daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into pussycat0x-1

patch-1
Prince Chaddha 2023-07-07 17:08:23 +05:30
parent 411915fcae 646ffaf0b8
commit fb087bbc59
4271 changed files with 8482 additions and 12571 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
.new-additions
View File

@ -1,9 +1,89 @@
file/keys/adafruit-key.yaml
file/keys/adobe/adobe-client.yaml
file/keys/airtable-key.yaml
file/keys/algolia-key.yaml
file/keys/alibaba/alibaba-key-id.yaml
file/keys/alibaba/alibaba-secret-id.yaml
file/keys/asana/asana-clientid.yaml
file/keys/asana/asana-clientsecret.yaml
file/keys/atlassian/atlassian-api-token.yaml
file/webshell/asp-webshell.yaml
file/webshell/jsp-webshell.yaml
file/webshell/php-webshell.yaml
http/cnvd/2022/CNVD-2022-86535.yaml
http/cves/2012/CVE-2012-5321.yaml
http/cves/2018/CVE-2018-6530.yaml
http/cves/2019/CVE-2019-14789.yaml
http/cves/2019/CVE-2019-8390.yaml
http/cves/2020/CVE-2020-19515.yaml
http/cves/2020/CVE-2020-35984.yaml
http/cves/2020/CVE-2020-35985.yaml
http/cves/2020/CVE-2020-35986.yaml
http/cves/2020/CVE-2020-35987.yaml
http/cves/2022/CVE-2022-4295.yaml
http/cves/2022/CVE-2022-43164.yaml
http/cves/2022/CVE-2022-43165.yaml
http/cves/2022/CVE-2022-43166.yaml
http/cves/2022/CVE-2022-43167.yaml
http/cves/2022/CVE-2022-43169.yaml
http/cves/2022/CVE-2022-43170.yaml
http/cves/2022/CVE-2022-43185.yaml
http/cves/2022/CVE-2022-44944.yaml
http/cves/2022/CVE-2022-44946.yaml
http/cves/2022/CVE-2022-44947.yaml
http/cves/2022/CVE-2022-44948.yaml
http/cves/2022/CVE-2022-44949.yaml
http/cves/2022/CVE-2022-44950.yaml
http/cves/2022/CVE-2022-44951.yaml
http/cves/2022/CVE-2022-44952.yaml
http/cves/2023/CVE-2023-0297.yaml
http/cves/2023/CVE-2023-0514.yaml
http/cves/2023/CVE-2023-1730.yaml
http/cves/2023/CVE-2023-1835.yaml
http/cves/2023/CVE-2023-1890.yaml
http/cves/2023/CVE-2023-2023.yaml
http/cves/2023/CVE-2023-2252.yaml
http/cves/2023/CVE-2023-2272.yaml
http/cves/2023/CVE-2023-28121.yaml
http/cves/2023/CVE-2023-2822.yaml
http/cves/2023/CVE-2023-30256.yaml
http/cves/2023/CVE-2023-30777.yaml
http/cves/2023/CVE-2023-33439.yaml
http/cves/2023/CVE-2023-36287.yaml
http/cves/2023/CVE-2023-36289.yaml
http/cves/2023/CVE-2023-36346.yaml
http/default-logins/esafenet-cdg-default-login.yaml
http/default-logins/pyload/pyload-default-login.yaml
http/exposed-panels/arangodb-web-Interface.yaml
http/exposed-panels/arcserve-panel.yaml
http/exposed-panels/c2/hookbot-rat.yaml
http/exposed-panels/c2/mystic-stealer.yaml
http/exposed-panels/cloudpanel-login.yaml
http/exposed-panels/dell-idrac.yaml
http/exposed-panels/efak-login-panel.yaml
http/exposed-panels/pritunl-panel.yaml
http/exposed-panels/pyload-panel.yaml
http/exposed-panels/qdpm-login-panel.yaml
http/exposed-panels/shell-box.yaml
http/exposed-panels/untangle-admin-login.yaml
http/exposed-panels/uptime-kuma-panel.yaml
http/exposures/configs/collibra-properties.yaml
http/exposures/files/pnpm-lock.yaml
http/exposures/tokens/adafruit/adafruit-api-key.yaml
http/exposures/tokens/adobe/adobe-client-id.yaml
http/exposures/tokens/airtable/airtable-api-key.yaml
http/exposures/tokens/algolia/algolia-api-key.yaml
http/exposures/tokens/alibaba/alibaba-accesskey-id.yaml
http/exposures/tokens/alibaba/alibaba-secretkey-id.yaml
http/exposures/tokens/asana/asana-client-id.yaml
http/exposures/tokens/asana/asana-client-secret.yaml
http/exposures/tokens/atlassian-token.yaml
http/misconfiguration/unauth-temporal-web-ui.yaml
http/vulnerabilities /other/sitemap-sql-injection.yaml
http/vulnerabilities/wordpress/contus-video-gallery-sqli.yaml
http/vulnerabilities/wordpress/leaguemanager-sql-injection.yaml
http/vulnerabilities/wordpress/notificationx-sqli.yaml
http/vulnerabilities/wordpress/zero-spam-sql-injection.yaml
misconfiguration/proxy/open-proxy-external.yaml
network/misconfig/apache-dubbo-unauth.yaml
network/misconfig/apache-rocketmq-broker-unauth.yaml

4
.nuclei-ignore
View File

@ -25,7 +25,9 @@ tags:
files:
- http/cves/2006/CVE-2006-1681.yaml
- http/cves/2007/CVE-2007-5728.yaml
- http/cves/2011/CVE-2011-4618.yaml
- http/cves/2014/CVE-2014-9608.yaml
- http/cves/2018/CVE-2018-5316.yaml
- http/cves/2018/CVE-2018-5233.yaml
- http/cves/2019/CVE-2019-14696.yaml
- http/cves/2020/CVE-2020-11930.yaml
@ -34,4 +36,4 @@ files:
- http/cves/2020/CVE-2020-28351.yaml
- http/cves/2021/CVE-2021-35265.yaml
- http/vulnerabilities/oracle/oracle-ebs-xss.yaml
- http/vulnerabilities/other/nginx-module-vts-xss.yaml
- http/vulnerabilities/other/nginx-module-vts-xss.yaml

12
contributors.json
View File

@ -1380,6 +1380,15 @@
}
},
{
"author": "noraj",
"links": {
"github": "https://github.com/noraj",
"twitter": "https://twitter.com/noraj_rawsec",
"linkedin": "",
"website": "https://pwn.by/noraj",
"email": ""
}
},{
"author": "mabdullah22",
"links": {
"github": "https://www.github.com/maabdullah22",
@ -1389,5 +1398,4 @@
"email": ""
}
}
]
]

