CVE-2018-20643: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory...

Arbitrary File Upload

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to Arbitrary File Upload. It is possible to for a user to upload a .php file when creating a permission on the assets feature, resulting in arbitrary code...

Thoughts on Cloud Security

Recently I've been reading about cloud security and security with respect to DevOps. I'll say more about the excellent book I'm reading, but I had a moment of déjà vu during one section. The book described how cloud security is a big change from enterprise security because it relies less on...

A Game of Risk with Broadcasters, Cyber Felons and Dragons

Submitted by Steve Ng, Lead, Digital Platform Operations, Mediacorp Where there’s money, there has always been crime. But what if money came in the form of intangible digital assets and crime in the form of cyber adversaries? In fantasy role-playing game Dungeons & Dragons, dragons are intelligen...

Find a Place CMS Directory 1.5 - assetsexternaldata_2.php cate SQL Injection

Find a Place CMS Directory 1.5 - assetsexternaldata2.php cate SQL Injection Exploit Title: Find a Place CMS Directory 1.5 - 'assets/external/data2.php cate' SQL Injection Google Dork: inurl:"assets/external/data.php" Date: 14 Feb 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa....

PT-2019-18986

Name of the Vulnerable Software and Affected Versions Themerig Find a Place CMS Directory version 1.5 Description The issue is related to SQL Injection, which occurs via the cate parameter in the "find/assets/external/data 2.php" endpoint. Recommendations For Themerig Find a Place CMS Directory...

Meet the New Imperva – Defending Your Business Growth Today and Tomorrow

Today’s Imperva is a champion in the fight to secure data and applications, wherever they reside. The threat landscape is dangerous and ever-changing, but our thousands of customers know they can count on Imperva to protect them. No wonder our solutions are recognized as leaders by analysts such ...

Qualys Cloud Platform 2.36 New Features

This release of the Qualys Cloud Platform version 2.36 includes updates and new features for AssetView Cloud Assets and Cloud Agents and Web Application Scanning, highlights as follows. AssetView Rules for Cloud Assets and Cloud Agents Rule-Based Method to Purge/Uninstall Cloud Assets and Cloud...

Cross site scripting

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/wfitemEdit.gsp...

CVE-2019-6295

Cleanto 5.0 has SQL Injection via the assets/lib/servicemethodajax.php serviceid parameter...

Sql injection

Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...

CVE-2019-6296

Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...

CVE-2019-6296

Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...

PT-2019-18083

Name of the Vulnerable Software and Affected Versions Cleanto version 5.0 Description The issue is related to SQL Injection, which can be exploited via the id parameter in the "assets/lib/export ajax.php" API endpoint. Recommendations For Cleanto version 5.0, avoid using the id parameter in the...

CVE-2019-6295: Improper Neutralization of Special Elements used in an SQL Command

Cleanto 5.0 has SQL Injection via the assets/lib/servicemethodajax.php serviceid parameter...

PT-2019-18082

Name of the Vulnerable Software and Affected Versions Cleanto version 5.0 Description The issue is related to SQL Injection via the service id parameter in the "assets/lib/service method ajax.php" API endpoint. Recommendations For Cleanto version 5.0, avoid using the service id parameter in the...

CVE-2019-6296: Improper Neutralization of Special Elements used in an SQL Command

Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...

HackerOne: Response program can display "eligible for bounty" in scope area in program policy

Hello Hackerone Team and @jobert First of all, Happy new year to everyone. Summary Response program can also display "eligible for bounty" assets on program policy. It's basically causing from backend in terms of GRAPHQL mutation query for eligible in bounty:true which stays forever on response...

FreeBSD : typo3 -- multiple vulnerabilities (bab29816-ff93-11e8-b05b-00e04c1ea73d)

Typo3 core team reports : CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

DomainMOD cross-site scripting vulnerability (CNVD-2019-07965)

DomainMOD is an open source application for managing your domain names and other Internet assets in a central location. DomainMOD 4.11.01 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the assets/add/category.php Category Name or Stakeholder fields...