CVE-2017-18014

An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...

Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access(CVE-2017-18014)

Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center...

Cross-Site Scripting Vulnerability in CloudLock WAF

CloudLock is a free server security management software based on OS kernel hardening technology. A cross-site scripting vulnerability exists in CloudLock WAF. The vulnerability is due to CloudLock failing to adequately filter cross-site scripting. An attacker can exploit this vulnerability to...

Qualys Cloud Platform 2.31 New Features

This release of the Qualys Cloud Platform version 2.31 includes updates and new features for AssetView, Cloud Agent, EC2 Connector, Web Application Scanning, Web Application Firewall, and Security Assessment Questionnaire, highlights as follows. AssetView Use custom severities in AV searches and...

CVE-2017-15524

The Application Firewall Pack AFP, aka Web Application Firewall component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request...

Security feature bypass

The Application Firewall Pack AFP, aka Web Application Firewall component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request...

CVE-2017-15524

The CVE-2017-15524 entry concerns Kemp Load Balancer’s Application Firewall Pack (AFP/WAF). A security feature bypass exists where HTTP POST data is not inspected, enabling bypass of the Web Application Firewall. Affected versions are Kemp AFP prior to 7.2.40.1; remediation is upgrading to 7.2.40...

Kemp Load Balancers Security Bypass Vulnerability

Kemp Load Balancer is a load balancing appliance from Kemp Technlogies, Inc.Application Firewall Pack AFP, a.k.a. Web Application Firewall is a Web application firewall component used in... A security bypass vulnerability exists in the AFP component of Kemp Load Balancer versions prior to 7.2.40....

Kemp Load Balancer WAF 7.2.40 Bypass Vulnerability

Exploit for hardware platform in category web applications 1. ADVISORY SUMMARY Kemp Load Balancers - Module Application Firewall Pack AFP - Web Application Firewall WAF does not inspect HTTP POST data Risk: high Application: Kemp Load Balancers - Module Application Firewall Pack AFP Versions...

Randy Bias joins Wallarm board of advisers

Menlo Park, California — December 5, 2017 — Wallarm today announced that Randy Bias, Vice President of Technology and Strategy, Cloud Software at Juniper and founder of Cloudscaling acquired by EMC, has joined Wallarm’s board of advisers. “Randy is an agile cloud pioneer and a thought leader in...

Fortinet FortiWebManager Security Feature Bypass Vulnerability

Fortinet FortiWebManager is a web application firewall. A security feature bypass vulnerability exists in Fortinet FortiWebManager, which can be exploited by an attacker to bypass certain security restrictions and perform unauthorized operations...

Pentest-Tools-Auto-Installer - A Simple Tool For Installing Pentest Tools And Forensic Tools On Debian / Ubuntu Based OS

A Simple tool for installing pentest tools and forensic tools on Debian / Ubuntu Based OS Tested on Linux Mint And Kali Linux I Want To Get This How To Do ?? Change Your Privileges Terminal to Root Mode your@terminal:$ sudo su And Then Clone This your@terminal: git clone...

Protecting Xero’s Cloud-Based Accounting Platform from Cyber Attacks

Meeting with customers is always insightful, and recently I got a chance to sit down with Aaron McKeown, head of security engineering and architecture at Xero, to talk about how they use Imperva SecureSphere for their cloud-hosted applications. Founded in 2006, Xero provides cloud accounting...

DenyAll Web Application Firewall Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "DenyAll Web Application Firewall Remote Code Execution", 'Description' = %q This module exploits the command injection vulnerability of DenyAll We...

DenyAll WAF < 6.3.0 - Remote Code Execution Exploit

Exploit for linux platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "DenyAll Web Application Firewall Remote Code Execution", 'Description' = %q This module...

CVE-2017-14705

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. An iToken authentication parameter is required but can be obtained by...

CVE-2017-14706

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web...

Design/Logic Flaw

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. An iToken authentication parameter is required but can be obtained by...

Authentication flaw

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web...

How to Deploy SecureSphere WAF on Azure

If you host apps in the cloud, then you need security in the cloud. The Imperva SecureSphere Web Application Firewall WAF identifies and acts upon dangers maliciously woven into innocent-looking website traffic, both on-premises and in the cloud, such as: Blocking technical attacks such as SQL...