38
cves.json
View File

@ -193,6 +193,7 @@
{"ID":"CVE-2012-4889","Info":{"Name":"ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting","Severity":"medium","Description":"Multiple cross-site scripting vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2012/CVE-2012-4889.yaml"}
{"ID":"CVE-2012-4940","Info":{"Name":"Axigen Mail Server Filename Directory Traversal","Severity":"high","Description":"Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the fileName parameter in an edit or delete action to the default URI.","Classification":{"CVSSScore":"6.4"}},"file_path":"http/cves/2012/CVE-2012-4940.yaml"}
{"ID":"CVE-2012-4982","Info":{"Name":"Forescout CounterACT 6.3.4.1 - Open Redirect","Severity":"medium","Description":"Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 'a' parameter.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2012/CVE-2012-4982.yaml"}
{"ID":"CVE-2012-5321","Info":{"Name":"TikiWiki CMS Groupware v8.3 - Open Redirect","Severity":"medium","Description":"tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka \"frame injection\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2012/CVE-2012-5321.yaml"}
{"ID":"CVE-2012-5913","Info":{"Name":"WordPress Integrator 1.32 - Cross-Site Scripting","Severity":"medium","Description":"A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2012/CVE-2012-5913.yaml"}
{"ID":"CVE-2012-6499","Info":{"Name":"WordPress Plugin Age Verification v0.4 - Open Redirect","Severity":"medium","Description":"Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2012/CVE-2012-6499.yaml"}
{"ID":"CVE-2013-1965","Info":{"Name":"Apache Struts2 S2-012 RCE","Severity":"critical","Description":"Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2013/CVE-2013-1965.yaml"}
@ -631,6 +632,7 @@
{"ID":"CVE-2019-14470","Info":{"Name":"WordPress UserPro 4.9.32 - Cross-Site Scripting","Severity":"medium","Description":"WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API (v2) it relies on allows it via the example/success.php error_description parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14470.yaml"}
{"ID":"CVE-2019-14530","Info":{"Name":"OpenEMR \u003c5.0.2 - Local File Inclusion","Severity":"high","Description":"OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2019/CVE-2019-14530.yaml"}
{"ID":"CVE-2019-14696","Info":{"Name":"Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting","Severity":"medium","Description":"Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14696.yaml"}
{"ID":"CVE-2019-14789","Info":{"Name":"Custom 404 Pro \u003c 3.2.8 - Cross-Site Scripting","Severity":"medium","Description":"Custom 404 Pro before 3.2.9 is susceptible to cross-site scripting via the title parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14789.yaml"}
{"ID":"CVE-2019-14974","Info":{"Name":"SugarCRM Enterprise 9.0.0 - Cross-Site Scripting","Severity":"medium","Description":"SugarCRM Enterprise 9.0.0 contains a cross-site scripting vulnerability via mobile/error-not-supported-platform.html?desktop_url.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14974.yaml"}
{"ID":"CVE-2019-15043","Info":{"Name":"Grafana - Improper Access Control","Severity":"high","Description":"Grafana 2.x through 6.x before 6.3.4 is susceptible to improper access control. An attacker can delete and create arbitrary snapshots, leading to denial of service.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-15043.yaml"}
{"ID":"CVE-2019-15107","Info":{"Name":"Webmin \u003c= 1.920 - Unauthenticated Remote Command Execution","Severity":"critical","Description":"Webmin \u003c=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-15107.yaml"}
@ -718,6 +720,7 @@
{"ID":"CVE-2019-7543","Info":{"Name":"KindEditor 4.1.11 - Cross-Site Scripting","Severity":"medium","Description":"KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-7543.yaml"}
{"ID":"CVE-2019-7609","Info":{"Name":"Kibana Timelion - Arbitrary Code Execution","Severity":"critical","Description":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2019/CVE-2019-7609.yaml"}
{"ID":"CVE-2019-8086","Info":{"Name":"Adobe Experience Manager - XML External Entity Injection","Severity":"high","Description":"Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-8086.yaml"}
{"ID":"CVE-2019-8390","Info":{"Name":"qdPM 9.1 - Cross-site Scripting","Severity":"medium","Description":"qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-8390.yaml"}
{"ID":"CVE-2019-8442","Info":{"Name":"Jira - Local File Inclusion","Severity":"high","Description":"Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1, allows remote attackers to access files in the Jira webroot under the META-INF directory via local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-8442.yaml"}
{"ID":"CVE-2019-8446","Info":{"Name":"Jira Improper Authorization","Severity":"medium","Description":"The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2019/CVE-2019-8446.yaml"}
{"ID":"CVE-2019-8449","Info":{"Name":"Jira \u003c8.4.0 - Information Disclosure","Severity":"medium","Description":"Jira before 8.4.0 is susceptible to information disclosure. The /rest/api/latest/groupuserpicker resource can allow an attacker to enumerate usernames, and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized operations.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2019/CVE-2019-8449.yaml"}
@ -818,6 +821,7 @@
{"ID":"CVE-2020-19295","Info":{"Name":"Jeesns 1.4.2 - Cross-Site Scripting","Severity":"medium","Description":"Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /weibo/topic component and allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-19295.yaml"}
{"ID":"CVE-2020-19360","Info":{"Name":"FHEM 6.0 - Local File Inclusion","Severity":"high","Description":"FHEM version 6.0 suffers from a local file inclusion vulnerability.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-19360.yaml"}
{"ID":"CVE-2020-1943","Info":{"Name":"Apache OFBiz \u003c=16.11.07 - Cross-Site Scripting","Severity":"medium","Description":"Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-1943.yaml"}
{"ID":"CVE-2020-19515","Info":{"Name":"qdPM 9.1 - Cross-site Scripting","Severity":"medium","Description":"qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\\install\\modules\\database_config.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-19515.yaml"}
{"ID":"CVE-2020-1956","Info":{"Name":"Apache Kylin 3.0.1 - Command Injection Vulnerability","Severity":"high","Description":"Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-1956.yaml"}
{"ID":"CVE-2020-19625","Info":{"Name":"Gridx 1.3 - Remote Code Execution","Severity":"critical","Description":"Gridx 1.3 is susceptible to remote code execution via tests/support/stores/test_grid_filter.php, which allows remote attackers to execute arbitrary code via crafted values submitted to the $query parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-19625.yaml"}
{"ID":"CVE-2020-20285","Info":{"Name":"ZZcms - Cross-Site Scripting","Severity":"medium","Description":"ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2020/CVE-2020-20285.yaml"}
@ -911,6 +915,10 @@
{"ID":"CVE-2020-35847","Info":{"Name":"Agentejo Cockpit \u003c0.11.2 - NoSQL Injection","Severity":"critical","Description":"Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-35847.yaml"}
{"ID":"CVE-2020-35848","Info":{"Name":"Agentejo Cockpit \u003c0.12.0 - NoSQL Injection","Severity":"critical","Description":"Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-35848.yaml"}
{"ID":"CVE-2020-35951","Info":{"Name":"Wordpress Quiz and Survey Master \u003c7.0.1 - Arbitrary File Deletion","Severity":"critical","Description":"Wordpress Quiz and Survey Master \u003c7.0.1 allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2020/CVE-2020-35951.yaml"}
{"ID":"CVE-2020-35984","Info":{"Name":"Rukovoditel \u003c= 2.7.2 - Cross Site Scripting","Severity":"medium","Description":"A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2020/CVE-2020-35984.yaml"}
{"ID":"CVE-2020-35985","Info":{"Name":"Rukovoditel \u003c= 2.7.2 - Cross Site Scripting","Severity":"medium","Description":"A stored cross site scripting (XSS) vulnerability in the 'Global Lists\" feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2020/CVE-2020-35985.yaml"}
{"ID":"CVE-2020-35986","Info":{"Name":"Rukovoditel \u003c= 2.7.2 - Cross Site Scripting","Severity":"medium","Description":"A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2020/CVE-2020-35986.yaml"}
{"ID":"CVE-2020-35987","Info":{"Name":"Rukovoditel \u003c= 2.7.2 - Cross-Site Scripting","Severity":"medium","Description":"A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2020/CVE-2020-35987.yaml"}
{"ID":"CVE-2020-36112","Info":{"Name":"CSE Bookstore 1.0 - SQL Injection","Severity":"critical","Description":"CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-36112.yaml"}
{"ID":"CVE-2020-36289","Info":{"Name":"Jira Server and Data Center - Information Disclosure","Severity":"medium","Description":"Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the QueryComponentRendererValue!Default.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations, Affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-36289.yaml"}
{"ID":"CVE-2020-36365","Info":{"Name":"Smartstore \u003c4.1.0 - Open Redirect","Severity":"medium","Description":"Smartstore (aka \"SmartStoreNET\") before 4.1.0 contains an open redirect vulnerability via CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-36365.yaml"}
@ -1744,6 +1752,7 @@
{"ID":"CVE-2022-42747","Info":{"Name":"CandidATS 3.0.0 - Cross-Site Scripting.","Severity":"medium","Description":"CandidATS 3.0.0 contains a cross-site scripting vulnerability via the sortBy parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-42747.yaml"}
{"ID":"CVE-2022-42748","Info":{"Name":"CandidATS 3.0.0 - Cross-Site Scripting.","Severity":"medium","Description":"CandidATS 3.0.0 contains a cross-site scripting vulnerability via the sortDirection parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-42748.yaml"}
{"ID":"CVE-2022-42749","Info":{"Name":"CandidATS 3.0.0 - Cross-Site Scripting","Severity":"medium","Description":"CandidATS 3.0.0 contains a cross-site scripting vulnerability via the page parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-42749.yaml"}
{"ID":"CVE-2022-4295","Info":{"Name":"Show all comments \u003c 7.0.1 - Cross-Site Scripting","Severity":"medium","Description":"The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-4295.yaml"}
{"ID":"CVE-2022-4301","Info":{"Name":"WordPress Sunshine Photo Cart \u003c2.9.15 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Sunshine Photo Cart plugin before 2.9.15 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-4301.yaml"}
{"ID":"CVE-2022-43014","Info":{"Name":"OpenCATS 0.9.6 - Cross-Site Scripting","Severity":"medium","Description":"OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-43014.yaml"}
{"ID":"CVE-2022-43015","Info":{"Name":"OpenCATS 0.9.6 - Cross-Site Scripting","Severity":"medium","Description":"OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the entriesPerPage parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-43015.yaml"}
@ -1752,6 +1761,13 @@
{"ID":"CVE-2022-43018","Info":{"Name":"OpenCATS 0.9.6 - Cross-Site Scripting","Severity":"medium","Description":"OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the email parameter in the Check Email function. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-43018.yaml"}
{"ID":"CVE-2022-4306","Info":{"Name":"WordPress Panda Pods Repeater Field \u003c1.5.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Panda Pods Repeater Field before 1.5.4 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. This can be leveraged against a user who has at least Contributor permission. An attacker can also steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-4306.yaml"}
{"ID":"CVE-2022-43140","Info":{"Name":"kkFileView 4.1.0 - Server-Side Request Forgery","Severity":"high","Description":"kkFileView 4.1.0 is susceptible to server-side request forgery via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. An attacker can force the application to make arbitrary requests via injection of crafted URLs into the url parameter and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-43140.yaml"}
{"ID":"CVE-2022-43164","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking \"Add\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-43164.yaml"}
{"ID":"CVE-2022-43165","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking \"Create\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-43165.yaml"}
{"ID":"CVE-2022-43166","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking \"Add New Entity\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-43166.yaml"}
{"ID":"CVE-2022-43167","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking \"Add\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-43167.yaml"}
{"ID":"CVE-2022-43169","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross-Site Scripting","Severity":"medium","Description":"A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking \"Add New Group\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-43169.yaml"}
{"ID":"CVE-2022-43170","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking \"Add info block\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-43170.yaml"}
{"ID":"CVE-2022-43185","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross-Site Scripting","Severity":"medium","Description":"A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking \"Add\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-43185.yaml"}
{"ID":"CVE-2022-4320","Info":{"Name":"WordPress Events Calendar \u003c1.4.5 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be used against both unauthenticated and authenticated users.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-4320.yaml"}
{"ID":"CVE-2022-4321","Info":{"Name":"PDF Generator for WordPress \u003c 1.1.2 - Cross Site Scripting","Severity":"medium","Description":"The plugin includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2022/CVE-2022-4321.yaml"}
{"ID":"CVE-2022-4325","Info":{"Name":"WordPress Post Status Notifier Lite \u003c1.10.1 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Post Status Notifier Lite plugin before 1.10.1 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be used against high-privilege users such as admin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-4325.yaml"}
@ -1759,6 +1775,14 @@
{"ID":"CVE-2022-43769","Info":{"Name":"Hitachi Pentaho Business Analytics Server - Remote Code Execution","Severity":"high","Description":"Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby potentially enabling an attacker to execute malware, obtain sensitive information, modify data, and/or perform unauthorized operations without entering necessary credentials.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-43769.yaml"}
{"ID":"CVE-2022-4447","Info":{"Name":"WordPress Fontsy \u003c=1.8.6 - SQL Injection","Severity":"critical","Description":"WordPress Fontsy plugin through 1.8.6 is susceptible to SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-4447.yaml"}
{"ID":"CVE-2022-44877","Info":{"Name":"CentOS Web Panel 7 \u003c0.9.8.1147 - Remote Code Execution","Severity":"critical","Description":"CentOS Web Panel 7 before 0.9.8.1147 is susceptible to remote code execution via entering shell characters in the /login/index.php component. This can allow an attacker to execute arbitrary system commands via crafted HTTP requests and potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-44877.yaml"}
{"ID":"CVE-2022-44944","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages\u0026entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44944.yaml"}
{"ID":"CVE-2022-44946","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross-Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages\u0026entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44946.yaml"}
{"ID":"CVE-2022-44947","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types\u0026entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking \"Add\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44947.yaml"}
{"ID":"CVE-2022-44948","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross-Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking \"Add\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44948.yaml"}
{"ID":"CVE-2022-44949","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields\u0026entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44949.yaml"}
{"ID":"CVE-2022-44950","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields\u0026entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44950.yaml"}
{"ID":"CVE-2022-44951","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms\u0026entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44951.yaml"}
{"ID":"CVE-2022-44952","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking \"Add\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44952.yaml"}
{"ID":"CVE-2022-45037","Info":{"Name":"WBCE CMS v1.5.4 - Cross Site Scripting (Stored)","Severity":"medium","Description":"A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-45037.yaml"}
{"ID":"CVE-2022-45038","Info":{"Name":"WBCE CMS v1.5.4 - Cross Site Scripting (Stored)","Severity":"medium","Description":"A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-45038.yaml"}
{"ID":"CVE-2022-45362","Info":{"Name":"WordPress Paytm Payment Gateway \u003c=2.7.0 - Server-Side Request Forgery","Severity":"high","Description":"WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-45362.yaml"}
@ -1783,6 +1807,8 @@
{"ID":"CVE-2023-0126","Info":{"Name":"SonicWall SMA1000 LFI","Severity":"high","Description":"Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-0126.yaml"}
{"ID":"CVE-2023-0236","Info":{"Name":"WordPress Tutor LMS \u003c2.0.10 - Cross Site Scripting","Severity":"medium","Description":"WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the reset_key and user_id parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be used against high-privilege users such as admin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-0236.yaml"}
{"ID":"CVE-2023-0261","Info":{"Name":"WordPress WP TripAdvisor Review Slider \u003c10.8 - Authenticated SQL Injection","Severity":"high","Description":"WordPress WP TripAdvisor Review Slider plugin before 10.8 is susceptible to authenticated SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. This can lead, in turn, to obtaining sensitive information, modifying data, and/or executing unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-0261.yaml"}
{"ID":"CVE-2023-0297","Info":{"Name":"PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)","Severity":"critical","Description":"Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-0297.yaml"}
{"ID":"CVE-2023-0514","Info":{"Name":"Membership Database \u003c= 1.0 - Cross-Site Scripting","Severity":"medium","Description":"Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-0514.yaml"}
{"ID":"CVE-2023-0527","Info":{"Name":"Online Security Guards Hiring System - Cross-Site Scripting","Severity":"medium","Description":"A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. The manipulation of the argument searchdata with the input \"\u003e\u003cscript\u003ealert(document.domain)\u003c/script\u003e leads to cross site scripting. The attack may be launched remotely.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-0527.yaml"}
{"ID":"CVE-2023-0552","Info":{"Name":"WordPress Pie Register \u003c3.8.2.3 - Open Redirect","Severity":"medium","Description":"WordPress Pie Register plugin before 3.8.2.3 contains an open redirect vulnerability. The plugin does not properly validate the redirection URL when logging in and login out. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-0552.yaml"}
{"ID":"CVE-2023-0562","Info":{"Name":"Bank Locker Management System v1.0 - SQL Injection","Severity":"critical","Description":"A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-0562.yaml"}
@ -1800,13 +1826,19 @@
{"ID":"CVE-2023-1454","Info":{"Name":"Jeecg-boot 3.5.0 qurestSql - SQL Injection","Severity":"critical","Description":"A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-1454.yaml"}
{"ID":"CVE-2023-1496","Info":{"Name":"Imgproxy \u003c 3.14.0 - Cross-site Scripting (XSS)","Severity":"medium","Description":"Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-1496.yaml"}
{"ID":"CVE-2023-1671","Info":{"Name":"Sophos Web Appliance - Remote Code Execution","Severity":"critical","Description":"A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-1671.yaml"}
{"ID":"CVE-2023-1730","Info":{"Name":"SupportCandy \u003c 3.1.5 - Unauthenticated SQL Injection","Severity":"critical","Description":"The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-1730.yaml"}
{"ID":"CVE-2023-1835","Info":{"Name":"Ninja Forms \u003c 3.6.22 - Cross-Site Scripting","Severity":"medium","Description":"Ninja Forms before 3.6.22 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-1835.yaml"}
{"ID":"CVE-2023-1890","Info":{"Name":"Tablesome \u003c 1.0.9 - Cross-Site Scripting","Severity":"medium","Description":"Tablesome before 1.0.9 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-1890.yaml"}
{"ID":"CVE-2023-2023","Info":{"Name":"Custom 404 Pro \u003c 3.7.3 - Cross-Site Scripting","Severity":"medium","Description":"Custom 404 Pro before 3.7.3 is susceptible to cross-site scripting via the search parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-2023.yaml"}
{"ID":"CVE-2023-20864","Info":{"Name":"VMware Aria Operations for Logs - Unauthenticated Remote Code Execution","Severity":"critical","Description":"VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-20864.yaml"}
{"ID":"CVE-2023-20887","Info":{"Name":"VMware VRealize Network Insight - Remote Code Execution","Severity":"critical","Description":"VMWare Aria Operations for Networks (vRealize Network Insight) is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the root user. The RPC interface is protected by a reverse proxy which can be bypassed. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. A malicious actor can get remote code execution in the context of 'root' on the appliance. VMWare 6.x version are\n vulnerable.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-20887.yaml"}
{"ID":"CVE-2023-20888","Info":{"Name":"VMware Aria Operations for Networks - Remote Code Execution","Severity":"high","Description":"Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-20888.yaml"}
{"ID":"CVE-2023-20889","Info":{"Name":"VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability","Severity":"high","Description":"Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-20889.yaml"}
{"ID":"CVE-2023-2122","Info":{"Name":"Image Optimizer by 10web \u003c 1.0.26 - Cross-Site Scripting","Severity":"medium","Description":"Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowd_tabs_active parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-2122.yaml"}
{"ID":"CVE-2023-2130","Info":{"Name":"Purchase Order Management v1.0 - SQL Injection","Severity":"critical","Description":"A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226206 is the identifier assigned to this vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2130.yaml"}
{"ID":"CVE-2023-2252","Info":{"Name":"Directorist \u003c 7.5.4 - Local File Inclusion","Severity":"medium","Description":"Directorist before 7.5.4 is susceptible to Local File Inclusion as it does not validate the file parameter when importing CSV files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-2252.yaml"}
{"ID":"CVE-2023-22620","Info":{"Name":"SecurePoint UTM 12.x Session ID Leak","Severity":"medium","Description":"An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-22620.yaml"}
{"ID":"CVE-2023-2272","Info":{"Name":"Tiempo.com \u003c= 0.1.2 - Cross-Site Scripting","Severity":"medium","Description":"Tiempo.com before 0.1.2 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-2272.yaml"}
{"ID":"CVE-2023-22897","Info":{"Name":"Securepoint UTM - Leaking Remote Memory Contents","Severity":"medium","Description":"An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-22897.yaml"}
{"ID":"CVE-2023-23333","Info":{"Name":"SolarView Compact 6.00 - OS Command Injection","Severity":"critical","Description":"SolarView Compact 6.00 was discovered to contain a command injection vulnerability, attackers can execute commands by bypassing internal restrictions through downloader.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-23333.yaml"}
{"ID":"CVE-2023-23488","Info":{"Name":"WordPress Paid Memberships Pro \u003c2.9.8 - Blind SQL Injection","Severity":"critical","Description":"WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-23488.yaml"}
@ -1845,6 +1877,7 @@
{"ID":"CVE-2023-27587","Info":{"Name":"ReadToMyShoe - Generation of Error Message Containing Sensitive Information","Severity":"medium","Description":"ReadToMyShoe generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google Cloud TTS request, it will include the full URL of the request, which contains the Google Cloud API key.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2023/CVE-2023-27587.yaml"}
{"ID":"CVE-2023-2780","Info":{"Name":"Mlflow \u003c2.3.1 - Local File Inclusion Bypass","Severity":"critical","Description":"Path Traversal: '\\..\\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2780.yaml"}
{"ID":"CVE-2023-28121","Info":{"Name":"WooCommerce Payments - Unauthorized Admin Access","Severity":"critical","Description":"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-28121.yaml"}
{"ID":"CVE-2023-2822","Info":{"Name":"Ellucian Ethos Identity CAS - Cross-Site Scripting","Severity":"medium","Description":"A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-2822.yaml"}
{"ID":"CVE-2023-2825","Info":{"Name":"GitLab 16.0.0 - Path Traversal","Severity":"critical","Description":"An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-2825.yaml"}
{"ID":"CVE-2023-28343","Info":{"Name":"Altenergy Power Control Software C1.2.5 - Remote Command Injection","Severity":"critical","Description":"Altenergy Power Control Software C1.2.5 is susceptible to remote command injection via shell metacharacters in the index.php/management/set_timezone parameter, because of set_timezone in models/management_model.php. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-28343.yaml"}
{"ID":"CVE-2023-28432","Info":{"Name":"MinIO Cluster Deployment - Information Disclosure","Severity":"high","Description":"MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. All users of distributed deployment are impacted.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-28432.yaml"}
@ -1859,6 +1892,8 @@
{"ID":"CVE-2023-30019","Info":{"Name":"Imgproxy \u003c= 3.14.0 - Server-side request forgery (SSRF)","Severity":"medium","Description":"imgproxy \u003c=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-30019.yaml"}
{"ID":"CVE-2023-30210","Info":{"Name":"OURPHP \u003c= 7.2.0 - Cross Site Scripting","Severity":"medium","Description":"OURPHP \u003c= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via /client/manage/ourphp_tz.php.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-30210.yaml"}
{"ID":"CVE-2023-30212","Info":{"Name":"OURPHP \u003c= 7.2.0 - Cross Site Scripting","Severity":"medium","Description":"OURPHP \u003c= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-30212.yaml"}
{"ID":"CVE-2023-30256","Info":{"Name":"Webkul QloApps 1.5.2 - Cross-site Scripting","Severity":"medium","Description":"Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30256.yaml"}
{"ID":"CVE-2023-30777","Info":{"Name":"Advanced Custom Fields \u003c 6.1.6 - Cross-Site Scripting","Severity":"medium","Description":"Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the post_status parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30777.yaml"}
{"ID":"CVE-2023-31059","Info":{"Name":"Repetier Server - Directory Traversal","Severity":"high","Description":"Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-31059.yaml"}
{"ID":"CVE-2023-31548","Info":{"Name":"ChurchCRM v4.5.3 - Cross-Site Scripting","Severity":"medium","Description":"A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-31548.yaml"}
{"ID":"CVE-2023-32235","Info":{"Name":"Ghost CMS \u003c 5.42.1 - Path Traversal","Severity":"medium","Description":"Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-32235.yaml"}
@ -1875,3 +1910,6 @@
{"ID":"CVE-2023-34960","Info":{"Name":"Chamilo Command Injection","Severity":"high","Description":"","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-34960.yaml"}
{"ID":"CVE-2023-35843","Info":{"Name":"NocoDB version \u003c= 0.106.1 - Arbitrary File Read","Severity":"high","Description":"NocoDB through 0.106.1 has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-35843.yaml"}
{"ID":"CVE-2023-35844","Info":{"Name":"Lightdash version \u003c= 0.510.3 Arbitrary File Read","Severity":"high","Description":"packages/backend/src/routers in Lightdash before 0.510.3\nhas insecure file endpoints, e.g., they allow .. directory\ntraversal and do not ensure that an intended file extension\n(.csv or .png) is used.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-35844.yaml"}
{"ID":"CVE-2023-36287","Info":{"Name":"Webkul QloApps 1.6.0 - Cross-site Scripting","Severity":"medium","Description":"An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-36287.yaml"}
{"ID":"CVE-2023-36289","Info":{"Name":"Webkul QloApps 1.6.0 - Cross-site Scripting","Severity":"medium","Description":"An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-36289.yaml"}
{"ID":"CVE-2023-36346","Info":{"Name":"POS Codekop v2.0 - Cross-site Scripting","Severity":"medium","Description":"POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-36346.yaml"}

2
cves.json-checksum.txt
View File

@ -1 +1 @@
b830e8b5ef413ec8d972848bd93b95d8
4e9ea5be8a9b61669726b0fe75ee163e

2
dns/azure-takeover-detection.yaml
View File

@ -54,5 +54,3 @@ dns:
group: 1
regex:
- "IN\tCNAME\t(.+)"
# Enhanced by mp on 2022/03/13

4
dns/detect-dangling-cname.yaml
View File

@ -34,6 +34,4 @@ dns:
- type: regex
group: 1
regex:
- "IN\tCNAME\t(.+)"
# Enhanced by mp on 2022/03/13
- "IN\tCNAME\t(.+)"

4
dns/dmarc-detect.yaml
View File

@ -25,6 +25,4 @@ dns:
- type: regex
group: 1
regex:
- "IN\tTXT\t(.+)"
# Enhanced by md on 2023/04/20
- "IN\tTXT\t(.+)"

4
dns/dns-waf-detect.yaml
View File

@ -168,6 +168,4 @@ dns:
- type: word
name: edns
words:
- ".iidns.com"
# Enhanced by mp on 2022/03/13
- ".iidns.com"

4
dns/dnssec-detection.yaml
View File

@ -21,6 +21,4 @@ dns:
matchers:
- type: regex
regex:
- "IN\tDS\t(.+)"
# Enhanced by mp on 2022/03/14
- "IN\tDS\t(.+)"

4
dns/ec2-detection.yaml
View File

@ -21,6 +21,4 @@ dns:
- type: regex
regex:
- "ec2-[-\\d]+\\.compute[-\\d]*\\.amazonaws\\.com"
- "ec2-[-\\d]+\\.[\\w\\d\\-]+\\.compute[-\\d]*\\.amazonaws\\.com"
# Enhanced by mp on 2022/03/14
- "ec2-[-\\d]+\\.[\\w\\d\\-]+\\.compute[-\\d]*\\.amazonaws\\.com"

4
dns/elasticbeantalk-takeover.yaml
View File

@ -46,6 +46,4 @@ dns:
- type: regex
group: 1
regex:
- "IN\tCNAME\t(.+)"
# Enhanced by mp on 2022/03/14
- "IN\tCNAME\t(.+)"

4
dns/mx-fingerprint.yaml
View File

@ -27,6 +27,4 @@ dns:
- type: regex
group: 1
regex:
- "IN\tMX\t(.+)"
# Enhanced by mp on 2022/03/14
- "IN\tMX\t(.+)"

4
dns/mx-service-detector.yaml
View File

@ -80,6 +80,4 @@ dns:
name: "Proofpoint US"
words:
- "mx1-us1.ppe-hosted.com"
- "mx2-us1.ppe-hosted.com"
# Enhanced by mp on 2022/03/14
- "mx2-us1.ppe-hosted.com"

4
dns/nameserver-fingerprint.yaml
View File

@ -24,6 +24,4 @@ dns:
- type: regex
group: 1
regex:
- "IN\tNS\t(.+)"
# Enhanced by mp on 2022/03/14
- "IN\tNS\t(.+)"

4
dns/ptr-fingerprint.yaml
View File

@ -24,6 +24,4 @@ dns:
- type: regex
group: 1
regex:
- "IN\tPTR\t(.+)"
# Enhanced by mp on 2022/03/14
- "IN\tPTR\t(.+)"

4
dns/servfail-refused-hosts.yaml
View File

@ -20,6 +20,4 @@ dns:
- type: word
words:
- "SERVFAIL"
- "REFUSED"
# Enhanced by mp on 2022/03/14
- "REFUSED"

4
dns/spoofable-spf-records-ptr.yaml
View File

@ -22,6 +22,4 @@ dns:
words:
- "v=spf1"
- " ptr "
condition: and
# Enhanced by mp on 2022/03/14
condition: and

4
dns/txt-fingerprint.yaml
View File

@ -26,6 +26,4 @@ dns:
- type: regex
group: 1
regex:
- "IN\tTXT\t(.+)"
# Enhanced by mp on 2022/03/14
- "IN\tTXT\t(.+)"

4
dns/worksites-detection.yaml
View File

@ -20,6 +20,4 @@ dns:
matchers:
- type: word
words:
- "69.164.223.206"
# Enhanced by mp on 2022/03/14
- "69.164.223.206"

4
file/android/adb-backup-enabled.yaml
View File

@ -18,6 +18,4 @@ file:
matchers:
- type: word
words:
- "android:allowBackup=\"true\""
# Enhanced by mp on 2022/02/09
- "android:allowBackup=\"true\""

11
file/android/biometric-detect.yaml
View File

@ -1,9 +1,14 @@
id: biometric-detect
info:
name: Biometric or Fingerprint detect
name: Android Biometric/Fingerprint - Detect
author: gaurang
severity: info
description: Android Biometric/Fingerprint permission files were detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: android,file
file:
@ -14,4 +19,6 @@ file:
- type: word
words:
- "android.permission.USE_FINGERPRINT"
- "android.permission.USE_BIOMETRIC"
- "android.permission.USE_BIOMETRIC"
# Enhanced by md on 2023/05/02

11
file/android/certificate-validation.yaml
View File

@ -1,9 +1,14 @@
id: improper-certificate-validation
info:
name: Improper Certificate Validation
name: Android Improper Certificate Validation - Detect
author: gaurang
severity: medium
description: Android improper certificate validation was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-200
tags: android,file
file:
@ -13,4 +18,6 @@ file:
matchers:
- type: word
words:
- "Landroid/webkit/SslErrorHandler;->proceed()V"
- "Landroid/webkit/SslErrorHandler;->proceed()V"
# Enhanced by md on 2023/05/02

11
file/android/content-scheme.yaml
View File

@ -1,9 +1,14 @@
id: content-scheme
info:
name: Content Scheme Enabled
name: Android Content Scheme - Detect
author: gaurang
severity: info
description: Android content scheme enabling was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: android,file
file:
@ -13,4 +18,6 @@ file:
matchers:
- type: word
words:
- "android:scheme=\"content\""
- "android:scheme=\"content\""
# Enhanced by md on 2023/05/03

