CVE-2021-29156

CVE-2021-29156 개념 증명PoC c 2021 GuidePoint Security Charlton Trezevant [email protected] 배경 오늘 GuidePoint는 ForgeRock OpenAM v13.0.0의 LDAP 인젝션 취약점인 CVE-2021-29156에 대한 기능성 개념 증명PoC 도구를 공개하게 되어 기쁩니다. 이 취약점으로 인해 공격자는 문자 단위 무차별 대입 공격을 통해 취약한 OpenAM 서버에서 사용자의 비밀번호 해시와 같은 다양한 정보를 추출할 수 있습니다. 사용 방법 이...

PT-2026-5163

Name of the Vulnerable Software and Affected Versions SmartBlog version 2.0.1 Description The software contains a blind SQL injection issue in the id post parameter of the details controller. This allows attackers to extract database information by injecting crafted SQL queries that compare...

Wisconsin Governor Hacks the Veto Process

In my latest book, A Hackers Mind, I wrote about hacks as loophole exploiting. This is a great example: The Wisconsin governor used his line-item veto powers--supposedly unique in their specificity--to change a one-year funding increase into a 400-year funding increase. He took this wording:...

CVE-2022-46163 travel-support-program vulnerable to data exfiltration via Ransack query injection

Travel support program is a rails app to support the travel support program of openSUSE TSP. Sensitive user data bank account details, password Hash can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The...