CVE-2023-41717

CVE-2023-41717 Contrôle inapproprié du type de fichier dans les versions 3.6.1.25 et antérieures du proxy Zscaler permet aux attaquants locaux de contourner les restrictions de téléchargement/upload. Résumé Exécutif Au cours de l'été 2022, j'ai découvert une vulnérabilité affectant le proxy ZScal...

Check-WP-CVE-2020-35489

Check-WP-CVE-2020-35489 CVE-2020-35489 CVE-2020-35489 обнаружена в плагине Contact Form 7 для WordPress версии 5.3.1 и более старых версиях. Используя эту уязвимость, злоумышленники могут просто загружать файлы любого типа, обходя все ограничения, установленные в отношении разрешённых типов...

CVE-2022-22978

CVE 2022-22978: Обход авторизации в RegexRequestMatcher 🥶 Обзор Согласно информации, которую я нашёл, это уязвимость, связанная с классом RegexRequestMatcher во фреймворке Spring Security. В частности, приложения, использующие RegexRequestMatcher, в регулярном выражении которых содержится точка ....

k8s-CVE-2021-43557-poc

安装 安装 minikube 安装 apisix： root@kitploit: helm repo add apisix https://charts.apiseven.com helm repo add bitnami https://charts.bitnami.com/bitnami helm repo update kubectl create ns ingress-apisix helm install apisix apisix/apisix \ --set gateway.type=NodePort \ --set...

nacker

Nacker Nacker是一个用于绕过来有线局域网的802.1x网络访问控制（NAC）的工具。Nacker将帮助您定位子网中任何非802.1x可配置的主机，并伪造它们的MAC地址，从而使您看起来已向交换机进行了身份验证。 “Nacker”这个名字来源于单词“knocker”和NAC；巧合的是，将它们组合起来就等同于爱尔兰吉普赛人的俚语。你喜欢dags吗？ 重要说明 此工具当前处于不可工作状态。 简介...

CVE-2026-20896

CVE-2026-20896 Gitea 的官方 Docker 镜像（最高至 1.26.2 及包括该版本）在其默认配置中包含了 REVERSEPROXYTRUSTEDPROXIES = 。如果你开启了反向代理登录，这个通配符意味着每个来源 IP 都被视为可信代理，因此任何能访问该端口的人都可以发送 X-WEBAUTH-USER 头部并以任意用户身份登录。无需密码，无需令牌。 我已将此问题报告给 Gitea，并在 1.26.3 / 1.26.4 中修复。本仓库是我自己的分析报告、一个可用的 PoC 以及一个检测工具。这是一个已修补的公开漏洞。 CVE...

Netgear DGN2200 - Improper Authentication

A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the requested url, it will be recognized as passing the authentication. id: CVE-2024-57046 info: name: Netgear DGN2200...

Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass

Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the "vm://" transport scheme in BrokerView.addNetworkConnector and BrokerView.addConnector to prevent authenticated attackers from...

Masa CMS - Authentication Bypass

Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

WordPress Time Capsule < 1.21.16 - Authentication Bypass

WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWPJSONPREFIX causes the client to be logged in as the first account on the list of administrator accounts. id: CVE-2020-8771 info: name: WordPress Time Capsule 1.21.16 - Authentication...

TeamPass 2.1.27.36 - Improper Authentication

TeamPass 2.1.27.36 is susceptible to improper authentication. An attacker can retrieve files from the TeamPass web root, which may include backups or LDAP debug files, and therefore possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-12478 info...

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

Canon Devices - Authentication Bypass in Catwalk Server

Certain Canon devices manufactured in 2012 through 2020 such as imageRUNNER ADVANCE iR-ADV C5250, when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For...

WP Directory Kit <= 1.4.4 - Authentication Bypass

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism tha...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

Tenda 11N - Authentication Bypass

Tenda 11N with firmware version V5.07.33cn contains an authentication bypass vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-42233 info: name: Tenda 11N -...

Helmet Store Showroom v1.0 - SQL Injection

There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access. id: CVE-2022-46071 info: name: Helmet Store Showroom v1.0 - SQL Injection author: Harsh severity: critical description: | There is SQL Injection vulnerability...