Ivanti Connect Secure 9.x / 22.x Server-Side Request Forgery

Ivanti Connect Secure 9.x, 22.x suffers from a Server-Side Request Forgery. By crafting a specific HTTP request, a remote attacker could exploit this vulnerability to access certain restricted resources without authentication. No source data...

WordPress 5.4.x < 5.4.15 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A PHP file upload bypass via Plugin Installer requiring admin privileges. - An RCE POP Chains vulnerability. Note that the scanner has not tested for these issues but has...

WordPress 6.4.x < 6.4.3 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A PHP file upload bypass via Plugin Installer requiring admin privileges. - An RCE POP Chains vulnerability. Note that the scanner has not tested for these issues but has...

WordPress 4.3.x < 4.3.33 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A PHP file upload bypass via Plugin Installer requiring admin privileges. - An RCE POP Chains vulnerability. Note that the scanner has not tested for these issues but has...

WordPress 6.1.x < 6.1.5 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A PHP file upload bypass via Plugin Installer requiring admin privileges. - An RCE POP Chains vulnerability. Note that the scanner has not tested for these issues but has...

Web Server Configuration File Detected

A web server configuration file has been detected on the target host. This may expose privileged information or configurations to a malicious actor. No source data...

Web Services Description Language (WSDL) File Detected

A Web Services Description Language WSDL file has been detected on this url. No source data...

Ivanti Connect Secure 9.x / 22.x Authentication Bypass

Ivanti Connect Secure 9.x, 22.x suffers from an authentication bypass vulnerability. By crafting a specific HTTP request, a remote and unauthenticated attacker could exploit this vulnerability to bypass authentication and authorization requirements. No source data...

XSLT Injection

An XSLT Injection is when an attacker tries to inject XSLT documents to the application. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts. No source data...

Atlassian Confluence 8.x < 8.5.5 Remote Code Execution

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.13.x prior to 7.19.17, 8.x prior to 8.5.5 or 8.6.x prior to 8.7.2. It is, therefore, affected by a remote code execution vulnerability. Note that the scanner has not tested for thes...

Atlassian Confluence 7.13.x < 7.19.17 Remote Code Execution

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.13.x prior to 7.19.17, 8.x prior to 8.5.5 or 8.6.x prior to 8.7.2. It is, therefore, affected by a remote code execution vulnerability. Note that the scanner has not tested for thes...

Node-config Configuration File Detected

Node-config is a Node.js module providing hierarchical configurations to help with web applications deployments. By defining one or more configuration files in their application project 'config' directory or in a custom location, developers can define various configuration variables to be used in...

Digest Authentication Detected

The scanner detected the presence of a web page protected by a 'Digest' authentication. No source data...

JavaScript Source Map Detected

Developers often combine and minify their application JavaScript sources to help the server delivering it more efficiently to the client browsers. Sometimes, web applications JavaScript code may also be transpiled from another language like CoffeeScript of TypeScript. A source map is a file that...

Bearer Token Authentication Detected

The scanner detected the presence of a web page protected by a 'Bearer' authentication. No source data...

SAP ICF Open-Redirect

In all versions of SAP ABAP Platform, SAP NetWeaver, SAP Web Application Server and SAP S/4HANA an Open Redirect exists via the 'redirecturl' parameter from the logoff page. This can be used to redirect the victim to a malicious URL. Cyber-criminals will abuse these vulnerabilities in social...

NTLM Authentication Detected

The scanner detected the presence of a web page protected by a 'NTLM' authentication. No source data...

External Backend API Detected

Modern web applications often rely on a third party service as a backend when they are built with a micro-service architecture or using a third party SaaS service. In such deployments, it is recommended to perform additional scans directly against these backend hosts with the consent and approval...

XML Injection

An XML Injection is when an attacker tries to inject an XML documents to the application. If the XML parser fails to contextually validate data, then the test will yield a positive result. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the...

SAP NetWeaver KW Reflected Cross-Site Scripting

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data. No source data...