faraday_burp

Extensión de Faraday para Burp Comparte los resultados de tu trabajo de seguridad de aplicaciones en Faraday https://faradaysec.com Esta extensión te permitirá importar solicitudes y problemas de tu Burp Suite a un espacio de trabajo de Faraday. Descargar Puedes obtener la extensión precompilada...

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

Summary A Windows-specific command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace option. User-supplied --workspace values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling...

CVE-2022-22954-PoC

CVE-2022-22954 PoC VMware Workspace ONE Access e Identity Manager RCE mediante SSTI. CVE-2022-22954 - PoC SSTI Uso: root@kitploit: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file ...

CVE-2026-71538

@cyclonedx/cyclonedx-npm prior to 6.0.0 is vulnerable to a Windows-specific shell injection in the fallback execution path of src/npmRunner.ts, used when npm_execpath does not resolve the npm CLI. An untrusted value passed to the --workspace option is incorporated into a shell command without san...

VMware-CVE-2022-22954

Inyección de plantillas del lado del servidor Freemarker en VMware CVE-2022-22954 Workspace ONE Access POC para VMware CVE-2022-22954 ¡¡Usa esta solicitud GET de una línea!! Esto ejecutará cat /etc/passwd...

SlackPirate

SlackPirate - Slack 枚举与提取工具 这是一款使用 Python 开发的工具，它利用 Slack 原生 API 在给定访问令牌的情况下，从 Slack 工作区中提取“有趣”的信息。 截至 2018 年 5 月，Slack 拥有超过 800 万用户，并且这一数字正在迅速增长——其集成和“ChatOps”的可能性是无限的，允许团队（不仅仅是开发者！）创建一些非常强大的工作流以及 Slack 机器人/应用程序交互。 与大大小小的企业一样，Slack 这类工具经常被信息安全管理/策略雷达所忽视，这最终导致敏感和机密信息出现在它们不应出现的地方，从而引发危险情况。...

CVE-2022-22954-POC

CVE-2022-22954-POC VMware Workspace ONE Access anteriormente conocido como VMware Identity Manager está diseñado para permitir que sus empleados accedan más rápido a aplicaciones SaaS, web y móviles nativas mediante autenticación multifactor, acceso condicional e inicio de sesión único...

CVE-2022-22954

Análisis de CVE-2022-22954 Resumen Workspace ONE Access modelo de provisión de espacio de trabajo como servicio ofrece autenticación multifactor, inicio de sesión único y acceso condicional para SaaS, aplicaciones web y móviles. CVE-2022-22954 es una vulnerabilidad de Server-side Template Injecti...

VMWare_CVE-2022-22954

VMWareCVE-2022-22954 CVE-2022-22954 es una vulnerabilidad de inyección de plantillas del lado del servidor en VMware Workspace ONE Access e Identity Manager Resultado de búsqueda en Shodan PoC Síguenos Youtube Twitter...

VMware-CVE-2022-22954

VMware CVE-2022-22954 Workspace ONE Access Freemarker Inyección de plantillas del lado del servidor POC para Vmware CVE-2022-22954 ¡Usa esta solicitud GET de una línea!! Esto ejecutará cat /etc/passwd...

CVE-2022-22954

CVE-2022-22954 漏洞描述 Workspace ONE Access 提供统一应用门户,通过门户可安全访问企业的所有应用，可用于单点登录。CVE-2022-22954 中，攻击者可构造恶意请求造成模板注入，执行任意代码，控制服务器。 参考文章 https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 使用说明 批量扫描模式 root@kitploit: python3 CVE-2022-22954.py -m scan -f...

CVE-2020-13884

Título del Exploit: Citrix Workspace app anterior a 1912 para Windows - Escalada de Privilegios 2 Fecha: 2020-06-07 Autor: Andrew Hess Enlace del software: https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-windows/workspace-app-for-windows-1911.html/ Boletín:...

Dashy <= 4.3.6 - Reflected XSS via Workspace

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

VMware Workspace ONE Access - Authentication Bypass

VMware Workspace ONE Access has two authentication bypass vulnerabilities CVE-2022-22955 & CVE-2022-22956 in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework. id: CVE-2022-22956...

hekate

Hekate - Un exploit de ejecución remota de código en VMWare Workspace ONE Access Steven Seeley del Qihoo 360 Vulnerability Research Institute Servidor MySQL malicioso original de LandGrey Detalles Hekate se pronuncia heh-ka-teh Fecha: Tue Feb 22 13:37:00 CST 2022 Versión: 21.08.0.1 última Archivo...

EUVD-2026-81051

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-92788

Coze Studio through version 0.5.1 is affected by a cross-tenant database access vulnerability in its workflow SQL customization nodes. The root cause is a missing validation that ensures table names in those nodes belong to the caller's workspace, allowing an authenticated attacker to enumerate p...

CVE-2022-22954

CVE-2022-22954 Practicando redacción técnica al investigar la vulnerabilidad RCE de VMware Workspace ONE Access CVE-2022-22954...

CVE-2026-88817

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access t...

EUVD-2026-80695

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access t...