Team Password Manager 跨站请求伪造漏洞

Team Password Manager is a web-based team password manager. Team Password Manager suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to...

Kimai 跨站请求伪造漏洞

Kimai is an open source, web-based multi-user time tracking application. kimai 2 1.16.2 previously contained a cross-site request forgery vulnerability, which stems from the product's failure to verify that requests originate from trusted users. An attacker could send an unintended request to the...

CVE-2021-40130 Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability

A vulnerability in the web application of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting. This vulnerability is due to improper restriction of the syslog configuration. An attacker could exploit...

CVE-2021-40130

CVE-2021-40130 affects Cisco Common Services Platform Collector (CSPC) via the web application. The vulnerability arises from improper restriction of the syslog configuration, allowing an authenticated, remote attacker to configure non-log files as sources for syslog reporting. This could let the...

K8tools

It is an offensive tool for web application exploitation. The repository, K8tools, contains a collection of tools for various purposes, including internal penetration, privilege escalation, remote overflow, vulnerability exploitation, scanning, password cracking, and evasion. The primary focus is...

Discourse < 2.7.10 Cache Poisoning Vulnerability

Discourse is prone to a cache poisoning vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse";...

Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability

A vulnerability in the web application of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting. This vulnerability is due to improper restriction of the syslog configuration. An attacker could exploit...

CVE-2021-40130

A vulnerability in the web application of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting. This vulnerability is due to improper restriction of the syslog configuration. An attacker could exploit...

site-ud.nl Cross Site Scripting vulnerability OBB-2275273

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Application Security 101

Everything DevOps teams need to know about web application security risks and best practices...

PT-2021-4851 · Cisco · Cisco Common Services Platform Collector

Name of the Vulnerable Software and Affected Versions: Cisco Common Services Platform Collector CSPC affected versions not specified Description: A vulnerability in the web application of Cisco Common Services Platform Collector could allow an authenticated, remote attacker to specify non-log fil...

Cisco Common Services Platform Collector 安全漏洞

Cisco Common Services Platform Collector CSPC is an SNMP-based tool that discovers and collects information from Cisco devices installed on the network. versions of Cisco Common Services Platform Collector prior to 2.9.1.1 of the Web application contains an improper logging restriction...

Protecting today’s web applications requires more than a firewall

The way organizations build web applications has changed dramatically over the last several years. As a result, many organizations are considering additional security strategies to augment the Web Application Firewall WAF on which they have relied to protect critical digital business operations...

Cross-site Scripting in django-helpdesk

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Fuel CMS 1.4.13 SQL Injection

Exploit Title: Fuel CMS 1.4.13 - 'col' Parameter Blind SQL Injection Authenticated Date: 2021-04-11 Exploit Author: Rahad Chowdhury Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.13.zip Version: 1.4.13 Tested on: Kali Linux, PHP...

Exploit for Path Traversal in Apache Http_Server

CVE...

Exploit for Argument Injection in Phpmailer_Project Phpmailer

This is a Python script that exploits a vulnerability in PHPMailer version 5.2.18. The script is designed to be run on a vulnerable environment, and it will spawn a vulnerable web application on the host on port 8080. The exploit will drop a shell where commands can be sent to the backdoor. The...

JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2021-91660)

JetBrains YouTrack, a browser-based bug tracking and project management software from JetBrains Czech Republic, is vulnerable to a cross-site scripting vulnerability in versions prior to JetBrains YouTrack 2021.3.24402. The vulnerability stems from the lack of proper validation of client-side dat...

tCell by Rapid7 Supports the Newly Released .NET 6.0

We’re excited to share that we've coordinated our recent .NET and .NET Core agent releases with the brand new .NET 6.0 release from Microsoft. What is tCell? Since the founding of tCell by Rapid7, our web application and API protection solution, we’ve prided ourselves on providing both breadth an...

WordPress Plugin Cross-Site Request Forgery Vulnerability (CNVD-2021-101155)

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress Plugin is a WordPress open source application plugin. WordPress WP SEO suffers from a cross-site...