3
file/android/debug-enabled.yaml
View File

@ -4,6 +4,7 @@ info:
name: Android Debug Enabled
author: gaurang
severity: low
description: Android debug enabling was detected.
tags: android,file
file:
@ -13,4 +14,4 @@ file:
matchers:
- type: regex
regex:
- "android:debuggable=\"true\""
- "android:debuggable=\"true\""

9
file/android/deep-link-detect.yaml
View File

@ -1,13 +1,18 @@
id: deep-link-detect
info:
name: Deep Link Detection
name: Android Deep Link - Detect
author: Hardik-Solanki
severity: info
description: Android deep link functionality was detected.
reference:
- https://developer.android.com/training/app-links/deep-linking
- https://www.geeksforgeeks.org/deep-linking-in-android-with-example/
- https://medium.com/@muratcanbur/intro-to-deep-linking-on-android-1b9fe9e38abd
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: android,file,deeplink
@ -24,3 +29,5 @@ file:
- "android:host"
- "android:name"
condition: and
# Enhanced by md on 2023/05/02

11
file/android/dynamic-broadcast-receiver.yaml
View File

@ -1,9 +1,14 @@
id: dynamic-registered-broadcast-receiver
info:
name: Dynamic Registered Broadcast Receiver
name: Android Dynamic Broadcast Receiver Register - Detect
author: gaurang
severity: info
description: Android dynamic broadcast receiver register functionality was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: android,file
file:
@ -13,4 +18,6 @@ file:
matchers:
- type: word
words:
- ";->registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;)"
- ";->registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;)"
# Enhanced by md on 2023/05/02

11
file/android/file-scheme.yaml
View File

@ -1,9 +1,14 @@
id: file-scheme
info:
name: File Scheme Enabled
name: Android File Scheme - Detect
author: gaurang
severity: info
description: Android file scheme enabling was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: android,file
file:
@ -13,4 +18,6 @@ file:
matchers:
- type: word
words:
- "android:scheme=\"file\""
- "android:scheme=\"file\""
# Enhanced by md on 2023/05/03

9
file/android/provider-path.yaml
View File

@ -1,9 +1,14 @@
id: insecure-provider-path
info:
name: Insecure Provider Path
name: Android Insecure Provider Path - Detect
author: gaurang
severity: medium
description: Android insecure provider path was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-200
tags: android,file
file:
@ -15,3 +20,5 @@ file:
regex:
- "root-path name=\"[0-9A-Za-z\\-_]{1,10}\" path=\".\""
- "root-path name=\"[0-9A-Za-z\\-_]{1,10}\" path=\"\""
# Enhanced by md on 2023/05/02

11
file/android/webview-addjavascript-interface.yaml
View File

@ -1,9 +1,14 @@
id: webview-addjavascript-interface
info:
name: Webview addJavascript Interface Usage
name: Android WebView Add Javascript Interface - Detect
author: gaurang
severity: info
description: Android WebView Add Javascript interface usage was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-200
tags: android,file
file:
@ -13,4 +18,6 @@ file:
matchers:
- type: word
words:
- ";->addJavascriptInterface(Ljava/lang/Object;Ljava/lang/String;)V"
- ";->addJavascriptInterface(Ljava/lang/Object;Ljava/lang/String;)V"
# Enhanced by md on 2023/05/02

9
file/android/webview-javascript.yaml
View File

@ -1,9 +1,14 @@
id: webview-javascript-enabled
info:
name: Webview JavaScript enabled
name: WebView JavaScript - Detect
author: gaurang
severity: info
description: WebView Javascript enabling was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: android,file,javascript
file:
@ -14,3 +19,5 @@ file:
- type: word
words:
- "Landroid/webkit/WebSettings;->setJavaScriptEnabled(Z)V"
# Enhanced by md on 2023/05/03

11
file/android/webview-load-url.yaml
View File

@ -1,9 +1,14 @@
id: webview-load-url
info:
name: Webview loadUrl usage
name: WebView loadUrl - Detect
author: gaurang
severity: info
description: WebView loadUrl usage was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: android,file
file:
@ -13,4 +18,6 @@ file:
matchers:
- type: word
words:
- "Landroid/webkit/WebView;->loadUrl(Ljava/lang/String;)V"
- "Landroid/webkit/WebView;->loadUrl(Ljava/lang/String;)V"
# Enhanced by md on 2023/05/02

11
file/android/webview-universal-access.yaml
View File

@ -1,9 +1,14 @@
id: webview-universal-access
info:
name: Webview Universal Access enabled
name: Android WebView Universal Access - Detect
author: gaurang
severity: medium
description: Android WebView Universal Access enabling was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-200
tags: android,file
file:
@ -13,4 +18,6 @@ file:
matchers:
- type: word
words:
- "Landroid/webkit/WebSettings;->setAllowUniversalAccessFromFileURLs(Z)V"
- "Landroid/webkit/WebSettings;->setAllowUniversalAccessFromFileURLs(Z)V"
# Enhanced by md on 2023/05/03

10
file/audit/cisco/configure-aaa-service.yaml
View File

@ -1,13 +1,17 @@
id: configure-aaa-service
info:
name: Configure AAA service
name: Cisco AAA Service Configuration - Detect
author: pussycat0x
severity: info
description: |
Authentication, authorization and accounting (AAA) services provide an authoritative source for managing and monitoring access for devices.
Cisco authentication, authorization and accounting service configuration was detected.
reference:
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-cr-a2.html#GUID-E05C2E00-C01E-4053-9D12-EC37C7E8EEC5
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: cisco,config-audit,cisco-switch,file,router
file:
@ -24,3 +28,5 @@ file:
- type: word
words:
- "configure terminal"
# Enhanced by md on 2023/05/02

10
file/audit/cisco/configure-service-timestamps-debug.yaml
View File

@ -1,13 +1,17 @@
id: configure-service-timestamps-debug
info:
name: Configure Service Timestamps for Debug
name: Cisco Configure Service Timestamps for Debug - Detect
author: pussycat0x
severity: info
description: |
To configure the system to time-stamp debugging or logging messages, use one of the service timestamps global configuration commands. Use the no form of this command to disable this service.
The configuration for service timestamps on Cisco devices was not implemented for debugging purposes. It's important to note that timestamps can be added to either debugging or logging messages independently.
reference:
- https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: cisco,config-audit,cisco-switch,file,router
file:
@ -24,3 +28,5 @@ file:
- type: word
words:
- "configure terminal"
# Enhanced by md on 2023/05/02

10
file/audit/cisco/configure-service-timestamps-logmessages.yaml
View File

@ -1,13 +1,17 @@
id: configure-service-log-messages
info:
name: Configure Service Timestamps Log Messages
name: Cisco Configure Service Timestamps Log Messages - Detect
author: pussycat0x
severity: info
description: |
To configure the system to time-stamp debugging or logging messages, use one of the service timestamps global configuration commands. Use the no form of this command to disable this service.
Cisco service timestamp configuration for log messages was not implemented.
reference:
- https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: cisco,config-audit,cisco-switch,file,router
file:
@ -24,3 +28,5 @@ file:
- type: word
words:
- "configure terminal"
# Enhanced by md on 2023/05/02

9
file/audit/cisco/disable-ip-source-route.yaml
View File

@ -1,13 +1,18 @@
id: disable-ip-source-route
info:
name: Disable IP source-route
name: Cisco Disable IP Source-Route - Detect
author: pussycat0x
severity: info
description: |
Organizations should plan and implement network policies to ensure unnecessary services are explicitly disabled. The 'ip source-route' feature has been used in several attacks and should be disabled.
Cisco IP source-route functionality has been utilized in several attacks. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
remediation: Disable IP source-route where appropriate.
reference:
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-cr-book/ipaddr-i4.html#GUID-C7F971DD-358F-4B43-9F3E-244F5D4A3A93
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: cisco,config-audit,cisco-switch,file,router
file:

