CVE-2023-6149 Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security

Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize t...

CVE-2023-6149 Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security

Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize t...

CVE-2023-45724 Unauthenticated File Upload affects DRYiCE MyXalytics

HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication...

The vulnerability of the ProfileGrid plugin of the WordPress content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the ProfileGrid plugin in the WordPress content management system is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

CVE-2023-6689

CVE-2023-6689 affects EFACEC BCU 500 (automation/control device). The CSRF vulnerability could force state-changing requests, potentially compromising the web application when the victim is an administrative account. Public sources (CISA ICS advisory ICSA-23-353-02) outline affected product/versi...

web.bioucm.es Cross Site Scripting vulnerability OBB-3816039

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Bug or Feature? Hidden Web Application Vulnerabilities Uncovered

Web Application Security consists of a myriad of security controls that ensure that a web application: 1. Functions as expected. 2. Cannot be exploited to operate out of bounds. 3. Cannot initiate operations that it is not supposed to do. Web Applications have become ubiquitous after the expansio...

CVE-2023-48540

Adobe Experience Manager (AEM) 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability (CVE-2023-48540) in vulnerable form fields, enabling a low-privileged attacker to inject JavaScript that runs in a victim’s browser when visiting the page containing the field. Impa...

CVE-2023-48771

CVE-2023-48771 affects the WordPress File Gallery plugin (versions

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a throu...

Are HTTP Content-Security-Policy (CSP) Headers Sufficient to Secure Your Client Side?

Modern web frameworks have shifted business logic from the server side to the client side web browser, enhancing performance, flexibility, and user experience. However, this move introduces security and privacy concerns, as exposing sensitive logic and data can lead to vulnerabilities like code...

Unauthorized Access Vulnerability in Website Monitoring and Warning Platform of Yuanjiang Shengbang (Beijing) Network Security Technology Co.

Ltd. is an independent innovative enterprise dedicated to WEB application security solutions and application delivery. There is an unauthorized access vulnerability in the website monitoring and warning platform of Yuanjiang Shengbang Beijing Network Security Technology Co., Ltd. which can be...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

By Owais Sultan Reflectiz, a cloud-based platform that helps organizations manage and mitigate web application security risks This is a post from HackRead.com Read the original post: Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System...

Apache Cocoon SQL Injection Vulnerability

Apache Cocoon is the United States Apache Apache Foundation of a component-based Web development concepts built Web application framework. Apache Cocoon suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacke...

Quiz Maker < 6.4.9.5 - Reflected Cross-Site Scripting

Description The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting PoC Visit the following URL: https://example.com/wp-admin/admin.php?page=quiz-maker-questions%22%3E%3Cscript%3Ealert/xss/%3C/script%3E=something...

webtrends.net.br Cross Site Scripting vulnerability OBB-3797761

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mars: Blind SQL Injection on █████ via URI Path

The vulnerability involved a time-based SQL injection attack on the target system via the URI path. The attack capitalized on vulnerabilities in the application's interactions with the database, allowing the attacker to extract information by purposefully delaying database processing and observin...

PT-2023-30612 · Leadster · Leadster

Name of the Vulnerable Software and Affected Versions: Leadster plugin versions prior to 1.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web applicatio...

The Importance of Continuous Security Monitoring for a Robust Cybersecurity Strategy

In 2023, the global average cost of a data breach reached $4.45 million. Beyond the immediate financial loss, there are long-term consequences like diminished customer trust, weakened brand value, and derailed business operations. In a world where the frequency and cost of data breaches are...

doc-x.de Improper Access Control vulnerability OBB-3768209

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...