6672 matches found
CVE-CVE-2025-25231
CVE-2025-25231 Nuclei Template This template is written for the Nuclei tool to detect the CVE-2025-25231 Secondary Path Traversal vulnerability in the Omnissa Workspace ONE UEM product. Vulnerability Description CVE-2025-25231 is a Path Traversal vulnerability that allows an attacker to access...
CVE-2022-22954
CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file | manual -i IP,...
hekate
Hekate - A VMWare Workspace ONE Access Remote Code Execution Exploit Steven Seeley of Qihoo 360 Vulnerability Research Institute Original rogue MySQL server by LandGrey Details Hekate is pronounced as heh-ka-teh Date: Tue Feb 22 13:37:00 CST 2022 Version: 21.08.0.1 latest File:...
CVE-2022-22954-PoC
CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file | manual -i IP,...
CVE-2021-22054
CVE-2021-22054 Generate SSRF payloads References https://blog.assetnote.io/2022/04/27/advisory-vmware-workspace-one-uem/ https://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf/ Examples generate POC python3 ssrf.py --url https://target.com --url https://example.com --airwatch python3...
Awesome-BEC
Awesome-BEC Repository of attack and defensive information for Business Email Compromise investigations Office365/AzureAD ATT&CK O365 ATT&CK Azure Microsoft Azure Threat Research Matrix Microsoft 365 Licensing Microsoft Portals Azure App IDs Microsoft First Party App IDs & Graph Permissions...
bugbounty-lab101
██████╗ ███████╗██╗ ██╗ ██╗ ██████╗ ██╗██╗ ██╗ ██╔══██╗██╔════╝██║ ██║███║██╔═████╗███║╚██╗██╔╝ ██║ ██║█████╗ ██║ ██║╚██║██║██╔██║╚██║ ╚███╔╝ ██║ ██║██╔══╝ ╚██╗ ██╔╝ ██║████╔╝██║ ██║ ██╔██╗ ██████╔╝███████╗ ╚████╔╝ ██║╚██████╔╝ ██║██╔╝ ██╗ ╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═════╝ ╚═╝╚═╝ ╚═╝ BUG BOUNTY...
ALFA
ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...
CVE-2022-22954
CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file | manual -i IP,...
Cartero
Cartero Cartero is now a Go CLI with an embedded, no-configuration workspace database instead of the old MongoDB-dependent runtime. The current implementation provides: a polished terminal experience powered by Cobra and Lip Gloss a local admin web UI and safe testing pages via cartero serve...
ScubaGoggles
Developed by CISA, ScubaGoggles is an assessment tool that verifies a Google Workspace GWS organization's configuration conforms to the policies described in the Secure Cloud Business Applications SCuBA Secure Configuration Baseline documents. For the Microsoft 365 M365 rendition of this tool, se...
GDir-Thief
GDir-Thief Red Team tool for exfiltrating the target organization's Google People Directory that you have access to, via Google's People API. HOW TO Create a new Google Cloud Platform GCP project Steps to get the Google API Access Token needed for connecting to the API 1. Create a burner...
CVE-2022-22972
CVE-2022-22972 POC for CVE-2022-22972 affecting VMware Workspace ONE, vIDM, and vRealize Automation 7.6. Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...
CVE-2026-46558
CVE-2026-46558 Plane’s V2 asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces. Intro I found this issue while reviewing Plane , the open-source project...
CVE-2022-22954_VMware_PoC
CVE-2022-22954 PoC - VMware Workspace ONE Access Freemarker Server-Side Template Injection A vulnerability, which was classified as very critical, was found in Vmware Workspace ONE Access and Identity Manager. Affected component is Template Handler. Reference: https://vuldb.com/?id.196644 Usage:...
VMware Workspace ONE Access - Authentication Bypass
VMware Workspace ONE Access has two authentication bypass vulnerabilities CVE-2022-22955 & CVE-2022-22956 in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework. id: CVE-2022-22956...
Dashy <= 4.3.6 - Reflected XSS via Workspace
Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...
VMWare_CVE-2022-22954
VMWareCVE-2022-22954 CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspace ONE Access and Identity Manager Shodan Search result PoC Follow Youtube Twitter Telegram LinkedIn...
HiddenSteps
Core crates — implementation status This is the honest, current-state complement to docs/design/02-system-architecture.md's target module map. It says what's actually built, what's verified against a real backend vs. a mock, and what's still genuinely missing — not what's planned that's...