Dashboard Content Enhancements (#4191)

Dashboard Content Enhancements
2022-04-21 17:16:41 -04:00 · 2022-04-21 17:16:41 -04:00 · 31312b1c19
parent 20ba9176a3
commit 31312b1c19
45 changed files with 302 additions and 147 deletions
--- a/cves/2009/CVE-2009-0545.yaml
+++ b/cves/2009/CVE-2009-0545.yaml
@ -3,8 +3,10 @@ id: CVE-2009-0545
 info:
  name: ZeroShell <= 1.0beta11 Remote Code Execution
  author: geeknik
-  description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
-  reference: https://www.exploit-db.com/exploits/8023
+  description: "ZeroShell 1.0beta11 and earlier via cgi-bin/kerbynet allows remote attackers to execute arbitrary commands through shell metacharacters in the type parameter in a NoAuthREQ x509List action."
+  reference:
+    - https://www.exploit-db.com/exploits/8023
+    - https://nvd.nist.gov/vuln/detail/CVE-2009-0545
  severity: critical
  classification:
    cve-id: CVE-2009-0545
@ -20,3 +22,5 @@ requests:
        part: body
        regex:
          - "root:.*:0:0:"
+
+# Enhanced by mp on 2022/04/18
--- a/cves/2015/CVE-2015-2080.yaml
+++ b/cves/2015/CVE-2015-2080.yaml
@ -1,21 +1,21 @@
 id: CVE-2015-2080

 info:
-  name: Eclipse Jetty Remote Leakage
+  name: Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage
  author: pikpikcu
  severity: high
+  description: "Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header."
  reference:
    - https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
    - https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
    - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
-  description: |
-    The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
-  tags: cve,cve2015,jetty
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-2080
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.50
    cve-id: CVE-2015-2080
    cwe-id: CWE-200
+  tags: cve,cve2015,jetty

 requests:
  - method: POST
@ -33,3 +33,5 @@ requests:
        words:
          - "Illegal character 0x0 in state"
        part: body
+
+# Enhanced by mp on 2022/04/21
--- a/cves/2015/CVE-2015-9480.yaml
+++ b/cves/2015/CVE-2015-9480.yaml
@ -1,19 +1,19 @@
 id: CVE-2015-9480

 info:
-  name: WordPress Plugin RobotCPA 5 - Directory Traversal
+  name: WordPress RobotCPA 5 - Directory Traversal
  author: daffainfo
  severity: high
+  description: "The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter."
  reference:
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9480
    - https://www.exploit-db.com/exploits/37252
-  tags: cve,cve2015,wordpress,wp-plugin,lfi
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-9480
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.50
    cve-id: CVE-2015-9480
    cwe-id: CWE-22
-  description: "The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter."
+  tags: cve,cve2015,wordpress,wp-plugin,lfi

 requests:
  - method: GET
@ -29,3 +29,6 @@ requests:
      - type: status
        status:
          - 200
+
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2017/CVE-2017-10271.yaml
+++ b/cves/2017/CVE-2017-10271.yaml
@ -1,7 +1,7 @@
 id: CVE-2017-10271

 info:
-  name: Oracle WebLogic Server Component Remote Command Execution
+  name: Oracle Fusion Middleware WebLogic Server - Remote Command Execution
  author: dr_set
  severity: high
  description: The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to component deserialization remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Unauthenticated attackers with network access via T3 can leverage this vulnerability to compromise Oracle WebLogic Server.
@ -62,4 +62,5 @@ requests:
        status:
          - 500

-# Enhanced by mp on 2022/04/05
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2017/CVE-2017-16806.yaml
+++ b/cves/2017/CVE-2017-16806.yaml
@ -3,15 +3,17 @@ id: CVE-2017-16806
 info:
  name: Ulterius Server < 1.9.5.0 - Directory Traversal
  author: geeknik
-  reference: https://www.exploit-db.com/exploits/43141
+  description: "Ulterius before 1.9.5.0 allows HTTP server directory traversal via the process function in RemoteTaskServer/WebServer/HttpServer.cs."
+  reference:
+    - https://www.exploit-db.com/exploits/43141
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-16806
  severity: high
-  tags: cve,cve2017,ulterius,traversal
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.50
    cve-id: CVE-2017-16806
    cwe-id: CWE-22
-  description: "The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal."
+  tags: cve,cve2017,ulterius,traversal

 requests:
  - method: GET
@ -30,3 +32,5 @@ requests:
          - "\\[(font|extension|file)s\\]"
        condition: or
        part: body
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2017/CVE-2017-3506.yaml
+++ b/cves/2017/CVE-2017-3506.yaml
@ -1,7 +1,7 @@
 id: CVE-2017-3506

 info:
-  name: Oracle Weblogic Remote OS Command Execution
+  name: Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
  author: pdteam
  description: The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.
  severity: high
@ -45,4 +45,5 @@ requests:
        words:
          - "http"

-# Enhanced by mp on 2022/04/05
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2017/CVE-2017-9805.yaml
+++ b/cves/2017/CVE-2017-9805.yaml
@ -1,20 +1,20 @@
 id: CVE-2017-9805

 info:
-  name: Apache Struts2 S2-052 RCE
+  name: Apache Struts2 S2-052 - Remote Code Execution
  author: pikpikcu
  severity: high
-  description: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to Remote Code Execution when deserializing XML payloads.
-  remediation: Apply the appropriate patch.
+  description: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to remote code execution when deserializing XML payloads.
  reference:
    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
    - https://struts.apache.org/docs/s2-052.html
-  tags: cve,cve2017,apache,rce,struts
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-9805
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.10
    cve-id: CVE-2017-9805
    cwe-id: CWE-502
+  tags: cve,cve2017,apache,rce,struts

 requests:
  - method: POST
@ -95,4 +95,5 @@ requests:
        status:
          - 500

