Route-Detect - Find Authentication (Authn) And Authorization (Authz) Security Bugs In Web Application Routes

Find authentication authn and authorization authz security bugs in web application routes: Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severity of the issue: 2021 OWASP Top 10 1 - Broken...

CVE-2024-23655

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusab...

Code injection

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusab...

CVE-2024-23655 Attacker can prevent users from accessing received emails

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusab...

CVE-2024-23655

CVE-2024-23655 affects Tuta (encrypted email service). A manipulation in emails sent to versions 3.118.12 through 3.119.9 can render the app unusable, preventing access to received emails on both the app and web interfaces. The issue has been fixed in version 3.119.10. In practice, an attacker co...

CVE-2024-23655 Attacker can prevent users from accessing received emails

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusab...

CVE-2024-23655 Attacker can prevent users from accessing received emails

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusab...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

Upgrade to New UI of Qualys Web Application Scanning (WAS): Bringing You Enhanced Web Application Security

In the dynamic world of cybersecurity, staying ahead means constantly evolving. At Qualys, we understand that the bedrock of outstanding security is continuous improvement and innovation. Thats why were thrilled to announce the latest launch of the new User Interface UI for Qualys Web Application...

Qualys WAS Unveils New Features in an Upgraded User Interface

Qualys Web Application Scanning WAS has been at the forefront of web application and API security innovation, and today, were excited to announce a significant leap - the launch of our New User Interface UI. From improved performance and reliability to cutting-edge technology adoption and enhance...

Html Injection

tuitse-tsusin is vulnerable to Html Injection. The vulnerability is due to the tuitsehtml function within html.py lacking proper escape or sanitization functionality for user-supplied data when incorporated into HTML output. This could allow attacker to inject malicious HTML or JavaScript code in...

CVE-2024-23345

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that suppo...

PYSEC-2024-16

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that suppo...

Fortra GoAnywhere Managed File Transfer (MFT) < 7.4.1 Authentication Bypass (CVE-2024-0204)

According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer MFT running on the remote web server is 7.4.1. It is, therefore, affected by an authentication bypass vulnerability. This can allow an unauthenticated attacker to create an admin user via the...

CVE-2024-23345 Nautobot has XSS potential in rendered Markdown fields

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that suppo...

ILIAS < 8.8 Broken Access Control Vulnerability

ILIAS is prone to a broken access control vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ilias:ilias"; if...

CVE-2023-51948

A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application...

Directory traversal

A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application...

Qnap VioStor < 5.0.0 Command Injection (CVE-2023-47565)

The version of Qnap VioStor installed on the remote host is prior to 5.0.0. It is, therefore, affected by an OS command injection vulnerability. If exploited, the vulnerability could allow authenticated users to execute commands. Note that Nessus has not tested for these issues but has instead...

CVE-2023-51948

CVE-2023-51948 affects actidata actiNAS SL 2U-8 RDX 3.2.03-SP1, with a site-wide directory listing issue in the /fm endpoint that allows remote attackers to enumerate files hosted by the web application. The vulnerability, documented across NVD/Red Hat/CVE records, has a base CVSS v3.1 score of 7...