Unrestricted File Upload

Unrestricted file upload vulnerability occurs when the application suffers from a lack of validation of files being uploaded to its filesystem. When an attacker is able to upload files not matching the application expectations in terms of names, type, content or size, it could lead to various...

Concrete CMS Login Panel Detected

Concrete CMS Login Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No source...

Progress Telerik Report Server Authentication Bypass

Progress Telerik Report Server version prior to 2024 Q1 10.0.24.305 is vulnerable to authentication bypass and an insecure deserialization, allowing an unauthenticated attacker to execute code remotely via a specially forged request. No source data...

Client Certificate Authentication Detected

This is an informational notice that the scanner was able to detect that the target requires a client certificate authentication. No source data...

Insecure Redirect Chain

The scanner encountered one or more insecure redirects during the application crawl which means the redirection chain is not fully done with HTTPS. During an insecure redirection anyone could establish a man-in-the-middle attack against the remote host. No source data...

Vmware vRealize Network Insight Command Injection

Vmware vRealize Network Insight version 6.2 6.10 are vulnerable to a Command Injection vulnerability. A remote unauthenticated attacker can perform remote code execution via a specially crafted request. No source data...

IBM Aspera Faspex < 4.4.2 PL2 Remote Code Execution

IBM Aspera Faspex versions before 4.4.2 patch level 2 suffer from a YAML deserialization issue. By crafting a specific payload on a specific API path, a remote and unauthenticated attacker can achieve remote code execution on the target instance. No source data...

Request URL Override

Web application components can sometimes rely on request HTTP headers like 'X-Original-URL' or 'X-Rewrite-URL' to override the original path of this request. Attackers can leverage this vulnerability to conduct further attacks in order to bypass restrictions or conduct cache poisonning attacks. N...

Quarkus DevMode Enabled

Quarkus installed on the remote host is configured to operate in development mode devMode. While this environment can help speed up development of web applications, it can leak information about the underlying web applications. No source data...

Apache Superset < 2.1.0 Hardcoded Secret Key

Apache Superset versions prior to 2.1.0 uses a default secret to sign cookies. An unauthenticated attacker can use this default value to forge a cookie and authenticate himself as administrator. No source data...

Adobe ColdFusion < 2021 Update 12 / < 2023 Update 6 Cross-Site Scripting

Adobe ColdFusion prior to versions 2021 Update 12 or 2023 Update 6, suffer from a Cross-Site Scripting vulnerability through a specially forged URL. No source data...

Authentication Check Pattern Found in Unauthenticated Browser

This is an informational notice that the scanner was able to find the authentication check pattern using an unauthenticated browser. This indicates that the scanner cannot validate if authentication was successful. No source data...

Adobe ColdFusion < 2021 Update 12 / < 2023 Update 6 Remote Code Execution

Adobe ColdFusion prior to versions 2021 Update 12 or 2023 Update 6, suffer from an Insecure Deserialization vulnerability through the argumentCollection parameter on /CFIDE/wizards/common/utils.cfc endpoint. By leveraging this vulnerability, a remote unauthenticated attacker could achieve a remot...

Sangfor NGAF Authentication Bypass

Sangfor NGAF are vulnerable to an Authentication Bypass allowing a remote to perform various unauthorized actions with a specially crafted HTTP request. Exploiting this vulnerability can lead to a Remote Code Execution. No source data...

Serialized Data Detected

Serialization is the process of converting an object to a stream of bytes, in order to store or send it through the network. By opposition, deserialization is the process of reconstructing an object from this stream of bytes. Web applications often use serialized data transmitted from the client...

CVE-2023-52461

creationtimestamp| type| source ---|---|--- 2024-02-23 16:32:00+00:00| seen| https://t.me/ctinow/191876 2024-02-24 12:46:27+00:00| seen| https://t.me/ctinow/192568...

GraphQL Batching

GraphQL engines sometimes support combining a group of requests into a single one to try optimizing network performances between the client and the GraphQL server. When supported and enabled, this feature implementation should be reviewed as it could be abused by an attacker to bypass application...

Microsoft Entra ID Detected

This is an informational notice that the scanner was able to detect that the target application is using Microsoft Entra ID. No source data...

Google Cloud Platform Detected

This is an informational notice that the scanner was able to detect that the target application is using an Google Cloud cloud service. No source data...

Amazon Web Services Detected

This is an informational notice that the scanner was able to detect that the target application is using an Amazon Web Services cloud service. No source data...