jetty: Symlink directory exposes webapp directory contents

If the $jetty.base directory or the $jetty.base/webapps directory is a symlink the contents of the $jetty.base/webapps directory may be deployed as a static web application, exposing the content of the directory for download. The highest threat from this vulnerability is to data confidentiality...

Sql injection

In Progress MOVEit Transfer before 2021.0 13.0, a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used MySQL, Microsoft SQL Server...

CVE-2021-31827

CVE-2021-31827 affects MOVEit Transfer (DMZ) up to version 2020.1 (12.1.1.116). The vulnerability is a SQL Injection in MOVEit.DMZ.WebApp’s SILHuman.vb (FolderApplySettingsRecurs path) that requires authentication and can allow an attacker to access the MOVEit Transfer database, infer schema/cont...

[SECURITY] [DSA 4917-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4917-1 [email protected] https://www.debian.org/security/ Michael Gilbert May 17, 2021 https://www.debian.org/security/faq -...

Debian DSA-4917-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2021-30506 @retsew0x01 discovered an error in the Web App installation interface. - CVE-2021-30507 Alison Huffman discovered an error in the Offline mode. - CVE-2021-30508 Leecraso and Guang Gong discovered a buffer...

openSUSE: Security Advisory for chromium (openSUSE-SU-2021:0742-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2021:0742-1 Rating: important References: 1185496 1185716 1185908 Cross-References: CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513...

Chromium: CVE-2021-30506 Incorrect security UI in Web App Installs

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

KLA12176 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A use after free vulnerability in...

Unspecified Vulnerability in Google Chromium (CNVD-2021-34718)

Google Chromium is an open source web browser from Google USA. A security vulnerability previously existed in Chromium version 90.0.4430.212. The vulnerability stems from an incorrect security UI security issue found in the Web App Installs component of the program. No details of the vulnerabilit...

Google Chrome 注入漏洞

Google Chromium is an open source web browser from Google USA. A security vulnerability previously existed in Chromium version 90.0.4430.212. The vulnerability stems from an incorrect security UI security issue found in the Web App Installs component of the program. No details of the vulnerabilit...

Design/Logic Flaw

Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and...

What’s New in InsightAppSec and tCell: Q1 2021 in Review

2021 is off and running! The big question on the corporate world’s mind is, of course, “What will work life look like at the end of 2021?” With vaccines rolling out around the world, another shift is set to take place around when and where people put in their hours. As offices slowly start to...

The vulnerability of PWA components in Google Chrome allows attackers to compromise data integrity.

The vulnerability of PWA components in Google Chrome browsers is related to improper security checks for standard elements. Exploiting this vulnerability can allow an attacker to compromise data integrity...

Exploit for Server-Side Request Forgery in Microsoft

CVE-2021-26855-Scanner Scanner and PoC for CVE-2021-26855 Cr...

March 2, 2021, update for Project 2016 (KB4493191)

None None...

The vulnerability of the Django web application software lies in improper default access control settings, which allow attackers to disclose protected information.

The vulnerability of the Django web application framework is related to incorrect default access rights settings. Exploiting this vulnerability allows a malicious actor to disclose protected information remotely...

Securing Your Web App, One Robot at a Time

Modern web apps are two things: complex, and under persistent attack. Any publicly accessible web application can receive up to tens of thousands of attacks a month. While that sounds like a reason to immediately pull the plug and find a safe space to hide, these are likely spread across the...

jetty: local temporary directory hijacking vulnerability

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub...

Web Application Attacks on Healthcare Spike 51% As COVID-19 Vaccines are Introduced

As the first vials of COVID-19 vaccines were disseminated in December, Imperva Research Labs monitored an astounding 51% increase in web application attacks on healthcare targets. The activity concludes an unprecedented year of cybersecurity activity. Imperva data shows the healthcare industry...