910 matches found
LCDS LAquis SCADA
1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: LCDS—Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Equipment: LAquis SCADA Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an...
Command Execution Vulnerability in Ruijie NBR Routers (CNVD-2021-58700)
Ltd. is a professional network vendor with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products, storage, etc. A command execution vulnerability exists in Ruijie NBR routers, which can be exploited by attackers...
SQL Injection Vulnerability in Riptide NBR Routers
Ruijie Networks Co., Ltd. is a professional network manufacturer with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products, storage, and so on. A SQL injection vulnerability exists in Ruijie NBR routers, which...
Sensormatic Electronics C-CURE 9000 (Update A)
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Equipment: C-CURE 9000 Vulnerability: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...
WAF-A-MoLE - A Guided Mutation-Based Fuzzer For ML-based Web Application Firewalls
A guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool for assessin...
List of order ids, number, items total and token value exposed for unauthorized uses via new API
Impact Part of the details order ID, order number, items total, and token value of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to...
The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.
The vulnerability of FortiWeb web applications’ network firewalls exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely, using the SAML serve...
The vulnerability of FortiWeb web applications’ network firewalls, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary commands.
The vulnerability of FortiWeb web applications’ network firewalls is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely by sending specially crafted SQL queries...
Symfony Elevation of Privilege Vulnerability
Symfony is a PHP framework based on the MVC architecture and is free software, distributed under the MIT License. Symfony suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain access to all firewalls by sending a specially crafted request...
Authentication granted to all firewalls instead of just one
Description ----------- When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a...
GHSA-RFCF-M67M-JCRQ Authentication granted to all firewalls instead of just one
Description ----------- When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a...
Privilege Escalation
symfony is vulnerable to privilege escalation. The vulnerability exists due to an insecure authenticated token by one of the firewall being available to all other firewall...
CVE-2021-32693 Authentication granted with multiple firewalls
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the...
CVE-2021-32693: Authentication granted to all firewalls instead of just one
More info at https://symfony.com/cve-2021-32693...
CVE-2021-32693: Authentication granted to all firewalls instead of just one
More info at https://symfony.com/cve-2021-32693...
Sensio Labs Symfony 授权问题漏洞
Symfony is a PHP framework based on the MVC architecture and is free software, distributed under the MIT License. Symfony suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain access to all firewalls by sending a specially crafted request...
PT-2021-3455 · Symfony · Symfony
Name of the Vulnerable Software and Affected Versions: Symfony versions 5.3.0 through 5.3.1 Description: A vulnerability in Symfony is related to firewall authentication. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other...
Riptide Networks Unified Internet Behavior Management Exploits Arbitrary File Download Vulnerability
Ruijie Networks is a specialized network vendor with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products, storage, and more. An arbitrary file download vulnerability exists in Ruijie Network's Unified Internet...
CVE-2021-20027
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls...
Buffer overflow
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls...