citrix_cve-2023-4966

citrixcve-2023-4966 Assetnote の Citrix CVE-2023-4966 を並列処理とファイル処理用に修正したもの...

blind-ssrf-chains

介绍 什么是服务端请求伪造（SSRF）？ 服务端请求伪造发生在当你能够迫使服务器代表你发起任意请求时。由于请求是由服务器发起的，因此有可能根据服务器在网络中的位置访问内部资源。在云环境中，由于存在可能包含敏感凭证或密钥的元数据端点，SSRF 构成了更重大的风险。 盲 SSRF 在利用服务端请求伪造时，我们常常会发现自己处于无法读取响应的情况。在行业中，这种行为通常被称为“盲 SSRF”。在这种情况下，我们如何证明其影响？这是由 Justin Gardner 在 Twitter 上引发的一场有趣的讨论： 最近我发现了大量的盲...

Next.js Server-Side Request Forgery in Server Actions

Impact A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js...

WatchGuard XTM Firebox Unauthenticated Remote Command Execution Exploit

This Metasploit module exploits a buffer overflow at the administration interface 8080 or 4117 of WatchGuard Firebox and XTM appliances which is built from a cherrypy python backend sending XML-RPC requests to a C binary called wgagent using pre-authentication endpoint /agent/login. This...

WatchGuard XTM Firebox Unauthenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'zlib' class MetasploitModule 'WatchGuard XTM Firebox Unauthenticated Remote Command Execution', 'Description' = %q This module exploits a buffer overflow at the...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2023-46805 Scanner CVE-2023-46805 Scanner for possible...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller

CVE-2023-4966 An Exploitation script developed to exploit the...

Alert: PoC Exploits Released for Citrix and VMware Vulnerabilities

Virtualization services provider VMware has alerted customers to the existence of a proof-of-concept PoC exploit for a recently patched security flaw in Aria Operations for Logs. Tracked as CVE-2023-34051 CVSS score: 8.1, the high-severity vulnerability relates to a case of authentication bypass...

Citrix ADC (NetScaler) Bleed Scanner

This module scans for a vulnerability that allows a remote, unauthenticated attacker to leak memory for a target Citrix ADC server. The leaked memory is then scanned for session cookies which can be hijacked if found. Module Options msf use auxiliary/scanner/http/citrix/bleedcve20234966 msf...

Progress Software WS_FTP Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Progress Software WSFTP Unauthenticated Remote Code Execution', 'Description' = %q This module exploits an unsafe .NET deserialization...

Progress Software Releases Urgent Hotfixes for Multiple Security Flaws in WS_FTP Server

Progress Software has released hotfixes for a critical security vulnerability, alongside seven other flaws, in the WSFTP Server Ad hoc Transfer Module and in the WSFTP Server manager interface. Tracked as CVE-2023-40044, the flaw has a CVSS score of 10.0, indicating maximum severity. All versions...

Exploit for CVE-2023-38646

Metabase Metabase is an open source business intelligence tool...

Flarum vulnerable to LFI and Blind SSRF via Avatar upload

Impact The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulat...

Exploit for CVE-2023-38646

CVE-2023...

Major Security Flaw Discovered in Metabase BI Software – Urgent Update Required

Users of Metabase, a popular business intelligence and data visualization software package, are being advised to update to the latest version following the discovery of an "extremely severe" flaw that could result in pre-authenticated remote code execution on affected installations. Tracked as...

U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added three security flaws to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The list of shortcomings is as follows - CVE-2022-47986 CVSS score: 9.8 - IBM Aspera Faspex Code...

WatchGuard XTM Firebox Unauthenticated Remote Command Execution

This module exploits a buffer overflow at the administration interface 8080 or 4117 of WatchGuard Firebox and XTM appliances which is built from a cherrypy python backend sending XML-RPC requests to a C binary called wgagent using pre-authentication endpoint /agent/login. This vulnerability impac...

Full Read SSRF in Mobile Plugin CVE-2022-26135

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user including a user who joined via the sign-up feature to perform a full read server-side request forgery via a batch endpoint. This affects Jira Management Server and Data Center versions from versi...

dotCMS Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DotCMS RCE via Arbitrary File Upload.', 'Description' = %q When files are uploaded into dotCMS via the content API, but before they become conten...

Zendesk: Leaked artifactory_key, artifactory_api_key, and gcloud refresh_token via GitHub.

It was reported to Zendesk that valid credentials to an instance of Artifactory and a gcloud project were unintentionally leaked via a public GitHub repository. We immediately rotated the credentials and investigated to ensure they were not utilized by any other party. We want to thank @rubyroobs...