joro

Joro Un framework d'exploitation web pour les professionnels de la sécurité offensive. Proxy d'interception, détection de vulnérabilités aveugles, génération de web shells, intégration C2 et outils de collaboration dans un seul binaire avec une interface web intégrée. Avertissement : Cet outil es...

CVE-2024-6492: Insufficiently Protected Credentials

Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted website...

froxlor/froxlor <= 0.10.38.2 - Authenticated Unrestricted File Upload to RCE

Description Unsafe file uploads occur when the web server fails to sufficiently validate the file’s size, type, name, contents, or what restrictions are placed on the file once it has been successfully uploaded. The application fails to validate files that are uploaded, allowing an attacker to...

GitLab: [Markdown] Stored XSS via character encoding parser bypass

Hi @briann and team, A carefully crafted injection used against the Markdown input parser can be leveraged to store and execute arbitrary JavaScript on GitLab 10.0 hosts. Given the nature of this injection, which makes use of a rather esoteric filter bypass, the scope for exploitation may vary...