiring only two simple commands to compile and run a vulnerable...

byty-v-praze7.cz Cross Site Scripting vulnerability OBB-1320376

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Remote code execution

A Remote Code Execution vulnerability exists in the SAP NetWeaver ABAP Server, up to release 7.40 and ABAP Platform release 7.40.Because of this, an attacker can exploit these products via Code Injection, and potentially enabling to take complete control of the products, including viewing,...

CVE-2020-6334

CVE-2020-6334 concerns SAP 3D Visual Enterprise Viewer (v9) where parsing of SKP files can trigger a use-after-free in a sandbox subprocess, allowing remote code execution. The vulnerability occurs when the software processes a manipulated SKP file from untrusted sources, with exploit requiring u...

Every Application Should Be Behind a WAF

It's no secret that security threats continue to expand in volume and variety, making headlines on virtually a daily basis. From nation-state attacks, corporate espionage, and data exfiltration campaigns to all-in-one and sneaker bot campaigns, businesses across the globe find themselves dealing...

Malicious Package in uploader-plugin

Version 1.0.2 of uploader-plugin contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...

Malicious Package in stream-combine

Version 2.0.2 of stream-combine has malicious code design to steal credentials and credit card information. The code searches all form elements for passwords, credit card numbers and CVC codes. It then uploads the information to a remote server using HTML links embedded in the page or form action...

Malicious Package in json-serializer

Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 2.0.10 of this module is found installed yo...

GHSA-C8H6-89Q2-MGV8 Malicious Package in dossier

Version 0.0.4 of dossier contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.4 of this module is found installed you will wan...

GHSA-VP8G-53FW-R9F2 Malicious Package in dynamo-schema

Version 0.0.3 of dynamo-schema contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.3 of this module is found installed you wi...

vulhub

It is an offensive tool for web application security training. The target product/service or framework is not explicitly stated, but the repository contains various vulnerable environments based on Docker-Compose, including Flask, Apache, Nginx, and others. The vulnerability class/vector is not...

CVE-2020-15158 Heap buffer overflow in libIEC61850

In libIEC61850 before version 1.4.3, when a message with COTP message length field with value 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remote code. If your application is used in...

CVE-2020-5928

In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF protection token can be reused multiple times...