15164 matches found
CVE-2020-15794
A vulnerability has been identified in Desigo Insight All versions. Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional information about the host system...
CVE-2020-6363
SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate...
How to Be Resilient to Data Theft
Page Integrity Manager is now PCI compliant -- a strong starting point to harden your web applications. Compliance with the Payment Card Industry Data Security Standard PCI DSS is fundamental for any business that accepts payment cards or processes payment card data. Many financial services...
API Discovery and Profiling -- Visibility to Protection
APIs have become a dominant mechanism in the modern web, allowing organizations to create powerful web and mobile experiences, while exposing back-end data and logic to create new and innovative offerings. Protecting internet-facing APIs -- an emerging practice over the past few years -- is the...
Akamai and Snyk Partnership Creates a Powerful Combination for In-Browser Script Protection
A web experience begins with the sum of the code you created. But it also includes all the code the user is put in contact with when loading your website. This means the attack surface to monitor for web application software threats is not just your code repositories, but the sum of the assets re...
Exploit for Buffer Underflow in Microsoft
简介 安全行业小工具以及学习资源收集项目，此项目部分内容来自：https://www.t00ls.net/thread-38964-1-1.html 感谢其分享，这里只是作为个人备份，如有问题可邮件通知。 安全资源 安全资源包括安全书籍，资料，安全教程，学习平台等等。 设备基线加固资料 https://github.com/re4lity/Benchmarks https://learn.cisecurity.org/benchmarks https://nvd.nist.gov/ncp/repository 内网渗透学习资料...
berliCRM 1.0.24 - 'src_record' SQL Injection
Exploit Title: berliCRM 1.0.24 - 'srcrecord' SQL Injection Google Dork: N/A Date: 2020-10-11 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.berlicrm.de Software Link: https://github.com/berliCRM/berlicrm/archive/1.0.24.zip Version: 1.0.24 Tested on: Kali Linux CVE : N/A ==========...
Cross site request forgery (csrf)
A cross-site request forgery CSRF vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted actions on the web application while they are currently authenticated. This applies to a single server class only, with no...
MedDream PACS Server 6.8.3.751 - Remote Code Execution (Unauthenticated)
!/usr/bin/python Exploit Title: MedDream PACS Server 6.8.3.751 - Remote Code Execution Unauthenticated Exploit Author: bzyo Twitter: @bzyo Date: 10-10-2020 Vulnerable Software: https://www.softneta.com/products/meddream-pacs-server/ Vendor Homepage: https://www.softneta.com Version: 6.8.3.751...
Online Students Management System 1.0 - 'username' SQL Injections
Title: Online Students Management System 1.0 - 'username' SQL Injections Exploit Author: George Tsimpidas Date: 2020-10-09 Vendor Homepage: www.sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/studentrecord0.zip Version : 1.0 Tested on: Ubuntu...
openMAINT 1.1-2.4.2 Arbitrary File Upload
Exploit Title: openMAINT 1.1-2.4.2 - Arbitrary File Upload Dork: N/A Date: 2020-08-19 Exploit Author: mrb3n Vendor Homepage: https://www.openmaint.org/en Software Link: https://sourceforge.net/projects/openmaint/files/1.1/openmaint-1.1-2.4.2.zip/download Version: 1.1-2.4.2 Category: Webapps Teste...
ZEIT Next.js Input Validation Error Vulnerability
ZEIT Next.js is a ZEIT company based on Vue.js, Node.js, Webpack and Babel.js open source Web application framework. An input validation error vulnerability exists in ZEIT Next.js. The vulnerability stems from a web system or product that does not properly validate input data. No detailed...
Online Student's Management System SQL Injection
Title: Online Student's Management System - Unauthenticated Multiple SQL Injections Exploit Author: George Tsimpidas Date: 2020-10-09 Vendor Homepage: www.sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/studentrecord0.zip Tested on: Ubuntu...
Security Bulletin: IBM Security Guardium Insights is affected by a Netty vulnerability
Summary IBM Security Guardium Insights has addressed the following vulnerability Vulnerability Details CVEID: CVE-2020-7238 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw when handling Transfer-Encoding whitespace and a later Content-Length header. By sending a...
Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability (CNVD-2020-57577)
Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco. A cross-site scripting vulnerability exists in Cisco SD-WAN vManage Software. The vulnerability stems from a lack of proper validation of client data by the WEB application. ...
CVE-2020-4773
A cross-site request forgery CSRF vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted actions on the web application while they are currently authenticated. This applies to a single server class only, with no...
vBulletin <= 5.6.3 Multiple XSS Vulnerabilities
vBulletin is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Liman 0.7 Cross Site Request Forgery
Exploit Title: Liman v0.7 - Cross-Site Request Forgery CSRF Date: 27-03-2018 Exploit Author: George Tsimpidas Software Link : https://github.com/salihciftci/liman/releases/tag/v0.7 Version: 0.7 Tested on: 18.04.5 LTS Bionic Beaver Category: Webapp 1. Description:- There is no CSRF protection in...
SQLInjectionWiki
This is a comprehensive wiki on SQL injection, a type of web application security vulnerability. The wiki is maintained by NetSPI and is available in both English and Chinese versions. The wiki covers various aspects of SQL injection, including detection, exploitation, and mitigation. The wiki...
