U.S. Dept Of Defense: Unauthorized Access to Internal Server Panel without Authentication

The server can be accessed without any authentication and it contains information that should not be kept public for anyone. I advice you to take look if this data are sensitive or not! References ███████ Impact There might be sensitive info that should not have to be leaked to public. System Hos...

Exploit for CVE-2022-26646

Tittle: Online Banking System LFI. Author: Erik451 C...

GHSA-Q24H-5RQ3-63J9 Incorrect Authorization in @uppy/companion

@uppy/companion prior to version 3.3.1 is vulnerable to incorrect authorization. A user with URL upload access could enumerate internal companion server networks, send local webservers files to the destination server, and finally download them If each of these files had a guessable and regular na...

PT-2021-22481 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone versions prior to 1.2.0 Description: The issue allows an attacker to access internal server-to-server RPC endpoints, enabling them to download raw data from Datanode and Ozone manager, and modify Ratis replication configuration...

TIBCO Partnerexpress 安全漏洞

TIBCO Partnerexpress is a Php-based platform that generates barcodes by product name from TIBCO USA. A security vulnerability exists in the internal server and gateway server components of TIBCO PartnerExpress, versions 6.2.1 and below, which can be exploited by an attacker to perform a...

Eyoucms Server Side Request Forgery (CVE-2021-39497)

A sever-side request forgery vulnerability exists in Eyoucms. The vulnerability is due to a lack of validation on the subdomain parameter in HTTP requests. Successful exploitation of this vulnerability could allow an unauthenticated attacker to make a request to any internal and external server...

Unable to add Store in Native Workspace/Receiver App from External Machines

On adding Store error "Your account cannot be added" or "Could not detect the specific account" appears On Storefront no errors in event viewer Wireshark trace on NetScaler shows, NetScaler senta request to Storefront server for "/Agservices/Discover", storefront server returns "500 : Internal...

CVE-2021-33705

The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery SSRF vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request e.g. POST, G...

CVE-2021-28910

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server...

CVE-2021-28910

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server...

CVE-2021-22255

SSRF in URL file upload in Baserow 1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address...

Design/Logic Flaw

SSRF in URL file upload in Baserow 1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address...

CVE-2021-22255

SSRF in URL file upload in Baserow 1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address...

CVE-2021-33213

An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address...

CVE-2021-33213

The CVE-2021-33213 entry documents an SSRF in Elements-IT HTTP Commander 5.3.3, specifically in the Upload from URL feature. When authenticated, an attacker can supply an internal address to retrieve HTTP/FTP resources from the internal network, exposing internal resources. Root cause: SSRF in th...

CVE-2021-33213

An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address...

CVE-2020-15384

Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header...

Http/1.1 Internal Server Error 43531 Error after upgrading to Citrix Gateway 13.0 71.44 and 12.1 60.16

After successful authentication on Citrix Gateway, the enumeration of the published application failed with the error below: Http/1.1 Internal Server Error 43531...

in utmsigep/member-directory

✍️ Description Entering unintended values during the member creation flow causes unusual database state, unhandled exceptions/stack trace disclosure and denial of service due to continuous page crashes. 🕵️‍♂️ Proof of Concept - Select a member-status/group - Create New Member - Enter an invalid...

UPchieve: User enumeration through forget password

Vulnerability:- -User enumeration is possible through forgot password feature. steps to reproduce:- -Go to the above selected domain and go to forgot password. -submit random email and then intercept request by burp suit -in response you will get HTTP/1.1 500 Internal Server Error with "err":"No...