Path Traversal

Web applications occasionally use parameter values to store the location of a file which will later be required by the server. An example of this is often seen in error pages, where the actual file path for the error page is stored in a parameter value -- for example...

Form-based File Upload

The design of many web applications require that users be able to upload files that will either be stored or processed by the receiving web server. Scanner has flagged this not as a vulnerability, but as a prompt for the penetration tester to conduct further manual testing on the file upload...

Unvalidated Redirection

Web applications occasionally use parameter values to store the address of the page to which the client will be redirected -- for example: yoursite.com/page.asp?redirect=www.yoursite.com/404.asp An unvalidated redirect occurs when the client is able to modify the affected parameter value in the...

DOM-based Cross-Site Scripting (XSS)

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Unlike traditional Cross-Site Scripting XSS, where the client is able to inject...

Blind SQL Injection (differential analysis)

Due to the requirement for dynamic content of today's web applications, many rely on a database backend to store data that will be called upon and processed by the web application or other programs. Web applications retrieve data from the database by using Structured Query Language SQL queries. T...

Security Update for Microsoft Silverlight (KB4013867)

This security update to Silverlight includes fixes outlined in KB 4013867. This update is backward compatible with web applications built using previous versions of Silverlight...

LG Cross-Site Scripting Vulnerability

LG Looking Glass is a set of web applications written in Perl for connecting to a router or console. LG suffers from a cross-site scripting vulnerability. It allows an attacker to inject arbitrary web script or HTML via the "addr" parameter...

CIOReview names Wallarm in    “20 Most Promising Enterprise WebApp Solution Providers”

CIOReview names Wallarm in “20 Most Promising Enterprise WebApp Solution Providers” We are glad to be short-listed amongst Top-20 most promising solution providers for the web apps by CIOReview. This is a good illustration of how we are helping enterprises to secure their web apps. The award main...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

Easy Support Tools 1.0 - stt Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Easy Support Tools - FAQs, Help Articles, Blog and Feedback Script v1.0 - SQL Injection Google Dork: N/A Date: 07.02.2017 Vendor Homepage: http://nelliwinne.net/ Software Buy:...

[SECURITY] Fedora 24 Update: gd-2.2.4-1.fc24

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

[SECURITY] Fedora 25 Update: gd-2.2.4-1.fc25

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

MS15-080: Description of the security update for Silverlight 5: August 11, 2015

MS15-080: Description of the security update for Silverlight 5: August 11, 2015 Summary This security update resolves vulnerabilities in the Microsoft .NET Framework and Microsoft Silverlight. These vulnerabilities could allow remote code execution if a user opens a specially crafted document or...

Critical PHPMailer Flaw leaves Millions of Websites Vulnerable to Remote Exploit

A critical vulnerability has been discovered in PHPMailer, which is one of the most popular open source PHP libraries to send emails used by more than 9 Million users worldwide. Millions of PHP websites and popular open source web applications, including WordPress, Drupal, 1CRM, SugarCRM, Yii, an...

Security Compliance with Static Code Analysis

NOTE: This blog post is outdated. For an update list of supported compliance requirements please visit our website. PCI DSS The Data Security Standard from the Payment Card Industry, short PCI DSS, specifies 12 requirements for the safe use of credit card information. The specifications were...

[SECURITY] Fedora 24 Update: gd-2.2.3-5.fc24

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

[SECURITY] Fedora 25 Update: gd-2.2.3-5.fc25

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

ImageMagick Convert Tiff Adobe Deflate Code Execution Vulnerability

Summary An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks’s convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution.. The vulnerability can be...