GHSA-XVHG-W6QC-M3QQ Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading

Impact The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential...

modsecurity: lacking the complete content in FILES_TMP_CONTENT leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when FILESTMPCONTENT lacks complete content, which can lead to a Web Application Firewall bypass...

mod_security: incorrect parsing of HTTP multipart requests leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when HTTP multipart requests are incorrectly parsed and could bypass the Web Application Firewall. NOTE: This is related to CVE-2022-39956, but can be considered independent changes to the ModSecurity C language codebase...

modsecurity: lacking the complete content in FILES_TMP_CONTENT leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when FILESTMPCONTENT lacks complete content, which can lead to a Web Application Firewall bypass...

mod_security: incorrect parsing of HTTP multipart requests leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when HTTP multipart requests are incorrectly parsed and could bypass the Web Application Firewall. NOTE: This is related to CVE-2022-39956, but can be considered independent changes to the ModSecurity C language codebase...

Moderate: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.57 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Insufficient Session Expiration

Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. This can allow an attacker to hijack the user's session and gain unauthorized access to the application. The web application m...

编号撤回

Damn Vulnerable Web Application DVWA is a very vulnerable PHP/MySQL web application by Robin Wood Personal Developer. Help security professionals test their skills and tools in a legal environment, help web developers better understand web application security processes, and help students and...

How to Build a Simple Application Powered by ChatGPT

OpenAI’s ChatGPT API enables applications to access and integrate ChatGPT, a large language model LLM that generates human-like responses to input. Learn how to build a web application that utilizes ChatGPT to generate useful output...

How to manually update Web Application Firewall Signatures

Provide steps to updateWeb Application Firewall Signatures...

PT-2023-27131 · Unknown · Damn Vulnerable Web Application

Name of the Vulnerable Software and Affected Versions: Damn Vulnerable Web Application DVWA version 1.0 Description: The issue is related to a SQL injection vulnerability via the id parameter at blindsourcehigh.php. This vulnerability was discovered in DVWA v1.0. There are approximately 731 peopl...

CSZCMS SQL Injection Vulnerability (CNVD-2023-64217)

CSZCMS is an open source web application that allows to manage all the content and settings on the website. A SQL injection vulnerability exists in CSZCMS version 1.2.9, which stems from a lack of validation of externally entered SQL statements in the pmsendmail parameter in cszmodel.php. An...

New password can be set as same as the old password

Description The web application allows us to set new password as the old one at Password change function. Detail: 1/ Access to the demo website and go to My profile. 2/ Choose Edit profile, at the Security tab, change the password with the new password and the old password are the same. 3/ Logout...

homepage-verwaltung.web.de Cross Site Scripting vulnerability OBB-3574717

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

School Faculty Scheduling System SQL注入漏洞

School Faculty Scheduling System is a school faculty scheduling system. A SQL injection vulnerability exists in School Faculty Scheduling System v1.0, which stems from a lack of validation of externally entered SQL statements in the parameter id of manageuser.php. An attacker can exploit this...

WordPress Appointment Hour Booking Plugin < 1.3.73 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dwbooster:appointmenthourbooking"; ifdescription...

CVE-2023-37069

Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection SQLI attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the login id and password fields during the login...

PT-2023-27338 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.174 Description: The issue allows for XSS in the app/View/Events/index.ctp file. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents wher...

Mattermost Server < 7.8.5 / 7.9.x < 7.9.4 / 7.10.x < 7.10.1 Missing Authorization (MMSA-2023-00151)

The version of Mattermost Server running on the remote host is prior to 7.8.5, 7.9.x prior to 7.9.4 or 7.10.x prior to 7.10.1. It is, therefore, affected by a missing authorization vulnerability. Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request...

tsukamoto-dojo.jp Cross Site Scripting vulnerability OBB-3573190

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...