Abusing JSON-Based SQL

Overview Modern databases, such as PostgreSQL, natively support JSON as data values that can be queried. This capability uses JSON-specific operators, including an operator to test for key presence. Imperva Threat Research has investigated these database native JSON operators and discovered...

Top 5 API Security Myths That Are Crushing Your Business

There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business. Why so? Because these myths are widening your security gaps. This is making it easier for attackers to abuse APIs. And API attacks are costly. Of course, you will have to bea...

Expedia Group Bug Bounty: Cache Poisoning Allows Stored XSS Via hav Cookie Parameter (To Account Takeover)

A cache poisoning vulnerability allowed for stored cross-site scripting XSS attacks via the "hav" cookie parameter on abritel.fr, leading to account takeover. The server had a protection mechanism that hid double quotes, but not greater than and less than symbols, which allowed the attacker to...

CVE-2022-38381

An improper handling of malformed request vulnerability CWE-228 exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall WAF protection suc...

CVE-2022-38381

The CVE-2022-38381 entry covers FortiADC, affecting 5.0, 6.0.0, 6.1.0, 6.2.0–6.2.3, and 7.0.0–7.0.2. It describes an improper handling of malformed requests (CWE-228) that may allow a remote, unauthenticated attacker to bypass Web Application Firewall protections (e.g., SQL Injection and XSS filt...

CVE-2022-38381

An improper handling of malformed request vulnerability CWE-228 exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall WAF protection suc...

PT-2022-24398 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: FortiADC versions 5.0 through 7.0.2 Description: An improper handling of malformed request vulnerability exists in FortiADC, allowing a remote attacker without privileges to bypass some Web Application Firewall WAF protection, such as the SQL...

FortiADC - WAF XSS Injection Bypass

An improper handling of malformed request vulnerability CWE-228 in FortiADC may allow a remote attacker without privileges to bypass some Web Application Firewall WAF protection such as the SQL Injection and XSS filters via a malformed HTTP request...

Evolution of API Security – A Practical Guide to Addressing API Threats in 2023

The kind of API security scenarios we witnessed today were never like this from the beginning of time. It has gone to extra lengths to become responsive and productive as it’s now. How was it in the beginning? What changes has it faced? What more can we expect in the future? If this is what bothe...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 - OGNL injection vulnerability. Script proof...

Vulnerabilities fixed in several F5 products

F5 has fixed several vulnerabilities in BIG-IP and NGINX. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution...

CVE-2022-41691

When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

Code injection

When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

Remote code execution

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface...

CVE-2022-41836 BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836

When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

CVE-2022-41836 BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836

When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

CVE-2022-41691 BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691

When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

CVE-2022-41691 BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691

When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

CVE-2022-41691

CVE-2022-41691 – Summary (F5 BIG-IP Advanced WAF/ASM) A vulnerability in BIG-IP Advanced WAF/ASM is triggered when a security policy is applied on a virtual server; undisclosed requests can cause the bd process to terminate, resulting in DoS on the BIG-IP system. The vulnerability is documented b...

CVE-2022-41617 BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface...