On this page
Atomicorp WAF Rule 390727
Rule Summary
- Rule ID: 390727
- Status: Active
- Alert message: Atomicorp.com WAF Rules: cross site scripting stealth attempt to inject javascript
- Observed CWEs: CWE-20 (2), CWE-22 (13), CWE-77 (1), CWE-79 (16), CWE-89 (18), CWE-119 (2), CWE-189 (1), CWE-200 (4), CWE-269 (1), CWE-284 (2), CWE-287 (3), CWE-327 (1), CWE-352 (1), CWE-362 (1), CWE-425 (1), CWE-434 (1), CWE-444 (1), CWE-522 (1), CWE-601 (3), CWE-770 (1), CWE-798 (1), CWE-918 (4)
- Revision: 4
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request arguments, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “cross site scripting stealth attempt to inject javascript” in the request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2012-1259 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 9.8 (v3.1) | Critical |
| CVE-2013-7137 | Burden 1.8 - Authentication Bypass | burden | 9.8 (v3.1) | Critical |
| CVE-2016-6600 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 9.8 (v3.0) | Critical |
| CVE-2016-6602 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 9.8 (v3.0) | Critical |
| CVE-2016-6603 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 9.8 (v3.0) | Critical |
| CVE-2016-9682 | Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injection | sonicwall secure remote access server | 9.8 (v3.0) | Critical |
| CVE-2017-17970 | Muviko 1.1 - SQL Injection | muviko | 9.8 (v3.0) | Critical |
| CVE-2018-12596 | Ektron CMS 9.20 SP2 - Improper Access Restrictions | ektron cms | 9.8 (v3.0) | Critical |
| CVE-2018-15534 | Geutebrueck re_porter 7.8.974.20 - Credential Disclosure | re porter 16 firmware | 9.8 (v3.0) | Critical |
| CVE-2018-9160 | SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response | sickrage | 9.8 (v3.0) | Critical |
| CVE-2019-1935 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.1) | Critical |
| CVE-2019-1937 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.0) | Critical |
| CVE-2020-17463 | Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated) | fuel cms | 9.8 (v3.1) | Critical |
| CVE-2021-40617 | openSIS Community Edition 8.0 - SQL Injection | opensis | 9.8 (v3.1) | Critical |
| CVE-2022-0332 | Moodle 3.11.4 - SQL Injection | moodle | 9.8 (v3.1) | Critical |
| CVE-2022-0788 | WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection | wp fundraising donation and crowdfunding platform | 9.8 (v3.1) | Critical |
| CVE-2022-38580 | X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) | skipper | 9.8 (v3.1) | Critical |
| CVE-2023-0938 | Music Gallery Site v1.0 - SQL Injection on music_list.php | music gallery site | 9.8 (v3.1) | Critical |
| CVE-2023-27350 | PaperCut - Unauthenticated Remote Code Execution | papercut mf | 9.8 (v3.1) | Critical |
| CVE-2023-33362 | Piwigo 13.6.0 - SQL Injection | piwigo | 9.8 (v3.1) | Critical |
| CVE-2024-24495 | Daily Habit Tracker 1.0 - SQL Injection | daily habit tracker | 9.8 (v3.1) | Critical |
| CVE-2017-14611 | Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery | cockpit | 9.1 (v3.0) | Critical |
| CVE-2018-9302 | Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery | cockpit | 9.1 (v3.0) | Critical |
| CVE-2021-37593 | PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection | peel shopping | 9.1 (v3.1) | Critical |
| CVE-2018-5406 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 8.8 (v3.1) | High |
| CVE-2020-25760 | Visitor Management System in PHP 1.0 - SQL Injection (Authenticated) | visitor management system | 8.8 (v3.1) | High |
| CVE-2020-5192 | Hospital Management System 4.0 - 'searchdata' SQL Injection | hospital management system | 8.8 (v3.1) | High |
| CVE-2020-5504 | phpMyAdmin 5.0.0 - SQL Injection | phpmyadmin | 8.8 (v3.1) | High |
| CVE-2023-0962 | Music Gallery Site v1.0 - SQL Injection on page Master.php | music gallery site | 8.8 (v3.1) | High |
| CVE-2025-44177 | White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI) | protop | 8.2 (v3.1) | High |
| CVE-2023-46022 | Blood Bank 1.0 - 'bid' SQLi | blood bank | 7.8 (v3.1) | High |
| CVE-2011-4899 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 7.5 (v2.0) | High |
| CVE-2013-0249 | cURL - Buffer Overflow (PoC) | curl | 7.5 (v2.0) | High |
| CVE-2013-5639 | Gnew 2013.1 - Multiple Vulnerabilities (2) | gnew | 7.5 (v2.0) | High |
| CVE-2013-5640 | Gnew 2013.1 - Multiple Vulnerabilities (2) | gnew | 7.5 (v2.0) | High |
| CVE-2015-1503 | IceWarp Mail Server < 11.1.1 - Directory Traversal | mail server | 7.5 (v3.0) | High |
| CVE-2016-4309 | Symphony CMS 2.6.7 - Session Fixation | symphony | 7.5 (v3.1) | High |
| CVE-2016-6601 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 7.5 (v3.0) | High |
| CVE-2017-5850 | OpenBSD HTTPd < 6.0 - Memory Exhaustion Denial of Service | openbsd | 7.5 (v3.0) | High |
| CVE-2017-6190 | D-Link DWR-116 / DWR-116A1 - Arbitrary File Download | dwr-116 firmware | 7.5 (v3.0) | High |