8
file/audit/cisco/disable-pad-service.yaml
View File

@ -1,13 +1,17 @@
id: disable-pad-service
info:
name: Disable PAD service
name: Cisco Disable PAD - Detect
author: pussycat0x
severity: info
description: |
To reduce the risk of unauthorized access, organizations should implement a security policy restricting unnecessary services such as the 'PAD' service.
Cisco PAD service has proven vulnerable to attackers. To reduce the risk of unauthorized access, organizations should implement a security policy restricting or disabling unnecessary access.
reference:
- http://www.cisco.com/en/US/docs/ios-xml/ios/wan/command/wan-s1.html#GUID-C5497B77-3FD4-4D2F-AB08-1317D5F5473B
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: cisco,config-audit,cisco-switch,file,router
file:

10
file/audit/cisco/logging-enable.yaml
View File

@ -1,13 +1,17 @@
id: logging-enable
info:
name: Logging enable
name: Cisco Logging Enable - Detect
author: pussycat0x
severity: info
description: |
Enabling the Cisco IOS 'logging enable' command enforces the monitoring of technology risks for the organizations' network devices.
Cisco logging 'logging enable' enable command enforces the monitoring of technology risks for organizations' network devices.
reference:
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/xe-16-6/config-mgmt-xe-16-6-book/cm-config-logger.pdf
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: cisco,config-audit,cisco-switch,file
file:
@ -24,3 +28,5 @@ file:
- type: word
words:
- "configure terminal"
# Enhanced by md on 2023/05/03

10
file/audit/cisco/set-and-secure-passwords.yaml
View File

@ -1,13 +1,17 @@
id: set-and-secure-passwords
info:
name: Set and secure passwords
name: Cisco Set and Secure Password - Detect
author: pussycat0x
severity: info
description: |
To set a local password to control access to various privilege levels, use the enable password command in global configuration mode. To remove the password requirement, use the no form of this command.
Cisco set and secure password functionality is recommended to control privilege level access. To set a local password to control access to various privilege levels, use the enable password command in global configuration mode. To remove the password requirement, use the no form of this command.
reference:
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-cr-book/sec-cr-e1.html#wp3884449514
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: cisco,config-audit,cisco-switch,file
file:
@ -24,3 +28,5 @@ file:
- type: word
words:
- "configure terminal"
# Enhanced by md on 2023/05/03

10
file/audit/fortigate/auto-usb-install.yaml
View File

@ -1,11 +1,15 @@
id: auto-usb-install
info:
name: Auto USB Installation Enabled
name: Fortinet Auto USB Installation Enabled - Detect
author: pussycat0x
severity: info
description: If USB installation is not disabled, an attacker with physical access to a FortiGate could load a new configuration or firmware using the USB port.
description: Via Fortinet Auto USB installation, an attacker with physical access to a FortiGate can load a new configuration or firmware using the USB port, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: audit,config,file,firewall,fortigate
file:
@ -26,3 +30,5 @@ file:
- "config router"
- "config firewall"
condition: or
# Enhanced by md on 2023/05/03

11
file/audit/fortigate/heuristic-scan.yaml
View File

@ -1,11 +1,16 @@
id: heuristic-scan
info:
name: Heuristic scanning is not configured
name: Fortinet Heuristic Scanning not Configured - Detect
author: pussycat0x
severity: info
description: Heuristic scanning is a technique used to identify previously unknown viruses. A value of block enables heuristic AV scanning of binary files and blocks any detected. A replacement message will be forwarded to the recipient. Blocked files are quarantined if quarantine is enabled.
description: |
Fortinet heuristic scanning configuration is advised to thwart attacks. Heuristic scanning is a technique used to identify previously unknown viruses. A value of block enables heuristic AV scanning of binary files and blocks any detected. A replacement message is forwarded to the recipient, and blocked files are quarantined if quarantine is enabled.
reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: audit,config,file,firewall,fortigate
file:
@ -26,3 +31,5 @@ file:
- "config router"
- "config firewall"
condition: or
# Enhanced by md on 2023/05/03

10
file/audit/fortigate/inactivity-timeout.yaml
View File

@ -1,11 +1,15 @@
id: inactivity-timeout
info:
name: Inactivity Timeout Not Implemented
name: Fortinet Inactivity Timeout Not Implemented - Detect
author: pussycat0x
severity: info
description: Lack of Inactivity Timeout gives the unauthorized user to act within that threshold if the administrator is away from the computer.
description: If Fortinet inactivity timeout functionality is disabled, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations within that window if the administrator is away from the computer.
reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: audit,config,file,firewall,fortigate
file:
@ -25,3 +29,5 @@ file:
- "config router"
- "config firewall"
condition: or
# Enhanced by md on 2023/05/03

8
file/audit/fortigate/maintainer-account.yaml
View File

@ -1,11 +1,15 @@
id: maintainer-account
info:
name: Maintainer Account Not Implemented
name: Fortinet Maintainer Account Not Implemented - Detect
author: pussycat0x
severity: info
description: If the FortiGate is compromised and Password is not recoverable. A maintainer account can be used by an administrator with physical access to log into CLI..
description: In Fortinet, if a FortiGate is compromised and the password is not recoverable, a maintainer account can be used by an administrator with physical access to log into CLI.
reference: https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: audit,config,file,firewall,fortigate
file:

8
file/audit/fortigate/password-policy.yaml
View File

@ -1,11 +1,15 @@
id: password-policy
info:
name: Password Policy not Set
name: Fortinet Password Policy Not Set - Detect
author: pussycat0x
severity: info
description: The Administrative Password Policy is not set. Use the password policy feature to ensure all administrators use secure passwords that meet your organization's requirements.
description: Fortinet administrative password policy is not set. Using this feature is recommended to ensure all administrators use secure passwords that meet organizations' requirements.
reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/system-administrator-best-practices
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: fortigate,config,audit,file,firewall
file:

11
file/audit/fortigate/remote-auth-timeout.yaml
View File

@ -1,11 +1,16 @@
id: remote-auth-timeout
info:
name: Remote Authentication timeout not set
name: Fortinet Remote Authentication Timeout Not Set - Detect
author: pussycat0x
severity: info
description: Lack of Inactivity Timeout gives the unauthorized user to act within that threshold if the administrator is away from the computer.
reference: https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
description: Fortinet remote authentication timeout functionality is recommended to be enabled. Lack of a set timeout can allow an attacker to act within that threshold if the administrator is away from the computer, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
reference:
- https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: audit,config,file,firewall,fortigate
file:

8
file/audit/fortigate/scp-admin.yaml
View File

@ -1,11 +1,15 @@
id: scp-admin
info:
name: Admin-SCP Disabled
name: Fortinet Admin-SCP Disabled - Detect
author: pussycat0x
severity: info
description: Disable SCP by default. Enabling SCP allows downloading the configuration file from the FortiGate as an alternative method of backing up the configuration file.
description: Fortinet Admin-SCP functionality is recommended to be disabled by default. Enabling SCP allows download of the configuration file from the FortiGate as an alternative method of backing up the configuration file.
reference: https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/612504/hardening-your-fortigate
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: audit,config,file,firewall,fortigate
file:

