description

cves/CVE-2020-10199.yaml

@@ -4,6 +4,7 @@ info:
   name: Nexus Repository Manager 3 RCE
   auhtor: hetroublemakr
   severity: high
+  description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
   # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
 
 requests:

cves/CVE-2020-10204.yaml

@@ -4,6 +4,7 @@ info:
   name: Sonatype Nexus Repository RCE
   auhtor: hetroublemakr
   severity: high
+  description: A Remote Code Execution vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with an administrative account on NXRM to execute arbitrary code by crafting a malicious request to NXRM
   # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
 
 requests:
@@ -21,4 +22,4 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200

cves/CVE-2020-12720.yaml

@@ -4,7 +4,7 @@ info:
   name: CVE-2020-12720 vBulletin SQLI
   author: pdnuclei - projectdiscovery.io
   severity: critical
-
+  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
   # Source https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
   # This template supports the detection part only.
   # Do not test any website without permission

cves/CVE-2020-13167.yaml

@@ -4,6 +4,7 @@ info:
   name: Netsweeper WebAdmin unixlogin.php Python Code Injection
   author: dwisiswant0
   severity: critical
+  description: Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.
 
   # This template exploits a Python code injection in the Netsweeper
   # WebAdmin component's unixlogin.php script, for versions 6.4.4 and
@@ -38,4 +39,4 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200

cves/CVE-2020-8512.yaml

@@ -4,6 +4,7 @@ info:
   name: IceWarp WebMail XSS
   author: pdnuclei & dwisiswant0
   severity: medium
+  description: In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
 
 # source:- https://www.exploit-db.com/exploits/47988
 # https://twitter.com/sagaryadav8742/status/1275170967527006208
@@ -21,4 +22,4 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200

cves/CVE-2020-8982.yaml

@@ -4,6 +4,7 @@ info:
   name: Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read
   author: dwisiswant0
   severity: high
+  description: An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020.
 
 requests:
   - method: GET
@@ -20,4 +21,4 @@ requests:
           - "fonts"
           - "extensions"
         condition: and
-        part: body
+        part: body

cves/CVE-2020-9484.yaml

@@ -4,6 +4,7 @@ info:
   name: Apache Tomcat RCE by deserialization
   author: dwisiswant0
   severity: high
+  description: Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server
 
 requests:
   - method: GET
@@ -23,4 +24,4 @@ requests:
           - "ObjectInputStream"
           - "PersistentManagerBase"
         condition: and
-        part: body
+        part: body

cves/CVE-2020-9496.yaml

@@ -4,6 +4,8 @@ info:
   name: Apache OFBiz XML-RPC Java Deserialization
   author: dwisiswant0
   severity: medium
+  description: XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
+
 
   # This temaplte detects a Java deserialization vulnerability in Apache
   # OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for
@@ -52,4 +54,4 @@ requests:
         part: header
       - type: status
         status:
-          - 200
+          - 200

cves/CVE-2020-9757.yaml

@@ -4,6 +4,7 @@ info:
   name: SEOmatic < 3.3.0 Server-Side Template Injection
   author: dwisiswant0
   severity: high
+  description: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
 
 requests:
   - method: GET