Online Trackers Increasingly Switching to Invasive CNAME Cloaking Technique

With browser makers steadily clamping down on third-party tracking, advertising technology companies are increasingly embracing a DNS technique to evade such defenses, thereby posing a threat to web security and privacy. Called CNAME Cloaking, the practice of blurring the distinction between...

Online Trackers Increasingly Switching to Invasive CNAME Cloaking Technique

With browser makers steadily clamping down on third-party tracking, advertising technology companies are increasingly embracing a DNS technique to evade such defenses, thereby posing a threat to web security and privacy. Called CNAME Cloaking, the practice of blurring the distinction between...

SQL injection vulnerability in pr***.asp page of website building system of Ningbo Hi-Tech Zone Aokai Network Technology Co.

Ningbo Hi-Tech Zone Aokai Network Technology Co., Ltd, provides appropriate business and Internet brand promotion services. Ningbo High-tech Zone Aokai Network Technology Co., Ltd. building system pr.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive...

CVE-2021-20066

JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled...

nodejs: HTTP request smuggling via two copies of a header field in an http request

A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity...

BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)

Exploit Title: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting XSS Date: 16-02-2021 Exploit Author: Kamaljeet Kumar - TATA Advanced Systems Limited Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Tested on...

The vulnerability in the web interface for controlling the Cisco AsyncOS operating system of Cisco Web Security Appliance allows a perpetrator to execute arbitrary code.

The vulnerability in the web interface for controlling the Cisco AsyncOS operating system of Cisco Web Security Appliance lies in insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SmartFoxServer 2X 2.17.0 God Mode Console WebSocket Cross Site Scripting

SmartFoxServer 2X 2.17.0 God Mode Console WebSocket XSS Vendor: gotoAndPlay Product web page: https://www.smartfoxserver.com Affected version: Server: 2.17.0 Remote Admin: 3.2.6 SmartFoxServer 2X, Pro, Basic Summary: SmartFoxServer SFS is a comprehensive SDK for rapidly developing multiplayer gam...

The vulnerability of the components of the Cisco Email Security Appliance, a system for email security management, and the Cisco Content Security Management Appliance, a system for content security management, as well as the Cisco Web Security Appliance, an internet gateway, allows attackers to gain unauthorized access to protected information.

The vulnerability of the components of the Cisco Email Security Appliance, the Cisco Content Security Management Appliance, and the Cisco Web Security Appliance involves a lack of authentication token requirements. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

SmartFoxServer 2X 2.17.0 - God Mode Console WebSocket XSS

Exploit Title: SmartFoxServer 2X 2.17.0 - God Mode Console WebSocket XSS Date: 29.01.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.smartfoxserver.com Vendor: gotoAndPlay Product web page: https://www.smartfoxserver.com Affected version: Server: 2.17.0 Remote Admin: 3.2.6...

WordPress Plugin Supsystic Pricing Table 1.8.7 - Multiple Vulnerabilities

Exploit Title: WordPress Plugin Supsystic Pricing Table 1.8.7 - Multiple Vulnerabilities Date: 24/07/2020 Exploit Author: Erik David Martin Vendor Homepage: https://supsystic.com/ Software Link: https://downloads.wordpress.org/plugin/pricing-table-by-supsystic.1.8.7.zip Version: 1.8.7 and 1.8.6...

Jenzabar 9.2.2 Cross Site Scripting

Exploit Title: Jenzabar 9.2.2 - 'query' Reflected XSS. Date: 2021–02–06 Exploit Author: y0ungdst Vendor Homepage: https://jenzabar.com Version: Jenzabar — v9.2.0-v9.2.1-v9.2.2 and maybe other versions Tested on: Windows 10 CVE : CVE-2021–26723 -Description: A Reflected Cross-site scripting XSS...

Post-Pandemic world, Shut-downs, and Web Security Connections

As the anniversary of the World Health Organization’s WHO declaration of the COVID-19 pandemic approaches, we, here in Silicon Valley, have great hope for 2021. As the vaccine distribution continues to trickle to Main Street, Californians have recently exited a stay-at-home mandate that has nearl...

Cisco Web Security Appliance Information Disclosure (cisco-sa-esa-wsa-sma-info-RHp44vAC)

According to its self-reported version, Cisco Web Security Appliance WSA is affected by a vulnerability in the authentication for the general purpose APIs due to the absence of a secure authentication token requirement when authenticating to the general purpose API. An unauthenticated, remote...

Revive Adserver 跨站脚本漏洞

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver versions prior to 5.1.0, which stems from a lac...

The vulnerability of Trend Micro InterScan Web Security Virtual Appliance lies in the lack of protection for operational data, which allows attackers to exploit this weakness to disclose protected information.

The vulnerability of Trend Micro InterScan Web Security Virtual Appliance is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

The vulnerability of Trend Micro InterScan Web Security Virtual Appliance, related to deficiencies in authentication procedures, allows attackers to bypass the authentication process.

The vulnerability of Trend Micro InterScan Web Security Virtual Appliance is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process remotely...

The vulnerability in the Trend Micro InterScan Web Security Virtual Appliance exists due to the failure to take measures to eliminate certain special elements used in the operating system. This allows attackers to execute arbitrary code.

The vulnerability of Trend Micro InterScan Web Security Virtual Appliance exists due to the lack of measures taken to neutralize special elements used in the operating system’s command chain. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2021-23901

An XML external entity XXE injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions 1.18. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. ...

Xxe

An XML external entity XXE injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions 1.18. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. ...