satellite

satellite ساتلايت هي خدمة استضافة للحمولات عبر الويب تقوم بتصفية الطلبات لضمان وصول الحمولة إلى الهدف الصحيح. يمكن أن تكون هذه الخدمة مفيدة أيضًا لاستضافة الملفات التي يجب الوصول إليها فقط في ظروف محددة جدًا. دليل البدء السريع 1. تثبيت satellite على أوبونتو باستخدام ملف .deb dpkg -i...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

citrixmash_scanner

ماسح citrixmash CVE-2019-19781 ماسح متعدد الخيوط لأجهزة Citrix المعرضة للثغرة CVE-2019-19781. لا يحاول الماسح اختراق/استغلال المضيفين ويتجنب تنزيل أي محتوى حساس. يتم استخدام طلب HEAD لتحديد ما إذا كان الهدف ضعيفًا. يتم تقليل النتائج الإيجابية الخاطئة عن طريق التحقق من قيمة محددة في استجابة...

CVE-2023-3519

CVE-2023-3519 Ce modèle Nuclei vérifie la présence de la vulnérabilité CVE-2023-3519 sur un serveur web cible. Vulnérabilité CVE-2023-3519 est une vulnérabilité qui permet l'exécution de code à distance non authentifiée dans les appliances Citrix Application Delivery Controller ADC et Gateway. Un...

layne

Layne Layne est une GitHub App auto-hébergée qui centralise l'analyse de sécurité sur l'ensemble de nos dépôts. Comme nous n'utilisons pas d'outils commerciaux de SAST/détection de secrets, et que nous n'avons pas accès à GitHub Enterprise, il peut devenir difficile de maintenir différents fichie...

sh4d0wup

sh4d0wup % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low level tampering,...

cve-2023-33476

CVE-2023-33476 ReadyMedia MiniDLNA, des versions 1.1.15 à 1.3.2, est vulnérable à un débordement de tampon. La vulnérabilité est causée par une logique de validation incorrecte lors du traitement des requêtes HTTP utilisant le codage de transfert par blocs. Cela conduit à ce que du code ultérieur...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)

imgproxy =3.14.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. id: CVE-2023-30019 info: name: Imgproxy = 3.14.0 - Server-side request forgery SSRF author: DhiyaneshDK severity: medium description: | imgproxy =3.14.0 is vulnerable to...

WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery

The WPB Show Core WordPress plugin through version 2.2 is vulnerable to Server-Side Request Forgery SSRF via the 'path' parameter in the download-file.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs. id: CVE-2023-5974 info: nam...

rConfig 3.9.4 - Server-Side Request Forgery

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery SSRF via the patha parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs. id: CVE-2023-39109 info: name: rConf...

WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery

The CAS WordPress theme through version 1.0.0 is vulnerable to Server-Side Request Forgery SSRF via the 'url' parameter in the getremotedata.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs. id: CVE-2024-4399 info: name: WordPre...

Online Security Guards Hiring System - Cross-Site Scripting

A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. id: CVE-2023-0527 info: name: Online Security Guards Hiring System - Cross-Site Scripting author:...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

Oracle Weblogic - Server-Side Request Forgery

An unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services. id: CVE-2014-4210 info: name: Oracle Weblogic - Server-Side Request Forgery author:...

Umbraco <7.4.0- Server-Side Request Forgery

Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index. id: CVE-2015-8813 info: name: Umbraco 7.4.0- Server-Side Request...

Starlette - Improper Validation of Unsafe Equivalence in Input

A flaw was found in Starlette, a lightweight ASGI Asynchronous Server Gateway Interface framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading...

Gradio - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is used to make an HTTP...

Kan <= 0.5.4 - Server-Side Request Forgery

Kan, an open-source project management tool Trello alternative, versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled url query parameter straight to a server-side fetch...

Lobe Chat <= v0.150.5 - Server-Side Request Forgery

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause...