CVE-2020-24881

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...

Server side request forgery (ssrf)

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...

Bug hunting for a quick buck using WebLogic vulnerability (CVE-2020–14882)

Introduction Popular within the commercial sphere, Oracle WebLogic Server is a scalable enterprise Java platform application server for Java-based web applications. When a vulnerability is discovered in WebLogic, hackers will try to exploit it ASAP. And it’s not only hackers - bug hunters also wa...

CVE-2020-24881

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...

CVE-2020-24881

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...

CVE-2020-24881: Server-Side Request Forgery (SSRF)

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...

PT-2020-15848

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.14.3 Description A Server-Side Request Forgery SSRF issue exists, allowing an attacker to add malicious files to the server or perform port scanning. Recommendations For versions prior to 1.14.3, update to version...

Exploit for Improper Authentication in Microsoft

!made-with-bashhttps://img.shields.io/badge/Made%20with-Bash...

Trend Micro HouseCall for Home Networks: Giving You a Free Hand in Home Network Security

Remember when only desktop computers in our homes had connections to the internet? Thanks to the latest developments in smart device technology, almost everything now can be connected— security cameras, smart TVs, gaming consoles, and network storage, to name just a few. While a home network...

phpBB: Server Side Request Forgery in 'Jabber settings' in Admin Control Panel

Overview The 'Jabber settings' panel inside the Administrator Control Panel can be used to access resources that would otherwise only be accessible by the host machine, including resources/services hosted on the localhost interface. This can be performed by setting the 'jabber server' parameter t...

ClamAV Zip Bomb Vulnerability

...

CVE-2020-6308

The SAP BusinessObjects Business Intelligence Platform (Web Services) versions 410, 420, and 430 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a lack of validation on the CMS function for the APS parameter , which allows an unauthenticated attacker to inject arbitrary...

Exploit for Improper Access Control in Elasticsearch

欢迎各位大佬提BUG,当前版本 AssetScanV1.3 周期 初版：2019年11月28日 V1.0初版编写完成 修改1：2019年12月02日 感谢Shadow·J反馈kali下文件导入异常 修改2：2019年12月03日 V1.1发布，新增ARP存活检测（回滚，测bug） 修改3：2019年12月04日 V1.2发布，修复漏洞脚本异常，修复weblogic脚本 修改4：2019年12月05日 V1.2修改，感谢sevck提供设计思路以及代码不规范问题 修改5：2019年12月05日 V1.2修改，修复IP数据处理异常 修改6：2019年12月19日...

Discover A10 Networks Advanced Core OS Vulnerabilities using Qualys VMDR

The Qualys vulnerability signatures team has released a new series of signatures detections for A10 Networks ACOS Advanced Core Operating System, allowing security teams to identify A10 hosts and detect their vulnerabilities. A10 Advanced Core Operating System with true Scalable Symmetrical...

Scanners-Box

This is a collection of open-source scanning tools, referred to as "Scanners Box" or "scanbox," maintained by the user "We5ter" on GitHub. The repository contains various tools for scanning and testing different aspects of a system or network, including subdomain enumeration, database vulnerabili...

OFFPORT_KILLER - This Tool Aims At Automating The Identification Of Potential Service Running Behind Ports Identified Manually Either Through Manual Scan Or Services Running Locally

Manual Port Scanning Enumerate Potential Service If you like the tool and for my personal motivation so as to develop other tools please a +1 star INTRO This tool aims at automating the identification of potential service running behind ports identified manually or on services running locally onl...

Asnap - Tool To Render Recon Phase Easier By Providing Updated Data About Which Companies Owns Which Ipv4 Or Ipv6 Addresses

Asnap aims to render recon phase easier by providing regularly updated data about which companies owns which ipv4 or ipv6 addresses and allows the user to automate initial port and service scanning. █████╗ ███████╗███╗ ██╗ █████╗ ██████╗ ██╔══██╗██╔════╝████╗ ██║██╔══██╗██╔══██╗...

U.S. Dept Of Defense: SSRF in login page using fetch API exposes victims IP address to attacker controled server

Note: This is similar to my last report 991163. Summary: Server Side Request Forgery Exposes Victims Ip Address to External Server and which made attacker possible to determine physical location of Victim with IP Tracing. Description: Server Side Request Forgery is the critical vulnerability...

CVE-2020-15594

CVE-2020-15594 affects Zoho Application Control Plus prior to version 10.0.511. The mail gateway configuration feature exposes a Server-Side Request Forgery (SSRF) flaw that enables an attacker to scan for open ports and discover reachable machines on the same network segment. The issue is mitiga...

Lock and Code S1Ep16: Investigating digital vulnerabilities with Samy Kamkar

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Samy Kamkar, chief security officer and co-founder of Open Path, about the digital vulnerabilities in our physical world. If you look through a recent...