-# Enhanced by mp on 2022/02/04
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2018/CVE-2018-14912.yaml
+++ b/cves/2018/CVE-2018-14912.yaml
@ -1,9 +1,10 @@
 id: CVE-2018-14912
+
 info:
  name: cgit < 1.2.1 Directory Traversal
  author: 0x_Akoko
  severity: critical
-  description: cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
+  description: "cGit < 1.2.1 via cgit_clone_objects has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request."
  reference:
    - https://cxsecurity.com/issue/WLB-2018080034
    - https://nvd.nist.gov/vuln/detail/CVE-2018-14912
@ -28,3 +29,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/18
--- a/cves/2018/CVE-2018-19365.yaml
+++ b/cves/2018/CVE-2018-19365.yaml
@ -1,9 +1,10 @@
 id: CVE-2018-19365
+
 info:
-  name: Wowza Streaming Engine Manager Directory Traversal
+  name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
  author: 0x_Akoko
  severity: high
-  description: The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request
+  description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API.
  reference:
    - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html
    - https://www.cvedetails.com/cve/CVE-2018-19365
@ -29,3 +30,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2018/CVE-2018-2791.yaml
+++ b/cves/2018/CVE-2018-2791.yaml
@ -1,7 +1,7 @@
 id: CVE-2018-2791

 info:
-  name: Oracle WebCenter Sites Cross-Site Scripting
+  name: Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting
  author: madrobot,leovalcante
  severity: high
  description: The Oracle WebCenter Sites component of Oracle Fusion Middleware is susceptible to multiple instances of cross-site scripting that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites. Impacted versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data.
@ -43,4 +43,5 @@ requests:
          - 'Missing translation key'
        condition: and

-# Enhanced by mp on 2022/04/06
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2018/CVE-2018-3238.yaml
+++ b/cves/2018/CVE-2018-3238.yaml
@ -1,7 +1,7 @@
 id: CVE-2018-3238

 info:
-  name: Oracle WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting
+  name: Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting
  author: leovalcante
  severity: high
  description: The Oracle WebCenter Sites 11.1.1.8.0 component of Oracle Fusion Middleware is impacted by easily exploitable cross-site scripting vulnerabilities that allow high privileged attackers with network access via HTTP to compromise Oracle WebCenter Sites.
@ -44,4 +44,4 @@ requests:
          - 'Variables.cs_imagedir'
        condition: and

-# Enhanced by mp on 2022/04/14
+# Enhanced by mp on 2022/04/20
--- a/cves/2018/CVE-2018-7662.yaml
+++ b/cves/2018/CVE-2018-7662.yaml
@ -1,17 +1,19 @@
 id: CVE-2018-7662

 info:
-  name: CouchCMS Full Path Disclosure
+  name: CouchCMS <= 2.0 - Full Path Disclosure
  author: ritikchaddha
  severity: medium
-  description: phpmailer.php and mysql2i.func.php disclosure the full path
-  reference: https://github.com/CouchCMS/CouchCMS/issues/46
-  tags: couchcms,fpd,cve,cve2018
+  description: "CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php."
+  reference:
+    - https://github.com/CouchCMS/CouchCMS/issues/46
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-7662
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.30
    cve-id: CVE-2018-7662
    cwe-id: CWE-200
+  tags: couchcms,fpd,cve,cve2018

 requests:
  - method: GET
@ -35,3 +37,6 @@ requests:
          - "phpmailer.php on line 10"
          - "Fatal error: Call to a menber function add_event_listener() on a non-object in"
        condition: and
+
+
+# Enhanced by mp on 2022/04/21
--- a/cves/2019/CVE-2019-15713.yaml
+++ b/cves/2019/CVE-2019-15713.yaml
@ -1,19 +1,20 @@
 id: CVE-2019-15713

 info:
-  name: My Calendar <= 3.1.9 - Reflected Cross-Site Scripting (XSS)
+  name: WordPress My Calendar <= 3.1.9 - Cross-Site Scripting
  author: daffainfo,dhiyaneshDk
  severity: medium
-  description: The my-calendar plugin before 3.1.10 for WordPress has XSS. Triggered via unescaped usage of URL parameters in multiple locations presented in the public view of a site.
+  description: WordPress plugin My Calendar <= 3.1.9 is susceptible to reflected cross-site scripting which can be triggered via unescaped usage of URL parameters in multiple locations throughout the site.
  reference:
    - https://wpscan.com/vulnerability/9267
+    - https://wordpress.org/plugins/my-calendar/#developers
    - https://nvd.nist.gov/vuln/detail/CVE-2019-15713
-  tags: cve,cve2019,wordpress,xss,wp-plugin
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.10
    cve-id: CVE-2019-15713
    cwe-id: CWE-79
+  tags: cve,cve2019,wordpress,xss,wp-plugin

 requests:
  - method: GET
@ -35,3 +36,6 @@ requests:
      - type: status
        status:
          - 200
+
+
+# Enhanced by mp on 2022/04/21
--- a/cves/2019/CVE-2019-16097.yaml
+++ b/cves/2019/CVE-2019-16097.yaml
@ -1,19 +1,22 @@
 id: CVE-2019-16097
+
 info:
-  name: Harbor Enables Privilege Escalation From Zero to admin
+  name: Harbor <=1.82.0 - Privilege Escalation
  author: pikpikcu
  severity: medium
-  description: |
-    core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
+  description: "Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via
+    core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration."
+  remediation: Upgrade to v1.7.6 v1.8.3. v.1.9.0 or higher. A potential workaround without applying the fix is to configure Harbor to use a non-DB authentication backend such as LDAP.
  reference:
    - https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/
    - https://github.com/goharbor/harbor/issues/8951
-  tags: cve,cve2019,intrusive,harbor
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-16097
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 6.50
    cve-id: CVE-2019-16097
    cwe-id: CWE-862
+  tags: cve,cve2019,intrusive,harbor

 requests:
  - method: POST
@ -38,3 +41,5 @@ requests:
          - 201
          - 409
        condition: or
+
+# Enhanced by mp on 2022/04/19
--- a/cves/2019/CVE-2019-7481.yaml
+++ b/cves/2019/CVE-2019-7481.yaml
@ -1,19 +1,19 @@
 id: CVE-2019-7481

 info:
-  name: sonicwall sra 4600 vpn pre-authenticated sql injection
+  name: SonicWall SRA 4600 VPN - SQL Injection
  author: _darrenmartyn
  severity: high
-  description: |
-    The SonicWall SRA 4600 VPN appliance suffers a pre-authentication SQL injection vulnerability.
+  description: The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability.
  reference:
    - https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/
-  tags: cve,cve2019,sonicwall,sqli
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-7481
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.50
    cve-id: CVE-2019-7481
-    cwe-id: CWE-200
+    cwe-id: CWE-89
+  tags: cve,cve2019,sonicwall,sqli

 requests:
  - raw:
@ -31,3 +31,6 @@ requests:
        words:
          - "4220397236"
        part: body
+
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2019/CVE-2019-8982.yaml
+++ b/cves/2019/CVE-2019-8982.yaml
@ -1,16 +1,19 @@
 id: CVE-2019-8982
+
 info:
-  name: Wavemaker Studio 6.6 LFI/SSRF
+  name: Wavemaker Studio 6.6 Local File Inclusion/Server-Side Request Forgery
  author: madrobot
  severity: critical
-  description: com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.
-  reference: https://www.exploit-db.com/exploits/45158
-  tags: cve,cve2019,wavemaker,lfi,ssrf
+  description: "WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value in com/wavemaker/studio/StudioService.java, leading to disclosure of local files and server-side request forgery."
+  reference:
+    - https://www.exploit-db.com/exploits/45158
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-8982
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 9.60
    cve-id: CVE-2019-8982
    cwe-id: CWE-918
+  tags: cve,cve2019,wavemaker,lfi,ssrf

 requests:
  - method: GET
@ -25,3 +28,5 @@ requests:
        regex:
          - "root:.*:0:0:"
        part: body
+
+# Enhanced by mp on 2022/04/18
--- a/cves/2020/CVE-2020-10549.yaml
+++ b/cves/2020/CVE-2020-10549.yaml
@ -1,18 +1,20 @@
 id: CVE-2020-10549
+
 info:
-  name: rConfig 3.9.4 SQLi
+  name: rConfig <=3.9.4 - SQL Injection
  author: madrobot
  severity: critical
-  description: rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
+  description: "rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices."
  reference:
    - https://github.com/theguly/exploits/blob/master/CVE-2020-10549.py
    - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
-  tags: cve,cve2020,rconfig,sqli
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-10549
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.80
    cve-id: CVE-2020-10549
    cwe-id: CWE-89,CWE-522
+  tags: cve,cve2020,rconfig,sqli

 requests:
  - method: GET
@ -27,3 +29,6 @@ requests:
        words:
          - "[project-discovery]"
        part: body
+
+
+# Enhanced by mp on 2022/04/21
--- a/cves/2020/CVE-2020-14883.yaml
+++ b/cves/2020/CVE-2020-14883.yaml
@ -1,7 +1,7 @@
 id: CVE-2020-14883

 info:
-  name: Oracle WebLogic Server Administration Console Remote Code Execution
+  name: Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
  author: pdteam
  severity: high
  description: The Oracle Fusion Middleware WebLogic Server admin console in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is vulnerable to an easily exploitable vulnerability that allows high privileged attackers with network access via HTTP to compromise Oracle WebLogic Server.
@ -54,4 +54,4 @@ requests:
        regex:
          - "(u|g)id=.*"

-# Enhanced by mp on 2022/04/05
+# Enhanced by mp on 2022/04/20
--- a/cves/2020/CVE-2020-15148.yaml
+++ b/cves/2020/CVE-2020-15148.yaml
@ -1,19 +1,20 @@
 id: CVE-2020-15148

 info:
-  name: Yii 2 (yiisoft/yii2) RCE
+  name: Yii 2 <2.0.38 - Remote Code Execution
  author: pikpikcu
  severity: critical
  reference:
    - https://blog.csdn.net/xuandao_ahfengren/article/details/111259943
    - https://github.com/nosafer/nosafer.github.io/blob/227a05f5eff69d32a027f15d6106c6d735124659/docs/Web%E5%AE%89%E5%85%A8/Yii2/%EF%BC%88CVE-2020-15148%EF%BC%89Yii2%E6%A1%86%E6%9E%B6%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md
-  tags: cve,cve2020,rce,yii
+  description: "Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input."
+  remediation: Upgrade to version 2.0.38 or later. A possible workaround without upgrading is available in the linked advisory.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.00
    cve-id: CVE-2020-15148
    cwe-id: CWE-502
-  description: "Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory."
+  tags: cve,cve2020,rce,yii

 requests:
  - method: GET
@ -31,3 +32,5 @@ requests:
      - type: status
        status:
          - 500
+
+# Enhanced by mp on 2022/04/19
--- a/cves/2020/CVE-2020-24186.yaml
+++ b/cves/2020/CVE-2020-24186.yaml
@ -1,7 +1,7 @@
 id: CVE-2020-24186

 info:
-  name: Unauthenticated File upload wpDiscuz WordPress plugin Remote Code Execution
+  name: WordPress wpDiscuz <=7.0.4 - Remote Code Execution
  author: Ganofins
  severity: critical
  description: WordPress wpDiscuz plugin versions  version 7.0 through 7.0.4 are susceptible to remote code execution. This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site's server.
@ -84,4 +84,5 @@ requests:
        condition: and
        part: body

-# Enhanced by mp on 2022/03/27
+
+# Enhanced by mp on 2022/04/19
--- a/cves/2020/CVE-2020-7796.yaml
+++ b/cves/2020/CVE-2020-7796.yaml
@ -1,18 +1,19 @@
 id: CVE-2020-7796

 info:
-  name: Zimbra Collaboration Suite (ZCS) - SSRF
+  name: Zimbra Collaboration Suite (ZCS) - Server-Side Request Forgery
  author: gy741
  severity: critical
-  description: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
+  description: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 is susceptible to server-side request forgery when WebEx zimlet is installed and zimlet JSP is enabled.
  reference:
    - https://www.adminxe.com/2183.html
-  tags: cve,cve2020,zimbra,ssrf,oast
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-7796
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.80
    cve-id: CVE-2020-7796
    cwe-id: CWE-918
+  tags: cve,cve2020,zimbra,ssrf,oast

 requests:
  - raw:
@ -25,3 +26,5 @@ requests:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
+
+# Enhanced by mp on 2022/04/19
--- a/cves/2020/CVE-2020-9757.yaml
+++ b/cves/2020/CVE-2020-9757.yaml
@ -1,11 +1,10 @@
 id: CVE-2020-9757

 info:
-  name: SEOmatic < 3.3.0 Server-Side Template Injection
+  name: Craft CMS < 3.3.0 - Server-Side Template Injection
  author: dwisiswant0
  severity: high
-  description: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
-  tags: cve,cve2020,ssti
+  description: "Craft CMS before 3.3.0 is susceptible to server-side template injection via the SEOmatic component that could lead to remote code execution via malformed data submitted to the metacontainers controller."
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.50
@ -16,6 +15,8 @@ info:
    - https://github.com/giany/CVE/blob/master/CVE-2020-9757.txt
    - https://github.com/nystudio107/craft-seomatic/commit/65ab659cb6c914c7ad671af1e417c0da2431f79b
    - https://github.com/nystudio107/craft-seomatic/commit/a1c2cad7e126132d2442ec8ec8e9ab43df02cc0f
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-9757
+  tags: cve,cve2020,ssti

 requests:
  - method: GET
@ -36,3 +37,5 @@ requests:
          - "22344"
        condition: and
        part: body
+
+# Enhanced by mp on 2022/04/20
--- a/cves/2021/CVE-2021-25074.yaml
+++ b/cves/2021/CVE-2021-25074.yaml
@ -1,17 +1,19 @@
 id: CVE-2021-25074

 info:
-  name: WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect
+  name: WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect
  author: dhiyaneshDk
  severity: medium
-  description: The plugin contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue.
-  reference: https://wpscan.com/vulnerability/f3c0a155-9563-4533-97d4-03b9bac83164
-  tags: cve,cve2021,wordpress,redirect,wp-plugin,webpconverter
+  description: "WordPress WebP Converter for Media < 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an open redirect issue."
+  reference:
+    - https://wpscan.com/vulnerability/f3c0a155-9563-4533-97d4-03b9bac83164
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25074
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.10
    cve-id: CVE-2021-25074
    cwe-id: CWE-601
+  tags: cve,cve2021,wordpress,redirect,wp-plugin,webpconverter

 requests:
  - method: GET
@ -23,3 +25,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by mp on 2022/04/21
--- a/cves/2021/CVE-2021-25112.yaml
+++ b/cves/2021/CVE-2021-25112.yaml
@ -1,20 +1,19 @@
 id: CVE-2021-25112

 info:
-  name: WHMCS Bridge < 6.4b - Authenticated Reflected XSS
+  name: WordPress WHMCS Bridge < 6.4b -  Cross-Site Scripting
  author: DhiyaneshDK
  severity: medium
-  description: |
-    The plugin does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
+  description: WordPress WHMCS Bridge < 6.4b is susceptible to authenticated reflected cross-site scripting because the plugin does not sanitize and escape the error parameter before outputting it back in admin dashboard.
  reference:
    - https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25112
-  tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.10
    cve-id: CVE-2021-25112
    cwe-id: CWE-79
+  tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated

 requests:
  - raw:
@ -47,3 +46,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/21
--- a/vulnerabilities/wordpress/easy-social-feed.yaml
+++ b/vulnerabilities/wordpress/easy-social-feed.yaml
@ -1,11 +1,15 @@
-id: easy-social-feed
+id: CVE-2021-25120

 info:
-  name: Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting (XSS)
+  name: Easy Social Feed < 6.2.7 - Cross-Site Scripting
  author: dhiyaneshDk
  severity: medium
-  description: The plugin does not sanitise and escape a parameter before outputting back in an admin dashboard page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged admin or editor.
-  reference: https://wpscan.com/vulnerability/6dd00198-ef9b-4913-9494-e08a95e7f9a0
+  description: Easy Social Feed < 6.2.7 is susceptible to reflected cross-site scripting because the plugin does not sanitize and escape a parameter before outputting it back in an admin dashboard page, leading to it being executed in the context of a logged admin or editor.
+  reference:
+    - https://wpscan.com/vulnerability/6dd00198-ef9b-4913-9494-e08a95e7f9a0
+    - https://www.cvedetails.com/cve/CVE-2021-25120/
+  classification:
+    cve-id: CVE-2021-25120
  tags: wordpress,wp-plugin,xss,authenticated

