CVE-2021-42123

The CVE-2021-42123 entry concerns Business-DNA Solutions GmbH TopEase Platform (Web Applications) with Version

CVE-2021-42122

CVE-2021-42122 affects Business‑DNA Solutions GmbH TopEase Platform (≤7.1.27). The root cause is insufficient input validation on an object’s attributes with numeric format. An authenticated remote attacker with Object Modification privileges can insert an unexpected format, causing the affected ...

CVE-2021-42122 Denial of Service via Invalid Object Attribute in TopEase

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the...

CVE-2021-42121 Denial of Service via Invalid Date Format in TopEase

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 on an object’s date attributes allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads t...

CVE-2021-42120 Missing Character Length (Denial of Service) in TopEase

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long strings, eventually leading to exhaustion...

CVE-2021-42121

CVE-2021-42121 describes an insufficient input validation vulnerability in Business-DNA Solutions GmbH TopEase Platform (

CVE-2021-42120

CVE-2021-42120 affects Business-DNA Solutions GmbH TopEase Platform (Version

CVE-2021-42119

CVE-2021-42119 describes a persistent cross-site scripting vulnerability in Business-DNA Solutions GmbH TopEase platform (version ≤ 7.1.27) exposed through the Search Functionality. The issue arises when authenticated users with Object Modification privileges can inject arbitrary HTML/JavaScript ...

CVE-2021-42119 Stored XSS in Search Function in TopEase

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then...

CVE-2021-42118

The CVE-2021-42118 entry concerns Business-DNA Solutions GmbH TopEase Platform (<= 7.1.27) via the Structure Component. Affected component is the Structure Component which allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML/JavaScript in an obje...

CVE-2021-42118 Stored XSS in TopEase

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object...

CVE-2021-42117

CVE-2021-42117 affects Business-DNA Solutions GmbH TopEase Platform (Web Applications)

CVE-2021-42116 Unauthorized Menu Item Access in TopEase

Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via identifying said components in the...

CVE-2021-42115 Missing HTTPOnly flag on sensitive cookie in TopEase

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie...

CVE-2021-42115

The CVE-2021-42115 entry concerns Business-DNA Solutions GmbH TopEase Platform: versions ≤ 7.1.27 are affected by a Missing HTTPOnly flag on the session cookie UID, enabling an unauthenticated attacker to escalate to an authenticated user by stealing/injecting the cookie. The connected sources re...

vulhub

This repository is an open-source collection of vulnerable web applications and tools for security training and research. It is maintained by phith0n and hosted on GitHub. The repository contains a variety of vulnerable applications, including web servers, databases, and other systems, to help...

CVE-2021-41270

CVE-2021-41270 (Symfony CSV Injection) affects Symfony/Serializer in Symfony PHP framework. The issue arises in the CsvEncoder where cells beginning with =, +, -, or @ could be treated as formulas. Initially, a tab prefix was used to escape these, but OWASP expanded the vulnerable set to include ...

OWASP Top 10 Deep Dive: Defending Against Server-Side Request Forgery

Web applications are no longer just assets to a company — they’re an organization’s identity, playing a major role in how customers, clients, and users see a brand. Due to this importance, web apps have also become a primary target for attack. Over the years, these applications have grown more...

A Complete Guide to Cloud-Native Application Security

Explore this comprehensive guide to application security, which provides an overview of the importance of embedding runtime application security controls in the application build workflow to protect cloud-native web applications and APIs...

UPchieve: Authentication Bypass - Email Verification code bypass in account registration process.

Hi Team, I was able to bypass Email Verification code in account registration process. Summary : Authentication Bypass is a dangerous vulnerability, which is found in Web-Applications. An Attackers can bypass the control mechanisms which are used by the underlying web application like Email...