Taipan - Web Application Security Scanner

Taipan is a an automated web application scanner which allows to identify web vulnerabilities in an automatic fashion. This project is the core engine of a broader project which include other components, like a web dashboard where you can manage your scan or download a PDF report and a scanner...

Cisco Umbrella Dashboard Session Expiration Issue

Cisco Umbrella uses the internet infrastructure to block connections to malicious destinations before any connections to those destinations can be established. Cisco Umbrella also provides visibility into internet activity across all devices and all ports, even when users are no longer connected ...

beanstalk-dispatch (>=0.0.3 <=0.0.5), cklauth (>=0.1.0 <=0.3.0) +120 more potentially affected by CVE-2018-7536 via django (>=2.0.0 <=2.0.2)

django PYPI version =2.0.0, =0.0.3, =0.1.0, =0.5.0, =3.0.0, =2.1.0, =1.1.0, =0.0.7, =0.1.0, =0.0.2, =1.3.0, =2.0.0, =2.0.2 - django-cas-server =1.0.0 and more Source cves: CVE-2018-7536 Source advisory: SNYK:PYTHON-DJANGO-40778...

beanstalk-dispatch (>=0.0.3 <=0.0.5), cklauth (>=0.1.0 <=0.3.0) +120 more potentially affected by CVE-2018-7537 via django (>=2.0.0 <=2.0.2)

django PYPI version =2.0.0, =0.0.3, =0.1.0, =0.5.0, =3.0.0, =2.1.0, =1.1.0, =0.0.7, =0.1.0, =0.0.2, =1.3.0, =2.0.0, =2.0.2 - django-cas-server =1.0.0 and more Source cves: CVE-2018-7537 Source advisory: SNYK:PYTHON-DJANGO-40779...

Release Notes for Veeam Management Pack 8.0 Update 5

Challenge Release Notes for Veeam Management Pack 8.0 Update 5 Cause Please confirm you are running Veeam Management Pack 8.0 prior to installing this update. You can check this in Operations Manager console under Administration | Management Packs, the build number should be 8.0.0.2218 or later. ...

Qualys Cloud Platform 2.32 New Features

This release of the Qualys Cloud Platform version 2.32 includes updates and new features for AssetView, EC2 Connector, File Integrity Monitoring, Indication of Compromise, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. Post update...

Center for Internet Security CIS-CAT Pro Dashboard Privilege Gain Vulnerability

Center for Internet Security CIS-CAT Pro Dashboard is a set of panels used to display system compliance on a dashboard. An access control error vulnerability exists in versions of Center for Internet Security CIS-CAT Pro Dashboard prior to 1.0.4. An attacker can exploit this vulnerability to gain...

The vulnerability of the Php Inventory & Invoice Management System web application lies in the lack of restrictions on file downloads, allowing a malicious user to upload a malicious file.

The vulnerability of the Php Inventory & Invoice Management System web application is related to the lack of restrictions on file uploads. Exploiting this vulnerability allows a malicious actor to upload a malicious file to the file system, where it can be executed “/dashboard/editmyaccountdetail...

Continuous Security and Compliance Monitoring for Global IT Assets

In today’s information security world, all assets everywhere must be detected, visible, protected and compliant -- all the time. It’s no longer enough to rely on “point in time” security and compliance assessments, such as scheduled weekly or monthly scans on handpicked critical servers. “You mus...

CVE-2017-8916

In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access...

CVE-2017-8916

In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access...

CVE-2017-8916

In CIS-CAT Pro Dashboard, prior to version 1.0.4, an authenticated user can change an administrator’s email address and trigger a password-recovery email to themselves, thereby gaining administrative access. This is described in CVE-2017-8916 and corroborated by CNVD/CNVD-2018-05227 and other sou...

Visualizing Spectre/Meltdown Impact and Remediation Progress

In order to determine the impact of Spectre/Meltdown and track remediation progress across your entire environment, it is important to visualize vulnerability detections in a dynamic dashboard. For more information on Spectre and Meltdown, please see our previous blog. Using Qualys AssetView, we...

Concrete CMS: Stored XSS on Add Calendar

Greetings, There is no soup like crayons soup with vegetables. Hello @Concrete5 Team. Like my last report 300532 I found other Stored XSS vulnerability in your nice CMS. If you don't mind I will omit what Stored - XSS is and its description, hope everything is fine in your side about that :. The...

Huawei SmartCare dashboard module cross-site scripting vulnerability

Huawei SmartCare is an end-to-end user perception enhancement and assurance solution from Huawei, China, for improving customer experience in the telecom sector. dashboard module is one of the dashboard modules. A cross-site scripting vulnerability exists in the dashboard module in Huawei...

Automattic: Stored XSS in learnboost.com via the lesson[goals] parameter.

Summary --- learnboost.com is vulnerable to stored XSS via the lessongoals parameter. Browsers Verified In --- Mozilla Firefox 58.0b12 64-bit PoC --- The payload I used was: html Click F249206 POST /apps/lesson/update HTTP/1.1 Host: www.learnboost.com User-Agent: Mozilla/5.0 X11; Linux x8664;...

Zomato: [www.zomato.com] Privilege Escalation - Control reviews - /████dashboard_handler.php

Introduction The handler that controls all the ███ actions for reviews is accessible for any user. The following actions are thus being left open to anyone: getmanagerstatus read███████ unread██████████ ████████ feature██████ unfeature████████ moderate████ unmoderate█████ drop ███ sendmail...

CVE-2017-15312

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...

Cross site scripting

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...

CVE-2017-15312

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...