 requests:
@ -38,3 +42,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/21
--- a/cves/2021/CVE-2021-31805.yaml
+++ b/cves/2021/CVE-2021-31805.yaml
@ -1,18 +1,21 @@
 id: CVE-2021-31805
+
 info:
  name: Apache Struts2 S2-062 - Remote Code Execution
  author: taielab
  severity: critical
-  description: The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
+  description: "Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 (S2-061) was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax."
+  remediation: Avoid using forced OGNL evaluation on untrusted user input, and/or upgrade to Struts 2.5.30 or greater which checks if expression evaluation won't lead to the double evaluation.
  reference:
+    - https://cwiki.apache.org/confluence/display/WW/S2-062
    - https://github.com/Axx8/Struts2_S2-062_CVE-2021-31805
    - https://nvd.nist.gov/vuln/detail/CVE-2021-31805
-  tags: cve,cve2021,apache,rce,struts,struts2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.80
    cve-id: CVE-2021-31805
    cwe-id: CWE-917
+  tags: cve,cve2021,apache,rce,struts,struts2

 requests:
  - raw:
@ -44,3 +47,5 @@ requests:
        part: body
        regex:
          - "root:.*:0:0:"
+
+# Enhanced by mp on 2022/04/21
--- a/cves/2021/CVE-2021-32682.yaml
+++ b/cves/2021/CVE-2021-32682.yaml
@ -1,17 +1,16 @@
 id: CVE-2021-32682

 info:
-  name: elFinder - Multiple vulnerabilities leading to RCE
+  name: elFinder 2.1.58 - Remote Code Execution
  author: smaranchand
  severity: critical
-  tags: cve,cve2021,elfinder,misconfig,rce,oss
-  description: elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
+  description: elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration.
  reference:
    - https://smaranchand.com.np/2022/01/organization-vendor-application-security/
    - https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities
    - https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32682
-  remediation: Update to elFinder 2.1.59
+  remediation: Update to elFinder 2.1.59 or later. As a workaround, ensure the connector is not exposed without authentication.
  metadata:
    github: https://github.com/Studio-42/elFinder
  classification:
@ -19,6 +18,7 @@ info:
    cvss-score: 9.80
    cve-id: CVE-2021-32682
    cwe-id: CWE-22,CWE-78,CWE-918
+  tags: cve,cve2021,elfinder,misconfig,rce,oss

 requests:
  - method: GET
@ -45,3 +45,6 @@ requests:
      - type: status
        status:
          - 200
+
+
+# Enhanced by mp on 2022/04/19
--- a/cves/2021/CVE-2021-3377.yaml
+++ b/cves/2021/CVE-2021-3377.yaml
@ -1,19 +1,21 @@
 id: CVE-2021-3377

 info:
-  name: Ansi_up XSS
-  description: The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
+  name: npm ansi_up v4 - Cross-Site Scripting
+  description: npm package ansi_up v4 is vulnerable to cross-site scripting because ANSI escape codes can be used to create HTML hyperlinks.
+  remediation: Upgrade to v5.0.0 or later.
  reference:
    - https://doyensec.com/resources/Doyensec_Advisory_ansi_up4_XSS.pdf
    - https://github.com/drudru/ansi_up/commit/c8c726ed1db979bae4f257b7fa41775155ba2e27
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-3377
  author: geeknik
  severity: medium
-  tags: cve,cve2021,xss,npm
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.10
    cve-id: CVE-2021-3377
    cwe-id: CWE-79
+  tags: cve,cve2021,xss,npm

 requests:
  - raw:
@ -33,3 +35,5 @@ requests:
      - type: word
        words:
          - "com\"/onmouseover=\"alert(1)\">"
+
+# Enhanced by mp on 2022/04/21
--- a/cves/2021/CVE-2021-40539.yaml
+++ b/cves/2021/CVE-2021-40539.yaml
@ -1,22 +1,22 @@
 id: CVE-2021-40539

 info:
-  name: Zoho ManageEngine ADSelfService Plus version 6113 Unauthenticated RCE
+  name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution
  author: daffainfo,pdteam
  severity: critical
  description: Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution.
  remediation: Upgrade to ADSelfService Plus build 6114.
  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-40539
    - https://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis
    - https://www.synacktiv.com/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html
    - https://github.com/synacktiv/CVE-2021-40539
-  tags: cve,cve2021,rce,ad,intrusive,manageengine
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-40539
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.80
    cve-id: CVE-2021-40539
    cwe-id: CWE-287
+  tags: cve,cve2021,rce,ad,intrusive,manageengine

 requests:

@ -113,4 +113,5 @@ requests:
        status:
          - 200

-# Enhanced by mp on 2022/03/16
+
+# Enhanced by mp on 2022/04/18
--- a/cves/2021/CVE-2021-40978.yaml
+++ b/cves/2021/CVE-2021-40978.yaml
@ -1,20 +1,20 @@
 id: CVE-2021-40978

 info:
-  name: MKdocs 1.2.2 Directory Traversal
+  name: MKdocs 1.2.2 - Directory Traversal
  author: pikpikcu
  severity: high
  reference:
    - https://github.com/mkdocs/mkdocs/pull/2604
    - https://github.com/nisdn/CVE-2021-40978
    - https://nvd.nist.gov/vuln/detail/CVE-2021-40978
-  tags: cve,cve2021,mkdocs,lfi
  description: The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability (see references) because the dev server must be used in an unsafe way (namely public) to have this vulnerability exploited.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.50
    cve-id: CVE-2021-40978
    cwe-id: CWE-22
+  tags: cve,cve2021,mkdocs,lfi

 requests:
  - method: GET
@ -33,4 +33,4 @@ requests:
        status:
          - 200

-# Enhanced by mp on 2022/03/06
+# Enhanced by mp on 2022/04/20
--- a/cves/2022/CVE-2022-23881.yaml
+++ b/cves/2022/CVE-2022-23881.yaml
@ -1,20 +1,20 @@
 id: CVE-2022-23881

 info:
-  name: zzzphp v2.1.0 RCE
+  name: ZZZCMS zzzphp 2.1.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
-  description: ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
+  description: "ZZZCMS zzzphp v2.1.0 is susceptible to a remote command execution vulnerability via danger_key() at zzz_template.php."
  reference:
    - https://github.com/metaStor/Vuls/blob/main/zzzcms/zzzphp%20V2.1.0%20RCE/zzzphp%20V2.1.0%20RCE.md
    - http://www.zzzcms.com
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23881
-  tags: cve,cve2022,rce,zzzphp,zzzcms
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.80
    cve-id: CVE-2022-23881
    cwe-id: CWE-77
+  tags: cve,cve2022,rce,zzzphp,zzzcms

 requests:
  - raw:
@ -33,3 +33,6 @@ requests:
      - type: status
        status:
          - 500
+
+
+# Enhanced by mp on 2022/04/19
--- a/exposed-panels/opencast-detect.yaml
+++ b/exposed-panels/opencast-detect.yaml
@ -1,10 +1,10 @@
 id: opencast-panel

 info:
-  name: Opencast Panel Login
+  name: Opencast Admin Panel Discovery
  author: cyllective,daffainfo
  severity: info
-  description: The free and open source solution for automated video capture and distribution at scale.
+  description: An Opencast Admin panel was discovered. Opencast is a free and open source solution for automated video capture and distribution at scale.
  reference: https://github.com/opencast/opencast
  tags: panel,opencast

@ -23,3 +23,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/21
--- a/exposures/files/dwsync-exposure.yaml
+++ b/exposures/files/dwsync-exposure.yaml
@ -1,10 +1,15 @@
 id: dwsync-exposure

 info:
-  name: Dwsync.xml Exposure
+  name: Dreamweaver Dwsync.xml Exposure
  author: KaizenSecurity
  severity: info
-  description: The dwsync.xml file is a file generated by Dreamweaver. Where the file contains information related to what files are in the website directory.
+  description: The Dreamweaver file dwsync.xml was discovered. The dwsync.xml file is a file generated by Dreamweaver which contains information related to what files are in the website directory.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cve-id:
+    cwe-id: CWE-200
  tags: dwsync,exposure,dreamweaver

 requests:
@ -29,3 +34,5 @@ requests:
          - '<dwsync>'
          - '</dwsync>'
        condition: and
+
+# Enhanced by mp on 2022/04/21
--- a/misconfiguration/prometheus/prometheus-config.yaml
+++ b/misconfiguration/prometheus/prometheus-config.yaml
@ -1,10 +1,10 @@
 id: prometheus-config

 info:
-  name: Prometheus config API endpoint
+  name: Prometheus Config API Endpoint Discovery
  author: geeknik
  severity: info
-  description: The config endpoint returns the loaded Prometheus configuration file. This file also contains addresses of targets and alerting/discovery services alongside the credentials required to access them. Usually, Prometheus replaces the passwords in the credentials config configuration field with the placeholder <secret> (although this still leaks the username).
+  description: A Prometheus config API endpoint was discovered. The config endpoint returns the loaded Prometheus configuration file along with the addresses of targets and alerting/discovery services alongside the credentials required to access them. Usually, Prometheus replaces the passwords in the credentials config configuration field with the placeholder <secret> (although this still leaks the username).
  reference: https://jfrog.com/blog/dont-let-prometheus-steal-your-fire/
  tags: prometheus,config

