CVE-2022-47514

An XML external entity XXE injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery SSRF attacks, as demonstrated by a pingback.aspx POST request...

CVE-2022-47514

CVE-2022-47514 affects XML-RPC.NET prior to 2.5.0. The issue is an XML External Entity (XXE) injection leading to server-side request forgery (SSRF) by an authenticated user, demonstrated via a pingback.aspx POST. A PoC exists per references. Impact: remote SSRF with high severity per CVSS. Remed...

XML-RPC.NET 代码问题漏洞

XML-RPC.NET is an open source library from PaperCut Software for implementing XML-RPC services and clients in . A security vulnerability exists in versions of XML-RPC.NET prior to 2.5.0 that originates from allowing an authenticated remote user to conduct a server-side request forgery SSRF attack...

CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

DEBIAN-CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

Race condition

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

UBUNTU-CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

CVE-2022-3590 WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

PT-2022-23007

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 6.1 WordPress versions 6.1 through 6.2 WordPress versions 6.1 through 6.9.1 Description WordPress is susceptible to an unauthenticated blind Server-Side Request Forgery SSRF issue within the pingback feature. This i...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress suffers from a code issue vulnerability that stems from unauthenticated server-side request forgery ...

WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding

Description WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. PoC...

Malicious code in @adam_baldwin/pingback (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f588b73737abec3fff361bbdc2e62cf8bd2969cbff8e191ce69b6bb349dfbcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-58 Malicious code in @adam_baldwin/pingback (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f588b73737abec3fff361bbdc2e62cf8bd2969cbff8e191ce69b6bb349dfbcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Powershell Exec, Windows x64 Pingback, Reverse TCP Inline

Execute an x64 payload from a command via PowerShell. Connect back to attacker and report UUID Windows x64 Module Options msf use payload/cmd/windows/powershell/x64/pingbackreversetcp msf payloadpingbackreversetcp show actions ...actions... msf payloadpingbackreversetcp set ACTION msf...

Powershell Exec, Windows x86 Pingback, Bind TCP Inline

Execute an x86 payload from a command via PowerShell. Open a socket and report UUID when a connection is received Windows x86 Module Options msf use payload/cmd/windows/powershell/pingbackbindtcp msf payloadpingbackbindtcp show actions ...actions... msf payloadpingbackbindtcp set ACTION msf...

Acronis: [CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.com

Vulnerability description not provided...

New Pingback Malware Using ICMP Tunneling to Evade C&C Detection

Researchers on Tuesday disclosed a novel malware that uses a variety of tricks to stay under the radar and evade detection, while stealthily capable of executing arbitrary commands on infected systems. Called 'Pingback,' the Windows malware leverages Internet Control Message Protocol ICMP tunneli...

U.S. Dept Of Defense: Blind Stored XSS on the internal host - █████████████

The vulnerability was a blind stored XSS on an internal host. The payload was triggered from the endpoint https://███████████████/NSSI/controlcenterV2/index.htm?directlink&courses/classes/findstudent&&&&&&&& and was found in the Referer header. The vulnerable URL was not accessible from outside t...