TCASVS

OWASP Thick Client アプリケーションセキュリティ検証標準 TCASVS はじめに OWASP Thick Client Application Security Verification Standard TCASVS は、シッククライアントアプリケーション（デスクトップソフトウェア、ネイティブアプリケーション、ブラウザのサンドボックス外で実行されるその他のローカル実行プログラム）の設計、構築、テストのための包括的なセキュリティ要件セットを提供します。 TCASVS は、Web アプリケーション向けの OWASP Application Security...

MITM_Intercept

MITMIntercept Burp 및 기타 도구를 통해 SSL 및 TLS 가로채기 지원으로 비HTTP 프로토콜을 가로채고 수정하는 약간 덜 해킹적인 방법입니다. 이 도구는 연구원 및 두꺼운 클라이언트 보안 평가를 수행하는 응용 침투 테스터를 위한 것입니다. mitmrelay 프로젝트의 개선된 버전입니다. 이야기 CyberArk Labs 연구 부서의 작업의 일환으로, 우리는 TCP를 통한 SSL 및 TLS 통신을 검사하고 패킷 콘텐츠를 즉석에서 수정할 수 있는 방법이 필요했습니다. 이를 위한 많은 방법이 있습니다예를 들어, 잘...

CVE-2023-23397

CVE-2023-23397 Outlook 씩 클라이언트에 영향을 미치는 CVE-2023-23397 취약점의 간단하고 조잡한 PoC입니다. 설명 Outlook은 회의 및 약속 알림의 소리를 구성할 수 있는 사용자 입력을 제어하지 못하는 문제를 겪고 있습니다. 실제로 공격자는 사용자의 조작 없이 피해자가 자신의 서버에 연결하도록 강제할 수 있습니다 제로 클릭 취약점. 이 취약점을 악용하는 공격자는 SMB 요청을 통해 트래핑된 사용자의 비밀번호를 기반으로 NetNTLMv2 다이제스트를 검색합니다. 메일이 받은 편지함에 도착하자마자...

Thick-Client-Pentest-Checklist

シッククライアントペネトレーションテストチェックリスト OWASPベースのチェックリスト 🌟🌟 80以上のテストケース 🚀🚀 Notion link: https://hariprasaanth.notion.site/THICK-CLIENT-PENTESTING-CHECKLIST-35c6803f26eb4c9d89ba7f5fdc901fb0 情報収集 情報収集 アプリケーションアーキテクチャ（2層または3層）を特定する 使用されている技術（言語とフレームワーク）を特定する ネットワーク通信を特定する アプリケーションプロセスを観察する アプリケーションの各機能と動作を観察する...

CVE-2024-46505

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

CVE-2024-12530: Uncontrolled Search Path Element

Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager: 23.4. End-users can potentially exploit the vulnerability to execute malicious code in the trusted context of the thick-client applicatio...

CVE-2024-46505

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

PT-2025-2738 · Infoblox · Infoblox Bloxone

Name of the Vulnerable Software and Affected Versions: Infoblox BloxOne version 2.4 Description: A business logic flaw was discovered due to thick client vulnerabilities. Recommendations: For Infoblox BloxOne version 2.4, consider restricting access to the thick client until a patch is available...

CVE-2024-46505

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

CVE-2024-46505

A business logic flaw exists in Infoblox BloxOne v2.4 due to thick client vulnerabilities . This vulnerability could lead to high impact on integrity and availability, as indicated by its CRITICAL severity rating. While specific technical exploit details are not provided in the documents, the fla...

CVE-2024-46505: Incorrect Default Permissions

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

CVE-2024-46505

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

CVE-2023-49312

Precision Bridge PrecisionBridge.exe aka the thick client before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address...

CVE-2023-49312

Precision Bridge PrecisionBridge.exe aka the thick client before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address...

NCH Express Invoice 7.25 Cleartext Password

Exploit Title: NCH Express Invoice - Clear Text Password Storage and Account Takeover Google Dork:: intitle:ExpressInvoice - Login Date: 07/Apr/2020 Exploit Author: Tejas Nitin Pingulkar https://cvewalkthrough.com/ Vendor Homepage: https://www.nchsoftware.com/ Software Link:...

CVE-2019-12476: Weak Password Recovery Mechanism for Forgotten Password

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

ERS Data System 1.8.1 - Java Deserialization Exploit

Exploit for windows platform in category remote exploits Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0...

ERS Data System 1.8.1 Java Deserialization

Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0 Tested on: Windows 7 x86 CVE : CVE-2017-14702 Description: E...

ERS Data System 1.8.1 - Java Deserialization

ERS Data System 1.8.1 - Java Deserialization Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0 Tested on:...

ERS Data System 1.8.1 - Java Deserialization

Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0 Tested on: Windows 7 x86 CVE : CVE-2017-14702 Description: E...