5287 matches found
CVE-2019-11027
Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...
Imperva to Acquire Distil Networks, the Leader in Bot Management
As an established leader in cybersecurity, Imperva provides our customers the most comprehensive, analyst-recognized application security solution on the market. We are a five-time leader in Gartner’s 2018 Magic Quadrant for Web Application Firewalls WAF. Our DDoS Protection continues to...
MacOS Zero Day Allows Trusted Apps to Run Malicious Code
A researcher has revealed a zero-day flaw in Apple’s Mojave operating system tied to the way the OS verifies apps. The bug allows attackers to sneak past macOS security measures and run whitelisted apps that have been manipulated to run malicious code. macOS researcher Patrick Wardle revealed the...
Magic: CSRF in generating developer api_key
Hi At https://dashboard.forttmatic.com when developer tries to generate new apikey for his application, a POST request is sent to https://api.forttmatic.com which doesn't have any tokens to guard against CSRF attacks. CSRF POC : history.pushState'', '', '/' On submitting the above request, a new...
Web Security Leader Rapidly Expands by Partnering with AWS and Imperva
Companies try to plan and pace their growth. Those plans go out the window when a merger or acquisition happens, as it did to DigiCert Inc. DigiCert, based in Lehi, Utah, had long been a leading Certificate Authority CA, providing electronic documents that verify and authenticate the identities o...
Nagios XI 5.6.1 - SQL injection
Exploit Title: Nagiosxi username sql injection Date: 22/05/2019 Exploit Author: JameelNabbo Website: jameelnabbo.com Vendor Homepage: https://www.nagios.com Software Link: https://www.nagios.com/products/nagios-xi/ Version: xi-5.6.1 Tested on: MacOSX CVE: CVE-2019-12279 POC: POST...
Debian DLA-1794-1 : libspring-security-2.0-java security update
A vulnerability was discovered in libspring-security-2.0-java, a modular Java/J2EE application security framework, when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance, resulting in insecure randomness. For Debian 8 'Jessie', this problem has been fixed in version...
CVE-2019-4072
IBM Tivoli Storage Productivity Center IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17 allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time,...
Vulnerabilities in financial mobile apps put consumers and businesses at risk
Security hubris. It’s the phrase we use to refer to our feeling of confidence grounded on assumptions we all have but may not be aware of or care to admit about cybersecurity—and, at times, privacy. It rears its ugly head when 1 we share the common notion that programmers know how to code securel...
Buffer Overflow
libwmf is a library for reading and converting Windows Metafile Format WMF vector graphics. libwmf is used by applications such as GIMP and ImageMagick. It was discovered that libwmf did not correctly process certain WMF Windows Metafiles with embedded BMP images. By tricking a victim into openin...
Denial Of Service (DoS)
Libxml2 is vulnerable to denial of service DoS. The attack is possible because of heap-based buffer overflow in the way libxml2 handled documents that enable entity expansion. A remote attacker could provide a large, specially-crafted XML file that, when opened in an application linked against...
CVE-2015-9284
The request phase of the OmniAuth Ruby gem 1.9.1 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...
Management Interface Exposed
github.com/heketi/heketi does not require authentication to its management interface. This allows a remote attacker to gain unauthenticated access to management functions and perform further attacks against the application...
CVE-2016-1584
CVE-2016-1584 concerns Unity8 on large-screen devices where a running but non-active application could communicate with Maliit and consume keyboard input. The connected sources confirm this is a vulnerability in the Unity8/converged application lifecycle, allowing background apps to interact with...
How to find Web App Yummy Days of the security vulnerabilities? - Vulnerability warning-the black bar safety net
As a financial Web application developer, I of the security issues have been of particular concern. In the past two years, I was involved in some Web application before entering the production mode before, will go through comprehensive and rigorous safety checks to ensure they are in fully...
Casino Goes All In and Wins Big with Imperva Security
There’s no good time to be hit by ransom-seeking DDoS attackers. For one casino-entertainment provider, the timing was particularly bad — right before one of its largest online poker events in 2016. The casino, which generates multiple billions in revenue per year, leveraged Imperva’s emergency...
Mail.ru: Reflected cross site scripting at https://auto.mail.ru/reviews/add_review/ via problems_text parameter.
Description https://auto.mail.ru is vulnerable for xss. It is possible for an attacker to inject arbitrary JavaScript in application response Step to reproduce 1. Open the below link in Firefox...
DefectDojo v1.5.4 - Application Vulnerability Correlation And Security Orchestration Application
DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, schedule scans, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one...
Zomato: [Zomato Order] Insecure deeplink leads to sensitive information disclosure
Hello, i want to report the vulnerability found, Since the following activity com.application.zomato.activities.DeepLinkRouter has exported="true" it can be exploited by another application. Application Information Application: Zomato Order - Food Delivery App Package Name:...
