diff --git a/cnvd/2021/CNVD-2021-15822.yaml b/cnvd/2021/CNVD-2021-15822.yaml index eb55d50964..ababb62fc7 100644 --- a/cnvd/2021/CNVD-2021-15822.yaml +++ b/cnvd/2021/CNVD-2021-15822.yaml @@ -23,3 +23,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/17 diff --git a/misconfiguration/horde-unauthenticated.yaml b/cves/2005/CVE-2005-3344.yaml similarity index 50% rename from misconfiguration/horde-unauthenticated.yaml rename to cves/2005/CVE-2005-3344.yaml index a147fdb9b5..d81cd137c4 100644 --- a/misconfiguration/horde-unauthenticated.yaml +++ b/cves/2005/CVE-2005-3344.yaml @@ -1,10 +1,17 @@ -id: horde-unauthenticated +id: CVE-2005-3344 info: - name: Horde Groupware Unauthenticated + name: Horde Groupware Unauthenticated Admin Access author: pikpikcu severity: critical + description: Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access. tags: horde,unauth + remediation: + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2005-3344 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3344 + classification: + cve-id: CVE-2005-3344 requests: - method: GET @@ -25,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/18 diff --git a/cves/2010/CVE-2010-1870.yaml b/cves/2010/CVE-2010-1870.yaml index edecc3bdc3..0a5385b28a 100644 --- a/cves/2010/CVE-2010-1870.yaml +++ b/cves/2010/CVE-2010-1870.yaml @@ -5,7 +5,6 @@ info: author: b0yd severity: info description: A struts-based OGNL remote code execution vulnerability exists in ListSERV Maestro before and including version 9.0-8. - remediation: Update to the most recent version of ListSERV Maestro. reference: - https://www.securifera.com/advisories/sec-2020-0001/ - https://packetstormsecurity.com/files/159643/listservmaestro-exec.txt @@ -30,4 +29,4 @@ requests: - 'Administration Hub 9\.0-[123456780]' - 'Administration Hub [5678]' -# Enhanced by mp on 2022/02/15 +# Enhanced by mp on 2022/03/20 \ No newline at end of file diff --git a/cves/2010/CVE-2010-1873.yaml b/cves/2010/CVE-2010-1873.yaml index 89441da8ea..d15b7f802d 100644 --- a/cves/2010/CVE-2010-1873.yaml +++ b/cves/2010/CVE-2010-1873.yaml @@ -1,16 +1,17 @@ id: CVE-2010-1873 + info: - name: Joomla! Component Jvehicles - Local File Inclusion + name: Joomla! Component Jvehicles SQL Injection author: daffainfo severity: high description: A SQL injection vulnerability in the Jvehicles (com_jvehicles) component 1.0, 2.0, and 2.1111 for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an agentlisting action to index.php. - remediation: Upgrade to a supported version. reference: - https://www.exploit-db.com/exploits/11997 - https://www.cvedetails.com/cve/CVE-2010-1873 - tags: cve,cve2010,joomla,lfi + tags: cve,cve2010,joomla,lfi,sql-injection classification: cve-id: CVE-2010-1873 + requests: - method: GET path: @@ -23,4 +24,5 @@ requests: - type: status status: - 200 -# Enhanced by mp on 2022/02/15 + +# Enhanced by mp on 2022/03/20 diff --git a/cves/2021/CVE-2021-40542.yaml b/cves/2021/CVE-2021-40542.yaml index ab2d5f44d7..dad744396d 100644 --- a/cves/2021/CVE-2021-40542.yaml +++ b/cves/2021/CVE-2021-40542.yaml @@ -36,4 +36,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/03/16 +# Enhanced by mp on 2022/03/18 diff --git a/exposed-panels/acunetix-panel.yaml b/exposed-panels/acunetix-panel.yaml index 4a0bcf6c89..ac6c4353e9 100644 --- a/exposed-panels/acunetix-panel.yaml +++ b/exposed-panels/acunetix-panel.yaml @@ -1,10 +1,18 @@ id: acunetix-panel-detect info: - name: Acunetix Panel detector + name: Acunetix Login Panel author: joanbono severity: info + description: An Acunetix login panel was detected. tags: panel + reference: + - https://www.acunetix.com/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -21,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/adiscon-loganalyzer.yaml b/exposed-panels/adiscon-loganalyzer.yaml index 5f0e0bd13c..07c965a810 100644 --- a/exposed-panels/adiscon-loganalyzer.yaml +++ b/exposed-panels/adiscon-loganalyzer.yaml @@ -1,12 +1,18 @@ id: adiscon-loganalyzer info: - name: Detect exposed Adiscon LogAnalyzer + name: Adiscon LogAnalyzer Detection author: geeknik severity: high - description: Adiscon LogAnalyzer is a web interface to syslog and other network event data. It provides easy browsing, analysis of realtime network events and reporting services. - reference: https://loganalyzer.adiscon.com/ + description: Adiscon LogAnalyzer was discovered. Adiscon LogAnalyzer is a web interface to syslog and other network event data. It provides easy browsing and analysis of real-time network events and reporting services. + reference: + - https://loganalyzer.adiscon.com/ tags: adiscon,loganalyzer,syslog,exposures + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -32,3 +38,5 @@ requests: part: header words: - 'text/html' + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/adminer-panel.yaml b/exposed-panels/adminer-panel.yaml index 31a391dd47..43d26e4ffa 100644 --- a/exposed-panels/adminer-panel.yaml +++ b/exposed-panels/adminer-panel.yaml @@ -1,15 +1,23 @@ id: adminer-panel -info: - name: Adminer Login panel - author: random_robbie,meme-lord - severity: info - reference: https://blog.sorcery.ie/posts/adminer/ - tags: panel,adminer,login - # <= 4.2.4 can have unauthenticated RCE via SQLite driver - # <= 4.6.2 can have LFI via MySQL LOAD DATA LOCAL - # Most versions have some kind of SSRF usability - # Is generally handy if you find SQL creds +info: + name: Adminer Login Panel + author: random_robbie,meme-lord + description: An Adminer login panel was detected. + severity: info + reference: + - https://blog.sorcery.ie/posts/adminer/ + tags: panel,adminer,login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +# <= 4.2.4 can have unauthenticated RCE via SQLite driver +# <= 4.6.2 can have LFI via MySQL LOAD DATA LOCAL +# Most versions have some kind of SSRF usability +# Is generally handy if you find SQL creds requests: - method: GET @@ -43,3 +51,5 @@ requests: group: 1 regex: - '([0-9.]+)' + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/adminset-panel.yaml b/exposed-panels/adminset-panel.yaml index b9f1644f02..3d5467849a 100644 --- a/exposed-panels/adminset-panel.yaml +++ b/exposed-panels/adminset-panel.yaml @@ -1,13 +1,20 @@ id: adminset-panel info: - name: Adminset Panel + name: Adminset Login Panel author: ffffffff0x severity: info + description: An Adminset login panel was detected. metadata: fofa-query: app="AdminSet" - vendor: https://github.com/guhongze/adminset/ + reference: + - https://github.com/guhongze/adminset/ tags: adminset,panel + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -26,3 +33,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/adobe/adobe-component-login.yaml b/exposed-panels/adobe/adobe-component-login.yaml index c0042aed5b..9b423f9a58 100644 --- a/exposed-panels/adobe/adobe-component-login.yaml +++ b/exposed-panels/adobe/adobe-component-login.yaml @@ -1,11 +1,18 @@ -id: adobe-component-login +id: adobe-coldfusion-login info: - name: Adobe Component Browser Login + name: Adobe ColdFusion Component Browser Login Panel author: dhiyaneshDK + description: An Adobe ColdFusion Component Browser login panel was detected. severity: info - reference: https://www.exploit-db.com/ghdb/6846 - tags: panel,adobe + reference: + - https://www.exploit-db.com/ghdb/6846 + tags: panel,adobe,coldfusion + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -21,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/adobe/adobe-connect-central-login.yaml b/exposed-panels/adobe/adobe-connect-central-login.yaml index 1218c9f8d7..fdaf816057 100644 --- a/exposed-panels/adobe/adobe-connect-central-login.yaml +++ b/exposed-panels/adobe/adobe-connect-central-login.yaml @@ -1,10 +1,18 @@ id: adobe-connect-central-login info: - name: Adobe Connect Central Login + name: Adobe Connect Central Login Panel author: dhiyaneshDk + description: An Adobe Connect Central login panel was detected. severity: info - tags: adobe,panel + tags: adobe,panel,connect-central + reference: + - https://www.adobe.com/products/adobeconnect.html + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -21,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/adobe/adobe-experience-manager-login.yaml b/exposed-panels/adobe/adobe-experience-manager-login.yaml index 2162a6646f..4dbdef1e18 100644 --- a/exposed-panels/adobe/adobe-experience-manager-login.yaml +++ b/exposed-panels/adobe/adobe-experience-manager-login.yaml @@ -1,11 +1,19 @@ id: adobe-experience-manager-login info: - name: Adobe-Experience-Manager + name: Adobe Experience Manager Login Panel author: dhiyaneshDK + description: An Adobe Experience Manager login panel was detected. severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 + reference: + - https://www.shodan.io/search?query=http.title%3A%22AEM+Sign+In%22 + - https://business.adobe.com/products/experience-manager/adobe-experience-manager.html tags: panel,aem,adobe + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -21,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/adobe/adobe-media-server.yaml b/exposed-panels/adobe/adobe-media-server.yaml index deaf55913a..ec58a9acee 100644 --- a/exposed-panels/adobe/adobe-media-server.yaml +++ b/exposed-panels/adobe/adobe-media-server.yaml @@ -1,11 +1,19 @@ id: adobe-media-server info: - name: Adobe Media Server + name: Adobe Media Server Login Panel author: dhiyaneshDK + description: An Adobe Media Server login panel was detected. severity: info - reference: https://www.shodan.io/search?query=http.title%3A%22Adobe+Media+Server%22 + reference: + - https://www.shodan.io/search?query=http.title%3A%22Adobe+Media+Server%22 + - https://helpx.adobe.com/support/adobe-media-server.html tags: panel,adobe + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -21,3 +29,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/advance-setup.yaml b/exposed-panels/advance-setup.yaml index 6e01e7df87..629d3b1e84 100644 --- a/exposed-panels/advance-setup.yaml +++ b/exposed-panels/advance-setup.yaml @@ -1,11 +1,19 @@ -id: advance-setup-login +id: advanced-setup-login info: - name: Advance Setup Login + name: ActionTec Modem Advanced Setup Login Panel author: dhiyaneshDK + description: An ActionTec Modem Advanced Setup login panel was detected. severity: info - reference: https://www.exploit-db.com/ghdb/6819 + reference: + - https://www.exploit-db.com/ghdb/6819 + - https://www.actiontec.com/dsl/ tags: panel,setup + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -20,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/aerohive-netconfig-ui.yaml b/exposed-panels/aerohive-netconfig-ui.yaml index e5641facc7..a0db356bbd 100644 --- a/exposed-panels/aerohive-netconfig-ui.yaml +++ b/exposed-panels/aerohive-netconfig-ui.yaml @@ -1,31 +1,42 @@ -id: aerohive-netconfig-ui -info: - name: Aerohive NetConfig UI - author: pussycat0x - severity: info - metadata: - shodan-dork: 'http.title:"Aerohive NetConfig UI"' - tags: panel,tech,hiveos,aerohive - -requests: - - method: GET - path: - - "{{BaseURL}}/index.php5" - - matchers-condition: and - matchers: - - type: word - part: body - words: - - 'Aerohive NetConfig UI' - - - type: status - status: - - 200 - - extractors: - - type: regex - part: body - group: 1 - regex: - - 'version" align="right" valign="bottom">([0-9.a-z]+)<\/td>' +id: aerohive-netconfig-ui + +info: + name: Aerohive NetConfig UI + author: pussycat0x + severity: info + description: An Aerohive NetConfig user interface was detected. The NetConfig UI provides a fundamental set of configurations for configuring basic network and HiveManager connectivity settings, and uploading new IQ Engine images to Extreme Networks APs. + reference: + - https://docs.aerohive.com/330000/docs/help/english/ng/Content/reference/docs/online-help-systems.htm + metadata: + shodan-dork: 'http.title:"Aerohive NetConfig UI"' + tags: panel,tech,hiveos,aerohive + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php5" + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'Aerohive NetConfig UI' + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - 'version" align="right" valign="bottom">([0-9.a-z]+)<\/td>' + +# Enhanced by mp on 2022/03/21 diff --git a/exposed-panels/aims-password-mgmt-client.yaml b/exposed-panels/aims-password-mgmt-client.yaml index a178296f3f..c6f768a5c9 100644 --- a/exposed-panels/aims-password-mgmt-client.yaml +++ b/exposed-panels/aims-password-mgmt-client.yaml @@ -3,8 +3,16 @@ id: aims-password-mgmt-client info: name: Aims Password Management Client Detect author: iamthefrogy + description: An Aims Password management client was detected. severity: info tags: panel,aims + reference: + - https://www.avatier.com/products/identity-management/password-management/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -15,3 +23,5 @@ requests: - type: word words: - "Avatier Corporation" + +# Enhanced by mp on 2022/03/21 diff --git a/exposed-panels/aims-password-portal.yaml b/exposed-panels/aims-password-portal.yaml index 5400d182c1..62ffc3aebf 100644 --- a/exposed-panels/aims-password-portal.yaml +++ b/exposed-panels/aims-password-portal.yaml @@ -7,6 +7,7 @@ info: description: An AIMS Password Management portal was discovered. reference: - https://www.exploit-db.com/ghdb/6576 + - https://www.avatier.com/products/identity-management/password-management/ tags: panel,aims classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N @@ -28,4 +29,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/03/16 +# Enhanced by mp on 2022/03/21 diff --git a/exposed-panels/airflow-panel.yaml b/exposed-panels/airflow-panel.yaml index 92e1e646a4..8509d74c08 100644 --- a/exposed-panels/airflow-panel.yaml +++ b/exposed-panels/airflow-panel.yaml @@ -1,4 +1,4 @@ -id: airflow-panel +id: airflow-admin-login-panel info: name: Apache Airflow Admin Login Panel @@ -7,7 +7,7 @@ info: description: An Apache Airflow admin login panel was discovered. reference: - https://airflow.apache.org/docs/apache-airflow/stable/security/webserver.html - tags: panel,apache,airflow + tags: panel,apache,airflow,admin metadata: shodan-query: title:"Sign In - Airflow" classification: @@ -35,4 +35,4 @@ requests: status: - 200 -# Enhanced by mp on 2022/03/16 +# Enhanced by mp on 2022/03/21 diff --git a/exposed-panels/apache/tomcat-pathnormalization.yaml b/exposed-panels/apache/tomcat-pathnormalization.yaml index 21bf67d83b..9d80b61bce 100644 --- a/exposed-panels/apache/tomcat-pathnormalization.yaml +++ b/exposed-panels/apache/tomcat-pathnormalization.yaml @@ -4,8 +4,16 @@ info: name: Tomcat Manager Path Normalization author: organiccrap severity: info - reference: https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf + description: A Tomcat Manager login panel was discovered via path normalization. Normalizing a path involves modifying the string that identifies a path or file so that it conforms to a valid path on the target operating system. + reference: + - https://docs.microsoft.com/en-us/dotnet/framework/migration-guide/mitigation-path-normalization + - https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf tags: panel,tomcat,apache + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -26,3 +34,5 @@ requests: status: - 403 - 401 + +# Enhanced by mp on 2022/03/17 diff --git a/exposed-panels/apiman-panel.yaml b/exposed-panels/apiman-panel.yaml index eb3fa9f385..85b65e14e6 100644 --- a/exposed-panels/apiman-panel.yaml +++ b/exposed-panels/apiman-panel.yaml @@ -1,11 +1,18 @@ id: apiman-panel info: - name: Apiman Instance Detection Template + name: Apiman Login Panel author: righettod severity: info - description: Try to detect the presence of a Apiman instance via the login redirection + description: An Apiman instance was detected via the login redirection. tags: panel,apiman + reference: + - https://www.apiman.io/latest/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -21,4 +28,6 @@ requests: - type: status status: - - 302 \ No newline at end of file + - 302 + +# Enhanced by mp on 2022/03/18 diff --git a/exposed-panels/arcgis/arcgis-panel.yaml b/exposed-panels/arcgis/arcgis-panel.yaml index d6b8782887..8f02ee3245 100644 --- a/exposed-panels/arcgis/arcgis-panel.yaml +++ b/exposed-panels/arcgis/arcgis-panel.yaml @@ -5,6 +5,14 @@ info: author: Podalirius severity: info tags: docs,arcgis,cms,panel + description: An ArcGIS instance was discovered. + reference: + - https://enterprise.arcgis.com/en/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -34,4 +42,6 @@ requests: part: body group: 2 regex: - - '(Released Version:[\n\t ]+(([0-9]+(.[0-9]+)?(.[0-9]+)?)([\n\t ]+\([A-Za-z]+[\t ]+20[0-9][0-9]\))?))' \ No newline at end of file + - '(Released Version:[\n\t ]+(([0-9]+(.[0-9]+)?(.[0-9]+)?)([\n\t ]+\([A-Za-z]+[\t ]+20[0-9][0-9]\))?))' + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/arcgis/arcgis-rest-api.yaml b/exposed-panels/arcgis/arcgis-rest-api.yaml index 31371f4d91..b60cfd2026 100644 --- a/exposed-panels/arcgis/arcgis-rest-api.yaml +++ b/exposed-panels/arcgis/arcgis-rest-api.yaml @@ -1,10 +1,18 @@ id: arcgis-rest-api info: - name: ArcGIS exposed docs + name: ArcGIS Exposed Docs author: Podalirius severity: info + description: ArcGIS documents were discovered. tags: api,arcgis,cms + reference: + - https://enterprise.arcgis.com/en/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -20,3 +28,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/argocd-login.yaml b/exposed-panels/argocd-login.yaml index 4bf12b6196..08c875c528 100644 --- a/exposed-panels/argocd-login.yaml +++ b/exposed-panels/argocd-login.yaml @@ -4,10 +4,17 @@ info: name: Argo CD Login Panel author: Adam Crosser,daffainfo severity: info - description: Argo CD is a tool which will read your environment configuration (written either as a helm chart, kustomize files, jsonnet or plain yaml files) from your git repository and apply it to your Kubernetes namespaces. + description: An Argo CD login panel was discovered. + reference: + - https://argoproj.github.io/cd/ metadata: shodan-query: http.title:"Argo CD" tags: panel,argocd,login,kubernetes + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -24,3 +31,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/atlassian-crowd-panel.yaml b/exposed-panels/atlassian-crowd-panel.yaml index b7819bc20a..b14248a9a9 100644 --- a/exposed-panels/atlassian-crowd-panel.yaml +++ b/exposed-panels/atlassian-crowd-panel.yaml @@ -1,10 +1,18 @@ id: atlassian-crowd-panel info: - name: Atlassian Crowd panel detect + name: Atlassian Crowd Login Panel author: organiccrap + description: An Atlassian Crowd login panel was discovered. + reference: + - https://www.atlassian.com/ severity: info tags: panel,atlassian + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -16,3 +24,5 @@ requests: words: - Atlassian Crowd - Login part: body + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/atvise-login.yaml b/exposed-panels/atvise-login.yaml index ebc1df47af..74ba38fb08 100644 --- a/exposed-panels/atvise-login.yaml +++ b/exposed-panels/atvise-login.yaml @@ -1,13 +1,18 @@ id: atvise-login info: - name: Atvise Login panel + name: Atvise Login Panel author: idealphase severity: info - description: atvise is leading visualization and control center solutions based on pure web technology + description: An Atvise login panel was discovered. Atvise is a leading visualization and control center solutions based on pure web technology. reference: - https://www.exploit-db.com/ghdb/7837 - https://www.atvise.com/en + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 metadata: google-dork: intitle:"atvise - next generation" tags: panel,atvise @@ -27,3 +32,5 @@ requests: - type: status status: - 200 + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/avantfax-panel.yaml b/exposed-panels/avantfax-panel.yaml index 68b10166f2..1eefab2c24 100644 --- a/exposed-panels/avantfax-panel.yaml +++ b/exposed-panels/avantfax-panel.yaml @@ -4,9 +4,17 @@ info: name: AvantFAX Login Panel author: pikpikcu,daffainfo severity: info + description: An AvantFAX login panel was discovered. + reference: + - http://www.avantfax.com/ metadata: shodan-query: http.title:"AvantFAX - Login" tags: panel,avantfax,login + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -30,3 +38,5 @@ requests: group: 1 regex: - '

([0-9.]+)<\/p>' + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/avatier-password-management.yaml b/exposed-panels/avatier-password-management.yaml index 253126f16b..62d6395e8a 100644 --- a/exposed-panels/avatier-password-management.yaml +++ b/exposed-panels/avatier-password-management.yaml @@ -4,10 +4,17 @@ info: name: Avatier Password Management Panel Detect author: praetorian-thendrickson severity: info - reference: https://www.avatier.com + description: An Avatier password management panel was detected. + reference: + - https://www.avatier.com metadata: shodan-query: http.favicon.hash:983734701 tags: panel,avatier + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + cvss-score: 5.3 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -21,3 +28,5 @@ requests: - 'LabelWelcomeToPS' - 'Avatier Corporation' condition: and + +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/axigen-webadmin.yaml b/exposed-panels/axigen-webadmin.yaml index 3d48ec8102..0e54704559 100644 --- a/exposed-panels/axigen-webadmin.yaml +++ b/exposed-panels/axigen-webadmin.yaml @@ -1,15 +1,20 @@ id: axigen-webadmin info: - name: Axigen Web Admin + name: Axigen Web Admin Detection author: dhiyaneshDk severity: info - description: This template determines if Axigen Web Admin is running. + description: An Axigen Web Admin panel was discovered. reference: - https://www.axigen.com/ metadata: - shodan-query: 'http.title:"Axigen WebAdmin"' + shodan-query: 'http.title:"Axigen WebAdmin"' tags: axigen,panel + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -20,10 +25,10 @@ requests: matchers: - type: word words: - - 'Axigen WebAdmin' + - 'Axigen WebAdmin' - type: status status: - 200 -# Enhanced by cs on 2022/02/25 +# Enhanced by mp on 2022/03/20 diff --git a/exposed-panels/axigen-webmail.yaml b/exposed-panels/axigen-webmail.yaml index 42719fa314..25ab8cf431 100644 --- a/exposed-panels/axigen-webmail.yaml +++ b/exposed-panels/axigen-webmail.yaml @@ -1,15 +1,20 @@ id: axigen-webmail info: - name: Axigen WebMail + name: Axigen WebMail PanelDetection author: dhiyaneshDk,idealphase severity: info - description: This template determines if Axigen Webmail is running. + description: An Axigen webmail panel was discovered. reference: - https://www.axigen.com/ metadata: shodan-query: 'http.title:"Axigen WebMail"' tags: axigen,panel + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cvss-score: 0.0 + cve-id: + cwe-id: CWE-200 requests: - method: GET @@ -34,3 +39,5 @@ requests: part: body regex: - '