2931 matches found
Deserialization Attacks Surge Motivated by Illegal Crypto-mining
Imperva’s research group is constantly monitoring new web application vulnerabilities. In doing so, we’ve noticed at least four major insecure deserialization vulnerabilities that were published in the past year. Our analysis shows that, in the past three months, the number of deserialization...
[SECURITY] Fedora 27 Update: python-bottle-0.12.13-1.fc27
Bottle is a fast and simple micro-framework for small web-applications. It offers request dispatching Routes with URL parameter support, Template s, a built-in HTTP Server and adapters for many third party WSGI/HTTP-server a nd template engines. All in a single file and with no dependencies other...
[SECURITY] Fedora 26 Update: python-bottle-0.12.13-1.fc26
Bottle is a fast and simple micro-framework for small web-applications. It offers request dispatching Routes with URL parameter support, Template s, a built-in HTTP Server and adapters for many third party WSGI/HTTP-server a nd template engines. All in a single file and with no dependencies other...
Security Update for ASP.NET Core January 2018
The remote Windows host has an installation of ASP.NET Core and .NET Core SDK with a version less than 2.1.4. Therefore, the host is affected by multiple vulnerabilities: - An elevation of privilege vulnerability due to improper sanitization of web requests CVE-2018-0784 - A cross-site request...
PHP Melody 2.7.1 - playlist SQL Injection Vulnerability
Exploit for php platform in category web applications...
Advanced World Database 2.0.5 - SQL Injection
Exploit Title: Advanced World Database 2.0.5 - SQL Injection Dork: N/A Date: 10.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/advanced-world-database/ Version: 2.0.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit...
Top 3 Tech Challenges RASP/(ng)WAF Vendors Are Faced With
Here I’d like to share my experience and pain in building L7 data protection solutions which are frequently called WAF/ngWAFs or RASPs. I started to build it back in 2009 from a simple detection logic based on self-adopted heuristics for a CTF competition and then build an entire company on machi...
[SECURITY] Fedora 26 Update: memcached-1.4.39-1.fc26
memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load...
Infogram: A10 – Unvalidated Redirects and Forwards
https://infogram.com/login Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation. when i intercept the twitter request and change it to the google then it will redirect you to the...
CVE-2017-10323
Vulnerability in the Oracle Web Applications Desktop Integrator component of Oracle E-Business Suite subcomponent: Application Service. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated...
Code injection
Vulnerability in the Oracle Web Applications Desktop Integrator component of Oracle E-Business Suite subcomponent: Application Service. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated...
CVE-2017-10323
CVE-2017-10323 affects Oracle Web Applications Desktop Integrator (WADI) in Oracle E-Business Suite. Affected: 12.x E-Business Suite versions 12.1.1–12.2.6. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise WADI, with exploitation requiring some user ...
Oracle Web Applications Desktop Integrator Unauthorized Operation Vulnerability
Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. Oracle Web Applications Desktop Integrator is one of the Web application products desktop integrator component. A security vulnerability exists in the...
CVE-2017-5531
Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative contro...
Remote code execution
Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly...
CVE-2017-11826
Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly...
CVE-2017-11826
Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly...
[SECURITY] Fedora 27 Update: gd-2.2.5-1.fc27
The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...
Equifax Suffered Data Breach After It Failed to Patch Old Apache Struts Flaw
The massive Equifax data breach that exposed highly sensitive data of as many as 143 million people was caused by exploiting a flaw in Apache Struts framework, which Apache patched over two months earlier of the security incident, Equifax has confirmed. Credit rating agency Equifax is yet another...