Continuous Web Security Assessment for Production and DevOps Environments

Web applications have become essential for business, as they simplify and automate key functions and processes for employees, customers and partners, making organizations more agile, innovative and efficient. Unfortunately, many web applications are also unsafe due to latent vulnerabilities and...

CVE-2018-0787

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

Privilege escalation

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

CVE-2018-0808

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0784...

EUVD-2018-0483

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

CVE-2018-0808

CVE-2018-0808 affects ASP.NET Core 1.0/1.1/2.0 where elevation of privilege arises from how web requests are handled. The issue is a denial/privilege-elevation style vulnerability in ASP.NET Core, enabling a remote, unauthenticated attacker to influence the target app via specially crafted reques...

CVE-2018-0808

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0784...

Explained: SQL injection

Even though SQL injection is a type of attack that is relatively easy to prevent, it is one of the most common web hacking techniques. So, what’s it all about? The basics SQL is short for Structured Query Language and usually pronounced as “sequel.” SQL is a standard language used to query and...

Passhunt - Tool For Searching Of Default Credentials For Network Devices, Web Applications And More

Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords. How to install? git clone https://github.com/Viralmaniar/Passhunt.git cd Passhunt pip3 install -r requirements.txt python...

PSNews Website 1.0.0 - 'Keywords' SQL Injection

Exploit Title: PSNews Website Same Backend with Mobile Apps 1.0.0 - 'Keywords' SQL Injection Dork: N/A Date: 2018-02-16 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage: https://codecanyon.net/item/psnews-website/21360354?srank=9 Version: 1.0.0 Category:...

Debian: Security Advisory (DSA-4109-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Deserialization Attacks Surge Motivated by Illegal Crypto-mining

Imperva’s research group is constantly monitoring new web application vulnerabilities. In doing so, we’ve noticed at least four major insecure deserialization vulnerabilities that were published in the past year. Our analysis shows that, in the past three months, the number of deserialization...

[SECURITY] Fedora 27 Update: python-bottle-0.12.13-1.fc27

Bottle is a fast and simple micro-framework for small web-applications. It offers request dispatching Routes with URL parameter support, Template s, a built-in HTTP Server and adapters for many third party WSGI/HTTP-server a nd template engines. All in a single file and with no dependencies other...

[SECURITY] Fedora 26 Update: python-bottle-0.12.13-1.fc26

Bottle is a fast and simple micro-framework for small web-applications. It offers request dispatching Routes with URL parameter support, Template s, a built-in HTTP Server and adapters for many third party WSGI/HTTP-server a nd template engines. All in a single file and with no dependencies other...

Security Update for ASP.NET Core January 2018

The remote Windows host has an installation of ASP.NET Core and .NET Core SDK with a version less than 2.1.4. Therefore, the host is affected by multiple vulnerabilities: - An elevation of privilege vulnerability due to improper sanitization of web requests CVE-2018-0784 - A cross-site request...

PHP Melody 2.7.1 - playlist SQL Injection Vulnerability

Exploit for php platform in category web applications...

OWASP ZAP 2.7.0 - Penetration Testing Tool for Testing Web Applications

The OWASP Zed Attack Proxy ZAP is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. It...

Advanced World Database 2.0.5 - SQL Injection

Exploit Title: Advanced World Database 2.0.5 - SQL Injection Dork: N/A Date: 10.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/advanced-world-database/ Version: 2.0.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit...

Top 3 Tech Challenges RASP/(ng)WAF Vendors Are Faced With

Here I’d like to share my experience and pain in building L7 data protection solutions which are frequently called WAF/ngWAFs or RASPs. I started to build it back in 2009 from a simple detection logic based on self-adopted heuristics for a CTF competition and then build an entire company on machi...

[SECURITY] Fedora 26 Update: memcached-1.4.39-1.fc26

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load...