CVE-2018-17901

The CVE-2018-17901 entry concerns LAquis SCADA (versions 4.1.0.3870 and earlier). It describes a vulnerability in processing project files where input is not sanitized before write operations on a stack object, potentially allowing code to be executed in the context of the current process. Docume...

CVE-2018-14772

Pydio (formerly AjaXplorer) versions 4.2.1 through 8.2.1 are affected by an authenticated remote code execution vulnerability. An attacker with administrator access to the web application can trigger arbitrary code execution on the underlying system via Command Injection. Affected component is th...

iguzzini.com XSS vulnerability

Open Bug Bounty ID: OBB-686978 Description| Value ---|--- Affected Website:| iguzzini.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...

[SECURITY] Fedora 28 Update: nekovm-2.2.0-8.fc28

Neko is a high-level dynamically typed programming language which can also be used as an embedded scripting language. It has been designed to provide a common run-time for several different languages. Neko is not only very easy to learn and use, but also has the flexibility of being able to exten...

ademe.fr XSS vulnerability

Open Bug Bounty ID: OBB-685320 Description| Value ---|--- Affected Website:| ademe.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

christian-jacquiau.fr XSS vulnerability

Open Bug Bounty ID: OBB-684902 Description| Value ---|--- Affected Website:| christian-jacquiau.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

CVE-2018-10610

CVE-2018-10610 affects LeviStudioU, versions 1.8.29 and 1.8.44, with an out-of-bounds write when processing specially crafted project files. Connected sources (NVD, ZDI/ICS, CNVD) corroborate a high-severity, remote-exploit scenario (CVSSv3 8.8). Practical impact is remote code execution in affec...

arames.fr XSS vulnerability

Open Bug Bounty ID: OBB-684267 Description| Value ---|--- Affected Website:| arames.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

Zero Trust Security Architectures - Akamai's Approach

This is Part 5 of a 5 part blog series. Jump to Part 1: Introduction Jump to Part 2: Network Micro-Segmentation Jump to Part 3: Software Defined Perimeter Jump to Part 4: Identity Aware Proxy Introduction In the first part of this blog series, we covered an overview of zero trust architecture...

WordPress WP Insert 2.4.2 Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Wp Insert - 'Fckeditor' Arbitrary File Upload Exploit Author: Mostafa Gharzi Website: https://www.certcc.ir Google Dork: /wp-content/plugins/wp-insert Vendor: Namith Jawahar Software Link:...

Imperva Joins Global Cybersecurity Tech Accord

Imperva is dedicated to the global fight to keep people's data and applications safe from cybercriminals. What this means for our Imperva Threat Research team is that we spend a lot of time researching new cyber attacks, creating mitigations and writing powerful software. We believe that nothing...

Heap-based buffer overflow in nokogiri

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially...

HackerOne: User login page doesn't implement any form of rate limiting

Hi Team, Summary: As a best practice a login page should have a rate limitting just like hackerone.com Vulnerable Request POST /auth/postlogin HTTP/1.1 Host: ctf.hacker101.com User-Agent: Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://ctf.hacker101.com/...

Taking Stock: The Internet of Things, and Machine Learning Algorithms at War

It’s in the news every day; hackers targeting banks, hospitals, or, as we’ve come to fear the most, elections. Suffice to say then that cybersecurity has, in the last few years, gone from a relatively obscure industry – let's qualify that: not in the sense of importance, but rather how folks have...

Wallarm joins AI Leaders @ AI Summit

Wallarm joins a select group of AI startups and prominent technologists from Nvidia, Netflix, Microsoft and Amazon to participate in AI Summit on September 19–20 at San Francisco’s Palace of Fine Arts. AI Summit puts AI to work by delivering real value in the business. In just 3 years this...

Imperva Recognized as a 2018 Gartner Magic Quadrant WAF Leader, Five Years Running

Gartner has named Imperva as a Leader in the 2018 Gartner Magic Quadrant for Web Application Firewalls WAF -- for the fifth year in a row! Our combination of on-premises appliances, cloud WAF, shared threat intelligence and flexible licensing once again cement us as the best choice for companies ...

Admidio 3.3.5 - Cross-Site Request Forgery (Change Permissions) Vulnerability

Exploit for php platform in category web applications Exploit Title: Admidio 3.3.5 - Cross-Site Request Forgery Change Permissions Author: Nawaf Alkeraithe Vendor Homepage: https://www.admidio.org/ Software Link:...

Syhunt Community Hybrid Scanner v6.2

Syhunt Community is a hybrid static and dynamic web application security scanner. Syhunt is able to scan any kind of application source code for potential security vulnerabilities, pinpointing the exact lines of the code that need to be patched. Or you can simply enter a start URL and get detaile...

Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection

Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection Exploit Title: Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection Exploit Author: Mostafa Gharzi Website: https://www.certcc.ir Date: 2018-08-19 Google Dork: N/A Vendor: The WP Ninjas Software Link: https://wordpress.org/plugins/ninja-forms/...

Security Bulletin: One vulnerability in IBM Java SDK affects IBM Application Delivery Intelligence v1.0.1 and v1.0.1.1 (CVE-2016-5597)

Summary There is one vulnerability in IBM® SDK Java™ Technology Edition, Version 7.1 that is used by IBM Application Delivery Intelligence v1.0.1 and v1.0.1.1. This issue was disclosed as part of the IBM Java SDK updates in Oct 2016. Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An...