Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to...

Qualys Cloud Platform 2.30 New Features

This release of the Qualys Cloud Platform version 2.30 includes updates and new features for Cloud Agent, EC2 Connector, Web Application Scanning, Web Application Firewall, and Security Assessment Questionnaire, highlights as follows. This posting has been updated on 9/6/2017 and 10/25/2017 to...

shopgoodwill.com XSS vulnerability

Vulnerable URL: https://www.shopgoodwill.com/search/SearchKey.asp?itemtitle="...

XSS Radar: Discover Cross Site Scripting with A Chrome Extension

PenTestIT RSS Feed If you remember, there used to an add-on for Firefox - XSS Me; which unfortunately no longer works out of the box for the latest versions of the browser. It was also a part of the Firefox Addons for helping you with web application penetration testing. We now have something...

vbcode.com XSS vulnerability

Open Bug Bounty ID: OBB-280874 Description| Value ---|--- Affected Website:| vbcode.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

phpMyAdmin Bypass Restriction Vulnerability (PMASA-2014-7) - Windows

phpMyAdmin is prone to a bypass restriction vulnerability via remote authentication. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Affiliate Niche Script 3.4.0 - SQL Injection

Exploit Title: Affiliate Niche Script 3.4.0 SQL Injection Dork: N/A Date: 21.08.2017 Vendor Homepage: https://scriptoffice.com/ Software Link: https://soft.scriptoffice.com/projects/affiliatenichescript/wiki/MainMenu Demo: http://demodesigns.affiliatenichescript.com/ Version: 3.4.0 Category:...

Cacti XSS Vulnerability - Windows

Cross-site scripting XSS vulnerabilities in spikekill.php and lib/html.php in Cacti allow remote attackers to inject arbitrary web scripts or HTML. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

beadplace.net XSS vulnerability

Open Bug Bounty ID: OBB-280709 Description| Value ---|--- Affected Website:| beadplace.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

goozen.info Open Redirect vulnerability

Open Bug Bounty ID: OBB-280643 Description| Value ---|--- Affected Website:| goozen.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Photogallery Project 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Photogallery Project 1.0 - Multiple Vulnerabilities Dork: N/A Date: 17.08.2017 Vendor Homepage : http://surajkumar.in/ Software Link: http://surajkumar.in/product/photogallery-project-in-php/ Demo: http://surajkumar.in/ Version:...

DeWorkshop 1.0 - Arbitrary File Upload

DeWorkshop 1.0 - Arbitrary File Upload Exploit Title: DeWorkshop 1.0 - Arbitrary File Upload Dork: N/A Date: 18.08.2017 Vendor Homepage : https://sarutech.com/ Software Link: https://codecanyon.net/item/deworkshop-auto-workshop-portal/20336737 Demo: https://demo.sarutech.com/deworkshop/ Version:...

The vulnerability of the AddDriverFileServlet servlet in the web application, which is designed for managing and monitoring printing devices and image processing, allows a perpetrator to delete any file.

The vulnerability of the AddDriverFileServlet servlet in a web application, which is designed for managing and monitoring printing devices and image processing, exists due to an incorrect path limitation for the restricted directory. Exploiting this vulnerability could allow a malicious actor to...

LiveSupport 1.0 - SQL Injection

Exploit Title: LiveSupport 1.0 - SQL Injection Dork: N/A Date: 18.08.2017 Vendor Homepage : http://livecrm.co/ Software Link: https://codecanyon.net/item/livesupport-complete-ticketing-system-crm/20243447 Demo: http://livesupport.livecrm.co/livecrm/web/ Version: 1.0 Category: Webapps Tested on:...

Food Ordering Script 1.0 - SQL Injection

Food Ordering Script 1.0 - SQL Injection Exploit Title: Food Ordering Script 1.0 - SQL Injection Dork: N/A Date: 17.08.2017 Vendor Homepage : http://www.earthtechnology.co.in/ourproducts.html Software Link: https://www.foodorderingscript.com/ Demo: https://www.foodorderingscript.com/demo-new/...

Photogallery Project 1.0 - SQL Injection

Exploit Title: Photogallery Project 1.0 - Multiple Vulnerabilities Dork: N/A Date: 17.08.2017 Vendor Homepage : http://surajkumar.in/ Software Link: http://surajkumar.in/product/photogallery-project-in-php/ Demo: http://surajkumar.in/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

Threat Intelligence for WAF

It’s all about security rules Stephen Hawking said, “Intelligence is the ability to adapt to change”. One could say much the same of web application firewalls and WAF security rules. With web applications now one of the most attacked components of IT infrastructures, organizations have a critical...

Microsoft Resnet - DNS Configuration Web Vulnerability

Document Title: =============== Microsoft Resnet - DNS Configuration Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2087 Acknowledgements: https://technet.microsoft.com/en-us/security/cc308589.aspx Release Date: ============= 2017-08-...

Akamai Is Named A Leader In Gartner's Magic Quadrant For Web Application Firewalls

"Don't work for recognition, but do work worthy of recognition" - H. Jackson Brown. A friend sent this quote to me after I explained to her my ambivalence about being recognized by Gartner as a "Leader" in their Web Application Firewall Magic Quadrant. I had mixed feelings because I wanted to...

CVE-2017-12853

The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated...