EvilRip

Cve-2020-5029-finder CVE-2020-5902 に対して脆弱なサブドメイン/IP を探し出すための、bash で書かれた小さなスクリプトです。 影響を受けるバージョン BIG-IP バージョン 15.0.0-15.1.0.3、14.1.0-14.1.2.5、13.1.0-13.1.3.3、12.1.0-12.1.5.1、および 11.6.1-11.6.5.1 では、Configuration utility とも呼ばれる Traffic Management User...

CVE-2020-5902

CVE-2020-5902 BIG-IP 버전 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 및 11.6.1-11.6.5.1에서 TMUITraffic Management User Interface, 설정 유틸리티라고도 함의 미공개 페이지에 RCE원격 코드 실행 취약점이 존재합니다. 개념 증명 https:///tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd...

GoF5-CVE-2020-5902

GoF5-CVE-2020-5902 F5 BIG-IP Traffic Management User Interface TMUI の重大な脆弱性 CVE-2020-5902 を検証するためのオープンソースユーティリティ。 Golang 製。 Windows デモ...

cve-2023-46747

CVE-2023-46747 利用脚本 此脚本利用 F5 BIG-IP TMUI 远程代码执行漏洞 CVE-2023-46747 。它允许未认证的攻击者在易受攻击的 F5 BIG-IP 系统上执行任意命令。 目录 特性 环境要求 使用方法 参数 工作原理 免责声明 特性 未认证用户创建： 在目标系统上生成一个用户。 令牌获取： 使用创建的用户获取认证令牌。 远程命令执行： 在目标系统上执行任意 shell 命令。 环境要求 Python 3.8+ 模块： argparse binascii json random requests time urllib3 使用 pip 安装缺失的模块：...

CVE-2020-5902

🚨 CVE-2020-5902 — F5 BIG-IP TMUI RCE CVE-2020-5902 은 F5 BIG-IP Traffic Management User Interface TMUI / 구성 유틸리티의 치명적인 인증 없는 원격 코드 실행RCE 취약점입니다. 📌 개요 F5가 2020년 6월 30일NVD는 2020년 7월 1일 게시에 공개한 이 결함은 관리 인터페이스에 네트워크 접근이 가능한 인증되지 않은 공격자또는 인증된 사용자가 임의 시스템 명령어 실행 , 파일 읽기/쓰기/삭제, 서비스 비활성화, 임의 Java 코드 실행, 전...

CVE-2020-5902

CVE-2020-5902 / \ \ / / | | \ / \ \ / \ | / \ / \ \ | | \ \ / /| | | | | | | | | || || | | | | | | | \ / / | |/ /| | | |/ /| | | || \, | | | |/ / | | \ / | | / /| || / /| || | | / /| || / / | / || ||/|/ |/ // /| CVE-2020-5902-Scanner.py @nsflabs F5 BIG-IP の Traffic Management User Interface...

CVE-2020-5902

요약 BIG-IP 버전 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 및 11.6.1-11.6.5.1에서 Traffic Management User InterfaceTMUI, 구성 유틸리티라고도 함에 공개되지 않은 페이지에서 원격 코드 실행RCE 취약점이 존재합니다. 크레딧: Positive Technologies의 Mikhail Klyuchnikov 개념 증명...

Metasploit Weekly Wrap-Up

PTT for DCSync This week, community member smashery made an improvement to the windowssecretsdump module to enable it to dump domain hashes using the DCSync method after having authenticated with a Kerberos ticket. Now, if a user has a valid Kerberos ticket for a privileged account, they can run...

K22441651: BIG-IP TMUI XSS vulnerability CVE-2019-6657

Security Advisory Description A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility. CVE-2019-6657 Impact An attacker may exploit this vulnerability using a crafted URL ...

CVE-2022-28707: Improper Neutralization of Input During Web Page Generation

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility also referred to as the BIG-IP TMUI that allows an attacker t...

F5 BIG-IP 跨站脚本漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A cross-site scripting vulnerability exists in the F5 BIG-IP TMUI. An attacker can exploit the vulnerability to execute...

CVE-2020-5940

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility...

Cross site scripting

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility...