Authentication flaw

Barracuda Web Application Firewall WAF 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string...

CVE-2014-2595

Barracuda Web Application Firewall (WAF) firmware version 7.8.1.013 is affected by an authentication bypass: an attacker can reuse a non-expiring authentication token embedded in a query string to gain access to the WAF interface. The vulnerability originates from a flaw in how the temporary/perm...

CVE-2014-2595

Barracuda Web Application Firewall WAF 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string...

Native integrations in Wallarm WAF

How to configure sending reports to email? How to get a notification to the messenger about an event requiring a response? How to connect Wallam and other solutions that use DevOps and the security team? Integrations will help to solve all these issues in Wallam WAF. And today we'll talk about th...

Glassdoor: XSS at https://www.glassdoor.com/Salary/* via filter.jobTitleExact

Summary: There exists a Cross Site Scripting and Content Injection vulnerability at https://www.glassdoor.com/Salary/ via the filter.jobTitleExact query parameter. Using URL encoded HTML entities, it is possible to inject HTML content and break out of the context of a tag. The WAF does a good job...

Imperva Received Top Scores in Gartner’s “Critical Capabilities for Cloud Web Application Firewalls”

The web application landscape is constantly changing, and the tools needed for the best application security protection need to change with the landscape. With Imperva’s recent improvements in API Security, Bot Management, DDoS and Cloud WAF, it’s easy to see why we are among the highest-scored...

WordPress Database Reset Plugin Vulnerability (CVE-2020-7047, CVE-2020-7048)

A vulnerability recently disclosed by Wordfence and published as CVE-2020-7047 and CVE-2020-7048 allows an attacker to take over vulnerable WordPress-based websites. Functionality in the WP Database Reset plugin introduced the vulnerability, which allows any unauthenticated user to reset any tabl...

CVE-2011-5266

Imperva SecureSphere Web Application Firewall WAF before 12-august-2010 allows SQL injection filter bypass...

CVE-2011-5266

Imperva SecureSphere Web Application Firewall WAF before 12-august-2010 allows SQL injection filter bypass...

CVE-2011-5266

CVE-2011-5266 affects Imperva SecureSphere Web Application Firewall (WAF). The vulnerability allows bypass of SQL injection filters in versions prior to 12 August 2010. The CVSS metrics indicate high impact across confidentiality, integrity, and availability (NVD CVSS 2.0: base score 7.5; CVSS 3....

WAFW00F v2.0 - Allows One To Identify And Fingerprint Web Application Firewall (WAF) Products Protecting A Website

The Web Application FirewallFingerprinting Tool. — FromEnable Security How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number of potentially...

Vxscan

This is a Python script called Vxscan, which is a comprehensive scanning tool. It is written in Python 3.6 or later and is designed to perform various scanning tasks, including sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system...

Mail.ru: Reflected XSS with WAF Bypass https://pw.mail.ru

Reflected user-assisted XSS in https://pw.mail.ru...

New Wallarm Dashboard

There is an update in the Wallarm Console, which presents a brand new dashboard that can’t be missed. There are three significant changes that are worth mentioning: New structure. The dashboard has a new, clear structure emphasizing multiple modules of the Wallarm Platform — WAF, Scanner, FAST. T...

Semrush: Content Injection on api.semrush.com to Reflected XSS

The researcher found XSS vulnerability and wrote an awesome summary! : While testing api.semrush.com I've found that some inputs triggered MongoDB error on /reports/v1/projects/:id/siteaudit/page/list endpoint. Contents of url parameter was reflected in error message. Unfortunately WAF blocked my...

How to Maximize Your WAF

Whenever new WAF clients are brought aboard, there’s a procedure they must follow in order to properly configure their servers to work behind the WAF protection. You can find an example of the Imperva Cloud WAF onboarding procedure here. Sometimes, however, customers can miss important procedures...

Zomato: HTML injection leads to reflected XSS

The following payload was used to bypass the WAF: html "...

Zomato: HTML Injection @ /[restaurant]/order endpoint.

The following payloads were used to bypass the WAF and perform XSS: Basic payload but did not work on all browsers: html " Payload worked on all browsers, but needed a right-click to be executed: html "XSS...

QIWI: [qiwi.me] Stored XSS

Stored XSS with WAF bypass in "wishlist" functionality Хранимая ХСС в функционале вишлистов с обходом встроенного WAF. https://twitter.com/ptswarm...

October Release: Q&A with Ari Weil

Shortly after Akamai announced the October 2019 Release with new features and capabilities across its security, performance and media product lines, Akamai's VP of Product Marketing, Ari Weil, took over Akamai's Twitter account for a live October Release Q&A. For those that missed the live event,...