| CVE-2018-1306 | Apache Portals Pluto 3.0.0 - Remote Code Execution | pluto | 7.5 (v3.0) | High |
| CVE-2018-15535 | Responsive FileManager < 9.13.4 - Directory Traversal | responsive filemanager | 7.5 (v3.0) | High |
| CVE-2018-7171 | TwonkyMedia Server 7.0.11-8.5 - Directory Traversal | twonky server | 7.5 (v3.0) | High |
| CVE-2023-40279 | OpenClinic GA 5.247.01 - Path Traversal (Authenticated) | openclinic ga | 7.5 (v3.1) | High |
| CVE-2017-15643 | Ikraus Anti Virus 2.16.7 - Remote Code Execution | ikarus antivirus | 7.4 (v3.0) | High |
| CVE-2019-1936 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 7.2 (v3.1) | High |
| CVE-2020-20969 | PluckCMS 4.7.10 - Unrestricted File Upload | pluck | 7.2 (v3.1) | High |
| CVE-2012-3350 | Webmatic 3.1.1 - Blind SQL Injection | webmatic | 6.8 (v2.0) | Medium |
| CVE-2015-5161 | Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection | zend framework | 6.8 (v2.0) | Medium |
| CVE-2012-1258 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.5 (v3.1) | Medium |
| CVE-2017-3546 | Oracle PeopleSoft - Server-Side Request Forgery | peoplesoft enterprise peopletools | 6.5 (v3.0) | Medium |
| CVE-2018-5404 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 6.5 (v3.0) | Medium |
| CVE-2018-7690 | Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure | fortify software security center | 6.5 (v3.0) | Medium |
| CVE-2018-9038 | Monstra CMS 3.0.4 - Arbitrary Folder Deletion | monstra | 6.5 (v3.0) | Medium |
| CVE-2019-12616 | phpMyAdmin 4.8 - Cross-Site Request Forgery | phpmyadmin | 6.5 (v3.0) | Medium |
| CVE-2019-3778 | Spring Security OAuth - Open Redirector | spring security oauth | 6.5 (v3.1) | Medium |
| CVE-2021-34369 | Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR) | civic platform | 6.5 (v3.1) | Medium |
| CVE-2017-9640 | Automated Logic WebCTRL 6.1 - Path Traversal / Arbitrary File Write | i-vu | 6.3 (v3.0) | Medium |
| CVE-2012-1260 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium |
| CVE-2012-1261 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium |
| CVE-2017-3132 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium |
| CVE-2017-3133 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium |
| CVE-2019-18859 | Digi AnywhereUSB 14 - Reflective Cross-Site Scripting | anywhereusb/14 firmware | 6.1 (v3.1) | Medium |
| CVE-2019-1943 | CISCO Small Business 200 / 300 / 500 Switches - Multiple Vulnerabilities | sg200-50 firmware | 6.1 (v3.0) | Medium |
| CVE-2019-9591 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2019-9592 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2019-9593 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2021-33904 | Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS) | civic platform | 6.1 (v3.1) | Medium |
| CVE-2021-34370 | Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS) | civic platform | 6.1 (v3.1) | Medium |
| CVE-2018-15536 | Responsive FileManager < 9.13.4 - Directory Traversal | responsive filemanager | 5.5 (v3.0) | Medium |
| CVE-2017-3131 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium |
| CVE-2018-5405 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 5.4 (v3.0) | Medium |
| CVE-2019-11269 | Spring Security OAuth - Open Redirector | spring security oauth | 5.4 (v3.1) | Medium |
| CVE-2020-7108 | WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting | learndash | 5.4 (v3.1) | Medium |
| CVE-2021-26085 | Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read | confluence data center | 5.3 (v3.1) | Medium |
| CVE-2021-26086 | Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read | jira data center | 5.3 (v3.1) | Medium |
| CVE-2011-4898 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 5.0 (v2.0) | Medium |
| CVE-2012-5451 | TVMOBiLi 2.1.0.3557 - Denial of Service | tvmobili | 5.0 (v2.0) | Medium |
| CVE-2012-5875 | FireFly Mediaserver 1.0.0.1359 - Null Pointer Dereference | firefly media server | 5.0 (v2.0) | Medium |
| CVE-2012-5876 | Nero MediaHome 4.5.8.0 - Denial of Service | mediahome | 5.0 (v2.0) | Medium |
| CVE-2012-5877 | Nero MediaHome 4.5.8.0 - Denial of Service | mediahome | 5.0 (v2.0) | Medium |
| CVE-2015-5285 | Kallithea 0.2.9 - 'came_from' HTTP Response Splitting | kallithea | 5.0 (v2.0) | Medium |
| CVE-2024-24050 | Workout Journal App 1.0 - Stored XSS | workout journal app | 4.7 (v3.1) | Medium |
| CVE-2007-3385 | Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure | tomcat | 4.3 (v2.0) | Medium |
| CVE-2012-0782 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 4.3 (v2.0) | Medium |
| CVE-2014-0191 | eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection | fusion middleware | 4.3 (v2.0) | Medium |
| CVE-2025-41228 | VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) | vCenter Server | 4.3 (v3.1) | Medium |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.