Citrix Receiver on the Internal Network fails to connect to a Store when Remote Access enabled

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Under certain circumstances, while trying to access from a client in the internal network to a...

Dotclear 2.9.1 SSRF / XSPA

Dotclear 2.9.1 SSRF/XSPA Vulnerability + Software: https://dotclear.org/ + Author: Wiswat Aswamenakul + Affected version: only tested on 2.9.1 previous version might be affected + Platform: tested on Ubuntu 14.04, PHP 5.5.9 + Description Dotclear has a feature to import blog content through RSS...

Netgear device web interface login password disclosure vulnerability

Netgear is a global leader in enterprise networking solutions and a champion of digital home networking applications. A web interface login password disclosure vulnerability exists in several Netgear devices. When password recovery is disabled, an attacker with access to the internal network or...

Nextcloud: Server side request forgery (SSRF) on nextcloud implementation.

An admin of nextcloud server can add other trusted nextcloud server in his own installation. The following request passes when a new add request is processed: http POST /nextcloud/index.php/apps/federation/trusted-servers HTTP/1.1 Host: myown.nextcloudserver.com User-Agent: Mozilla/5.0 Macintosh;...

Uber paid found the login bypass vulnerability researcher 1 million dollars-vulnerability warning-the black bar safety net

! Car share company Uber recently to repair the company's website, a vulnerability that can allow an attacker without the password can also log some “. uber.com” the website, and further on its internal network attacks. Uber rewards in the last month found that the vulnerability of the Finnish...

Uber Pays Researcher $10K for Login Bypass Exploit

Ridesharing company Uber recently patched a vulnerability in its site that could have allowed an attacker to log into some “.uber.com” sites without a password and further compromise its internal network. Uber awarded Finnish security researcher Jouko Pynnönen $10,000 for discovering the flaw las...

DNS reconnaissance tool: Fierce

Fierce is a DNS reconnaissance tool for locating non-contiguous IP space Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames against specified domains. It’s really meant as a pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all of those require...

Dropbox: Dropbox apps Server side request forgery

Hi, SSRF is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server. Usually, Server Side Request Forgery SSRF attacks target internal systems behind the firewall that are normally inaccessible from the outside world but using SSRF it’s possible...

99 Problems but Two-Factor Ain’t One

Two-factor authentication is a best practice for securing remote access, but it is also a Holy Grail for a motivated red team. Hiding under the guise of a legitimate user authenticated through multiple credentials is one of the best ways to remain undetected in an environment. Many companies rega...

SSH Authentication Backdoor Vulnerability in Fortigate Firewalls

FortiGate Fita Firewall is a network firewall product from Fortinet Fita for defense against attacks such as network and malicious code at the network and content layers. Fortigate Firewall has an SSH authentication backdoor vulnerability. FortiGate firewall FortimanagerAccess user's password is...

金蝶某系统存在任意文件上传漏洞可威胁内网

简要描述： 上传绕过，可内网才是关键 详细说明： WooYun: 某大型在线考试系统通用型任意文件上传（涉及银行、证卷等企业） 问题发生后，是有进行相应的修补，但修补的有问题，限制了对jsp马的上传，但jspx毫无限制 上传jsp直接报错 但是jspx就 http://exam.kingdee.com/mana/edit/attachupload.jsp 可直接上传jspx马 上传成功后直接查看源代码获取shell地址 漏洞证明：...

用友某系统从弱口令到sql注射到getshell

简要描述： 弱口令、sql注射、getshell 详细说明： 系统地址： http://vip.ufida.com.cn/Frame/Index.aspx 弱口令帐号：adminnc 密码：adminnc 在自助查询处，发现注入（需要登录，注意cookie有时效） GET http://vip.ufida.com.cn/RepositorySearchInfo/DoctInfo.aspx?ReposID=38d4a08e-8b79-4de7-8566-30aecfb1d56f HTTP/1.1 Accept: text/html, application/xhtml+xml, /...

The vulnerability of the iOS operating system allows a perpetrator to initiate TCP connections with nodes within the internal network.

The vulnerability of the CFNetwork FTP Protocol component in the iOS operating system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to initiate TCP connections with internal network nodes using specially crafted responses to requests...

Sonar.js - Framework for identifying and launching exploits against internal network hosts

A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration, WebSocket host scanning, and external resource fingerprinting. How does it work? Upon loading the sonar.js payload in a modern web browser the following will happen: sonar.js will u...

Cisco ASA uRPF Checksum Bypass Vulnerability

The Cisco Adaptive Security Appliance is an adaptive security appliance that provides modules for security and VPN services. The Cisco Adaptive Security Appliance uRPF has a security vulnerability. Due to failure to properly verify the uRPF of an external interface IP message, if the IP address...

The vulnerability of the SAP NetWeaver software integration platform allows a hacker to obtain information about the accessibility of internal network services.

The vulnerability of the SAP NetWeaver software integration platform exists due to insufficient restrictions on access to the GetSecNetworkId method SAPControl. Exploiting this vulnerability allows a malicious actor to obtain information about the availability of internal network services through...

Debian Security Advisory DSA 3298-1 (jackrabbit - security update)

It was discovered that the Jackrabbit WebDAV bundle was susceptible to a XXE/XEE attack. When processing a WebDAV request body containing XML, the XML parser could be instructed to read content from network resources accessible to the host, identified by URI schemes such as https or file. Dependi...

MGASA-2015-0211 Updated springframework packages fix CVE-2014-0225

Updated springframework packages fix security vulnerabilities: When processing user provided XML documents, the Spring Framework did not disable by default the resolution of URI references in a DTD declaration. By observing differences in response times, an attacker could then identify valid IP...

D-Link DSL-500B Gen 2 - URL Filter Configuration Panel Persistent Cross-Site Scripting

!/usr/bin/perl Date dd-mm-aaaa: 13-02-2015 Exploit for D-Link DSL-500B G2 Cross Site Scripting XSS Injection Stored in todmngr.tod URL Filter Developed by Mauricio Corrêa XLabs Information Security WebSite: www.xlabs.com.br CAUTION! This exploit disables some features of the modem, forcing the...

D-Link DSL-2730B Modem - Cross-Site Scripting Injection Stored DnsProxy.cmd

Exploit Title: D-Link DSL-2730B Modem dnsProxy.cmd Exploit XSS Injection Stored Date: 11-01-2015 Exploit Author: Mauricio Correa Vendor Homepage: www.dlink.com Hardware version: C1 Version: GE 1.01 Tested on: Windows 8 and Linux !/usr/bin/perl Date dd-mm-aaaa: 11-11-2014 Exploit for D-Link...