@ -30,3 +30,5 @@ requests:
        part: header
        words:
          - 'application/json'
+
+# Enhanced by mp on 2022/04/21
--- a/misconfiguration/proxy/open-proxy-internal.yaml
+++ b/misconfiguration/proxy/open-proxy-internal.yaml
@ -1,9 +1,9 @@
 id: open-proxy-internal
+
 info:
  name: Open Proxy To Internal Network
  author: sullo
  severity: high
-  tags: exposure,config,proxy,misconfig,fuzz
  description: The host is configured as a proxy which allows access to other hosts on the internal network.
  remediation: Disable the proxy or restrict configuration to only allow access to approved hosts/ports.
  reference:
@ -14,6 +14,8 @@ info:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-441
+  tags: exposure,config,proxy,misconfig,fuzz
+
 requests:
  - raw:
      - |+
@ -107,4 +109,5 @@ requests:
          - (!contains(body_1, "ssh")) && (contains(body_2, "ssh") || contains(body_3, "ssh")) || contains(body_4, "ssh") || contains(body_5, "ssh") || contains(body_6, "ssh") || contains(body_7, "ssh") || contains(body_8, "ssh") || contains(body_9, "ssh") || contains(body_10, "ssh") || contains(body_11, "ssh") || contains(body_12, "ssh") || contains(body_13, "ssh") || contains(body_14, "ssh") || contains(body_15, "ssh") || contains(body_16, "ssh") || contains(body_17, "ssh") || contains(body_18, "ssh") || contains(body_19, "ssh") || contains(body_20, "ssh") || contains(body_21, "ssh") || contains(body_22, "ssh") || contains(body_23, "ssh") || contains(body_24, "ssh")
          - (!contains(body_1, "SSH")) && (contains(body_2, "SSH") || contains(body_3, "SSH")) || contains(body_4, "SSH") || contains(body_5, "SSH") || contains(body_6, "SSH") || contains(body_7, "SSH") || contains(body_8, "SSH") || contains(body_9, "SSH") || contains(body_10, "SSH") || contains(body_11, "SSH") || contains(body_12, "SSH") || contains(body_13, "SSH") || contains(body_14, "SSH") || contains(body_15, "SSH") || contains(body_16, "SSH") || contains(body_17, "SSH") || contains(body_18, "SSH") || contains(body_19, "SSH") || contains(body_20, "SSH") || contains(body_21, "SSH") || contains(body_22, "SSH") || contains(body_23, "SSH")
        condition: or
-# Enhanced by cs on 2022/02/14
+
+# Enhanced by mp on 2022/04/21
--- a/misconfiguration/proxy/open-proxy-localhost.yaml
+++ b/misconfiguration/proxy/open-proxy-localhost.yaml
@ -1,9 +1,9 @@
 id: open-proxy-http-portscan
+
 info:
-  name: Open Proxy to Other Web Ports on Proxy's localhost Interface
+  name: Open Proxy to Other Web Ports via Proxy's localhost Interface
  author: sullo
  severity: high
-  tags: exposure,config,proxy,misconfig,fuzz
  description: The host is configured as a proxy which allows access to web ports on the host's internal interface.
  remediation: Disable the proxy or restrict configuration to only allow access to approved hosts/ports.
  reference:
@ -14,6 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-441
+  tags: exposure,config,proxy,misconfig,fuzz
+
 requests:
  - raw:
      - |+
@ -51,4 +53,6 @@ requests:
          - (!contains(body_1, "Welcome to Windows") && !contains(body_2, "Welcome to Windows")) && (contains(body_3, "Welcome to Windows") || contains(body_4, "Welcome to Windows") || contains(body_5, "Welcome to Windows") || contains(body_6, "Welcome to Windows"))
          - (!contains(body_1, "Welcome to Windows") && !contains(body_2, "Welcome to Windows")) && (contains(body_3, "Welcome to Windows") || contains(body_4, "Welcome to Windows") || contains(body_5, "Welcome to Windows") || contains(body_6, "Welcome to Windows"))
          - (!contains(body_1, "It works") && !contains(body_2, "It works")) && (contains(body_3, "It works") || contains(body_4, "It works") || contains(body_5, "It works") || contains(body_6, "It works"))
-# Enhanced by cs on 2022/02/14
+
+
+# Enhanced by mp on 2022/04/21
--- a/misconfiguration/put-method-enabled.yaml
+++ b/misconfiguration/put-method-enabled.yaml
@ -1,11 +1,11 @@
 id: put-method-enabled

 info:
-  name: PUT method enabled
+  name: PUT Method Enabled
  author: xElkomy
  severity: high
  reference: https://portswigger.net/kb/issues/00100900_http-put-method-is-enabled
-  description: The PUT method is enabled on the web server, allowing for arbitrary file uploads.
+  description: The HTTP PUT method is normally used to upload data that is saved on the server at a user-supplied URL. If enabled, an attacker may be able to place arbitrary, and potentially malicious, content into the application. Depending on the server's configuration, this may lead to compromise of other users (by uploading client-executable scripts), compromise of the server (by uploading server-executable code), or other attacks.
  tags: injection

 requests:
@ -27,3 +27,6 @@ requests:
      - type: dsl
        dsl:
          - 'contains(body_2, "{{randstr}}")'
+
+
+# Enhanced by mp on 2022/04/20
--- a/misconfiguration/zabbix-dashboards-access.yaml
+++ b/misconfiguration/zabbix-dashboards-access.yaml
@ -8,12 +8,12 @@ info:
  reference:
    - https://www.exploit-db.com/ghdb/5595
    - https://packetstormsecurity.com/files/163657/zabbix5x-sqlxss.txt
+  tags: zabbix,unauth
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
    cvss-score: 5.8
    cve-id:
    cwe-id: CWE-522
-  tags: zabbix,unauth

 requests:
  - method: GET
--- a/network/vnc-detect.yaml
+++ b/network/vnc-detect.yaml
@ -3,8 +3,14 @@ info:
  name: VNC Service Detection
  author: pussycat0x
  severity: info
+  description: A Virtual Network Computing (VNC) service was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cve-id:
+    cwe-id: CWE-200
  tags: network,vnc,service
-  description: VNC service detection
+
 network:
  - inputs:
      - data: "\r\n"
@ -22,3 +28,5 @@ network:
        part: body
        regex:
          - "RFB ([0-9.]+)"
+
+# Enhanced by mp on 2022/04/20
--- a/vulnerabilities/other/beward-ipcamera-disclosure.yaml
+++ b/vulnerabilities/other/beward-ipcamera-disclosure.yaml
@ -1,13 +1,18 @@
 id: beward-ipcamera-disclosure

