CVE-2016-9185

In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are =6.0.0 =6.1.0, and ==7.0.0...

CVE-2016-9185

CVE-2016-9185 affects OpenStack Heat (OpenStack Orchestration). The vulnerability allows an authenticated user to discover internal network configuration by launching a new Heat stack with a local URL, causing an information-leak. Affected OpenStack Heat versions are =6.0.0

CVE-2016-9185: Exposure of Sensitive Information to an Unauthorized Actor

In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are =6.0.0 =6.1.0, and ==7.0.0...

DokuWiki Cross-Site Request Forgery Vulnerability

DokuWiki is a German software developer Andreas Gohr developed a PHP-based Wiki engine , it is mainly used for small and medium-sized team and personal website knowledge base management , and provides version control , full-text search and permission control and other functions . A cross-site...

CVE-2016-7964: Server-Side Request Forgery (SSRF)

The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and...

Talk about how Python development is rejected SSRF vulnerability-vulnerability warning-the black bar safety net

0x01 SSRF vulnerability common Defense techniques and bypass methods SSRF is a common Web vulnerability, usually present in the need to request external content, such as localized network images, XML parsing when the external entity injection, software offline download. When the attacker passed a...

Kerio Control firewall there are a number of serious vulnerabilities-vulnerability warning-the black bar safety net

! According to the foreign media to the latest reports, security research experts in the Kerio Control firewall found a series of serious security vulnerabilities. Due to these vulnerabilities exist, the external attacker will be able by tricking employees to click on to access a malicious link t...

The vulnerability of the ColdFusion interpreter allows attackers to read arbitrary files or send TCP requests to servers in the internal network.

The vulnerability of the Office Open XML OOXML file format in ColdFusion is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows an attacker to remotely read arbitrary files or send TCP requests to internal server networks using a specially...

Citrix Receiver on the Internal Network fails to connect to a Store when Remote Access enabled

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Under certain circumstances, while trying to access from a client in the internal network to a...

Dotclear 2.9.1 SSRF / XSPA

Dotclear 2.9.1 SSRF/XSPA Vulnerability + Software: https://dotclear.org/ + Author: Wiswat Aswamenakul + Affected version: only tested on 2.9.1 previous version might be affected + Platform: tested on Ubuntu 14.04, PHP 5.5.9 + Description Dotclear has a feature to import blog content through RSS...

Netgear device web interface login password disclosure vulnerability

Netgear is a global leader in enterprise networking solutions and a champion of digital home networking applications. A web interface login password disclosure vulnerability exists in several Netgear devices. When password recovery is disabled, an attacker with access to the internal network or...

Nextcloud: Server side request forgery (SSRF) on nextcloud implementation.

An admin of nextcloud server can add other trusted nextcloud server in his own installation. The following request passes when a new add request is processed: http POST /nextcloud/index.php/apps/federation/trusted-servers HTTP/1.1 Host: myown.nextcloudserver.com User-Agent: Mozilla/5.0 Macintosh;...

Uber paid found the login bypass vulnerability researcher 1 million dollars-vulnerability warning-the black bar safety net

! Car share company Uber recently to repair the company's website, a vulnerability that can allow an attacker without the password can also log some “. uber.com” the website, and further on its internal network attacks. Uber rewards in the last month found that the vulnerability of the Finnish...

Uber Pays Researcher $10K for Login Bypass Exploit

Ridesharing company Uber recently patched a vulnerability in its site that could have allowed an attacker to log into some “.uber.com” sites without a password and further compromise its internal network. Uber awarded Finnish security researcher Jouko Pynnönen $10,000 for discovering the flaw las...

DNS reconnaissance tool: Fierce

Fierce is a DNS reconnaissance tool for locating non-contiguous IP space Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames against specified domains. It’s really meant as a pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all of those require...

Dropbox: Dropbox apps Server side request forgery

Hi, SSRF is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server. Usually, Server Side Request Forgery SSRF attacks target internal systems behind the firewall that are normally inaccessible from the outside world but using SSRF it’s possible...

99 Problems but Two-Factor Ain’t One

Two-factor authentication is a best practice for securing remote access, but it is also a Holy Grail for a motivated red team. Hiding under the guise of a legitimate user authenticated through multiple credentials is one of the best ways to remain undetected in an environment. Many companies rega...

SSH Authentication Backdoor Vulnerability in Fortigate Firewalls

FortiGate Fita Firewall is a network firewall product from Fortinet Fita for defense against attacks such as network and malicious code at the network and content layers. Fortigate Firewall has an SSH authentication backdoor vulnerability. FortiGate firewall FortimanagerAccess user's password is...

金蝶某系统存在任意文件上传漏洞可威胁内网

简要描述： 上传绕过，可内网才是关键 详细说明： WooYun: 某大型在线考试系统通用型任意文件上传（涉及银行、证卷等企业） 问题发生后，是有进行相应的修补，但修补的有问题，限制了对jsp马的上传，但jspx毫无限制 上传jsp直接报错 但是jspx就 http://exam.kingdee.com/mana/edit/attachupload.jsp 可直接上传jspx马 上传成功后直接查看源代码获取shell地址 漏洞证明：...

用友某系统从弱口令到sql注射到getshell

简要描述： 弱口令、sql注射、getshell 详细说明： 系统地址： http://vip.ufida.com.cn/Frame/Index.aspx 弱口令帐号：adminnc 密码：adminnc 在自助查询处，发现注入（需要登录，注意cookie有时效） GET http://vip.ufida.com.cn/RepositorySearchInfo/DoctInfo.aspx?ReposID=38d4a08e-8b79-4de7-8566-30aecfb1d56f HTTP/1.1 Accept: text/html, application/xhtml+xml, /...