 info:
-  name: BEWARD N100 H.264 VGA IP Camera M2.1.6 Arbitrary File Disclosure
+  name: BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure
  author: geeknik
  severity: high
-  description: The N100 compact color IP camera suffers from an authenticated file disclosure vulnerability. Input passed via the READ.filePath parameter in fileread script is not properly verified before being used to read files. This can be exploited to disclose the contents of arbitrary files via absolute path or via the SendCGICMD API.
+  description: "The N100 compact color IP camera suffers from an authenticated file disclosure vulnerability. Input passed via the READ.filePath parameter in fileread script is not properly verified before being used to read files. This can be exploited to disclose the contents of arbitrary files via absolute path or via the SendCGICMD API."
  reference:
    - https://www.exploit-db.com/exploits/46320
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5511.php
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
+    cve-id:
+    cwe-id: CWE-22
  tags: iot,camera,disclosure

 requests:
@ -26,3 +31,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/20
--- a/vulnerabilities/other/qihang-media-lfi.yaml
+++ b/vulnerabilities/other/qihang-media-lfi.yaml
@ -1,11 +1,16 @@
 id: qihang-media-lfi

 info:
-  name: QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Arbitrary File Disclosure Vulnerability
+  name: QiHang Media Web (QH.aspx) Digital Signage 3.0.9 - Arbitrary File Disclosure
  author: gy741
  severity: high
-  description: The QiHang Media Web application suffers from an unauthenticated file disclosure vulnerability when input passed thru the filename parameter when using the download action or thru path parameter when using the getAll action is not properly verified before being used. This can be exploited to disclose contents of files and directories from local resources.
+  description: "The QiHang Media Web application suffers from an unauthenticated file disclosure vulnerability when input passed thru the filename parameter when using the download action or thru path parameter when using the getAll action is not properly verified before being used. This can be exploited to disclose contents of files and directories from local resources."
  reference: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5581.php
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
+    cve-id:
+    cwe-id: CWE-22
  tags: qihang,lfi,disclosure

 requests:
@ -33,3 +38,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/20
--- a/vulnerabilities/thinkphp/thinkphp-509-information-disclosure.yaml
+++ b/vulnerabilities/thinkphp/thinkphp-509-information-disclosure.yaml
@ -1,10 +1,10 @@
 id: thinkphp-509-information-disclosure

 info:
-  name: ThinkPHP 5.0.9 Information Disclosure
+  name: ThinkPHP 5.0.9 - Information Disclosure
  author: dr_set
  severity: critical
-  description: Verbose SQL error message reveals sensitive information including database credentials.
+  description: ThinkPHP 5.0.9 includes verbose SQL error message that can reveal sensitive information including database credentials.
  reference: https://github.com/vulhub/vulhub/tree/0a0bc719f9a9ad5b27854e92bc4dfa17deea25b4/thinkphp/in-sqlinjection
  tags: thinkphp

@ -24,3 +24,6 @@ requests:
      - type: status
        status:
          - 500
+
+
+# Enhanced by mp on 2022/04/20
--- a/vulnerabilities/wordpress/candidate-application-lfi.yaml
+++ b/vulnerabilities/wordpress/candidate-application-lfi.yaml
@ -1,11 +1,16 @@
 id: candidate-application-lfi

 info:
-  name: Candidate Application Form <= 1.3 - Unauthenticated Arbitrary File Download
+  name: WordPress Candidate Application Form <= 1.3 - Local File Inclusion
  author: dhiyaneshDK
  severity: high
-  description: The code in downloadpdffile.php does not do any sanity checks, allowing a remote attacker to download sensitive system files.
+  description: "WordPress Candidate Application Form <= 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks."
  reference: https://wpscan.com/vulnerability/446233e9-33b3-4024-9b7d-63f9bb1dafe0
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
+    cve-id:
+    cwe-id: CWE-22
  tags: wordpress,wp-plugin,lfi,wp

 requests:
@ -22,3 +27,6 @@ requests:
      - type: status
        status:
          - 200
+
+
+# Enhanced by mp on 2022/04/21
--- a/vulnerabilities/wordpress/cherry-file-download.yaml
+++ b/vulnerabilities/wordpress/cherry-file-download.yaml
@ -4,10 +4,15 @@ info:
  name: Cherry Plugin < 1.2.7 - Unauthenticated Arbitrary File Download
  author: 0x_Akoko
  severity: high
-  description: The cherry plugin WordPress plugin was affected by an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file.
+  description: "WordPress plugin Cherry < 1.2.7 contains an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file."
  reference:
    - https://wpscan.com/vulnerability/90034817-dee7-40c9-80a2-1f1cd1d033ee
    - https://github.com/CherryFramework/cherry-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
+    cve-id:
+    cwe-id: CWE-22
  tags: wordpress,wp-plugin,lfi

 requests:
@ -27,3 +32,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/21
--- a/vulnerabilities/wordpress/cherry-lfi.yaml
+++ b/vulnerabilities/wordpress/cherry-lfi.yaml
@ -1,13 +1,18 @@
 id: cherry-lfi

 info:
-  name: Cherry Plugin < 1.2.7 - Unauthenticated Arbitrary File Upload and Download
+  name: WordPress Cherry < 1.2.7 - Unauthenticated Arbitrary File Upload and Download
  author: dhiyaneshDK
  severity: high
-  description: The cherry plugin WordPress plugin was affected by an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file.
+  description: "WordPress plugin Cherry < 1.2.7 has a vulnerability which enables an attacker to upload files directly to the server. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file."
  reference:
    - https://wpscan.com/vulnerability/90034817-dee7-40c9-80a2-1f1cd1d033ee
    - https://support.alertlogic.com/hc/en-us/articles/115003048083-06-19-17-WordPress-CMS-Cherry-Plugin-Arbitrary-File-Upload-RCE
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
+    cve-id:
+    cwe-id: CWE-22
  tags: wordpress,wp-plugin,lfi,wp

 requests:
@ -27,3 +32,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/04/21