10
file/audit/pfsense/configure-dns-server.yaml
View File

@ -1,13 +1,17 @@
id: configure-dns-server
info:
name: Configure DNS Server
name: DNS Server Not Implemented - Detect
author: pussycat0x
severity: info
description: |
The purpose DNs server is to perform the resolution of system hostnames to Internet Protocol (IP) addresses.
DNS is recommended to be configured over TLS. This prevents intermediate parties and potential attackers from viewing the content of DNS queries and can also assure that DNS is being provided by the expected DNS servers.
reference: |
https://docs.netgate.com/pfsense/en/latest/recipes/dns-over-tls.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: firewall,config,audit,pfsense,file
@ -28,3 +32,5 @@ file:
- "<pfsense>"
- "<system>"
condition: and
# Enhanced by md on 2023/05/04

10
file/audit/pfsense/configure-session-timeout.yaml
View File

@ -1,13 +1,17 @@
id: configure-session-timeout
info:
name: Configure Sessions Timeout
name: PfSence Configure Sessions Timeout Not Set - Detect
author: pussycat0x
severity: info
description: |
Indefinite or even long session timeout window increase the risk of attackers abusing abandoned sessions.
Configure sessions timeout is recommended to be enabled. An indefinite or even long session timeout window can increase the risk of an attacker abusing abandoned sessions and potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
reference: |
https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: firewall,config,audit,pfsense,file
@ -31,3 +35,5 @@ file:
- "<webgui>"
- "<system>"
condition: and
# Enhanced by md on 2023/05/04

11
file/audit/pfsense/enable-https-protocol.yaml
View File

@ -1,14 +1,17 @@
id: enable-https-protocol
info:
name: Enable HTTPS on Web Management
name: Pfsence Web Admin Management Portal HTTPS Not Set - Detect
author: pussycat0x
severity: info
description: |
Web Admin Management Portal should only be accessed using HTTPS Protocol.HTTP transmits all data (including passwords) in clear text over the network and
provides no assurance of the identity of the hosts involved.
PfSence Web Admin Management Portal is recommended to be accessible using only HTTPS protocol. HTTP transmits all data, including passwords, in clear text over the network and provides no assurance of the identity of the hosts involved, making it possible for an attacker to obtain sensitive information, modify data, and/or execute unauthorized operations.
reference: |
https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: firewall,config,audit,pfsense,file
@ -31,3 +34,5 @@ file:
- "<pfsense>"
- "<system>"
condition: and
# Enhanced by md on 2023/05/04

13
file/audit/pfsense/known-default-account.yaml
View File

@ -1,16 +1,17 @@
id: known-default-account
info:
name: Known Default Account - Detect
name: PfSence Known Default Account - Detect
author: pussycat0x
severity: info
description: |
In order to attempt access to known devices' platforms, attackers use the available database of the known default accounts for each platform or Operating System.
The known default accounts are often (without limiting to) the following: 'admin'.
PfSence configured known default accounts are recommended to be deleted. In order to attempt access to known devices' platforms, an attacker can use the available database of the known default accounts for each platform or operating system. Known default accounts are often, but not limited to, 'admin'.
reference: |
- https://docs.netgate.com/pfsense/en/latest/usermanager/defaults.html
remediation: |
Deletes the known default accounts configured.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: audit,config,file,firewall,pfsense
file:
@ -25,3 +26,5 @@ file:
- "<descr><![CDATA[System Administrator]]></descr>"
- "<priv>user-shell-access</priv>"
condition: and
# Enhanced by md on 2023/05/04

10
file/audit/pfsense/password-protected-consolemenu.yaml
View File

@ -1,13 +1,17 @@
id: password-protected-consolemenu
info:
name: Configure Password Protected on Console Menu
name: PfSence Consolemenu Password Protection Not Implememnted - Detect
author: pussycat0x
severity: info
description: |
An unattended computer with an open Console Menu session to the device could allow an unauthorized user access to the firewall’s management.
PfSence password protection via the Console Menu is recommended to be configured. An unattended computer with an open Console Menu session can allow an unauthorized user access to the firewall management.
reference: |
https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: firewall,config,audit,pfsense,file
@ -31,3 +35,5 @@ file:
- "<webgui>"
- "<system>"
condition: and
# Enhanced by md on 2023/05/04

11
file/audit/pfsense/set-hostname.yaml
View File

@ -1,14 +1,17 @@
id: set-hostname
info:
name: Ensure Hostname is Set
name: PfSence Hostname Not Set - Detect
author: pussycat0x
severity: info
description: |
Ensure Hostname is set is a process that helps to ensure that the computer or device is being identified correctly on a network.
The hostname is a unique identifier for the device, and it is important that it is properly set so that other devices on the network can identify it.
PfSence Hostname should be set so that other devices on the network can correctly identify it. The hostname is a unique identifier for the device.
reference: |
https://docs.netgate.com/pfsense/en/latest/config/general.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: firewall,config,audit,pfsense,file
file:
@ -23,3 +26,5 @@ file:
- "<hostname></hostname>"
- "domain>"
condition: and
# Enhanced by md on 2023/05/04

6
file/electron/electron-version-detect.yaml
View File

@ -1,11 +1,15 @@
id: electron-version-detect
info:
name: Electron Version Detect
name: Electron Version - Detect
author: me9187
severity: info
reference:
- https://www.electronjs.org/blog/chromium-rce-vulnerability/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: electron,file
file:

4
file/electron/node-integration-enabled.yaml
View File

@ -19,6 +19,4 @@ file:
- type: word
words:
- "nodeIntegration: true"
# Enhanced by mp on 2022/05/19
- "nodeIntegration: true"

22
file/keys/adafruit-key.yaml Normal file
View File

@ -0,0 +1,22 @@
id: adafruit-key
info:
name: Adafruit API Key
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adafruit-api-key.yaml
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adafruit-api-key.go
metadata:
verified: true
tags: adafruit,file,keys
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)(?:adafruit)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9_-]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

22
file/keys/adobe/adobe-client.yaml Normal file
View File

@ -0,0 +1,22 @@
id: adobe-client
info:
name: Adobe Client ID
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adobe-client-id.yaml
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/adobe-client-id.go
metadata:
verified: true
tags: adobe,file,token
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)(?:adobe)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

0
file/keys/adobe-secret.yaml → file/keys/adobe/adobe-secret.yaml
View File

22
file/keys/airtable-key.yaml Normal file
View File

@ -0,0 +1,22 @@
id: airtable-key
info:
name: Airtable API Key
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/airtable-api-key.yaml
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/airtable-api-key.go
metadata:
verified: true
tags: airtable,file,token
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)(?:airtable)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{17})(?:['|\"|\n|\r|\s|\x60|;]|$)

22
file/keys/algolia-key.yaml Normal file
View File

@ -0,0 +1,22 @@
id: algolia-key
info:
name: Algolia API Key
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/algolia-api-key.yaml
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/algolia-api-key.go
metadata:
verified: true
tags: algolia,file,keys
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)(?:algolia)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

22
file/keys/alibaba/alibaba-key-id.yaml Normal file
View File

@ -0,0 +1,22 @@
id: alibaba-key-id
info:
name: Alibaba Access Key ID
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/alibaba-access-key-id.yaml
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/alibaba-access-key-id.go
metadata:
verified: true
tags: alibaba,access,file,keys
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)\b((LTAI)(?i)[a-z0-9]{20})(?:['|\"|\n|\r|\s|\x60|;]|$)

22
file/keys/alibaba/alibaba-secret-id.yaml Normal file
View File

@ -0,0 +1,22 @@
id: alibaba-secret-id
info:
name: Alibaba Secret Key ID
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/alibaba-secret-key.yaml
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/alibaba-secret-key.go
metadata:
verified: true
tags: alibaba,secret,file,keys
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)(?:alibaba)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{30})(?:['|\"|\n|\r|\s|\x60|;]|$)

11
file/keys/amazon/amazon-account-id.yaml
View File

@ -1,11 +1,16 @@
id: amazon-account-id
info:
name: AWS Account ID
name: Amazon Web Services Account ID - Detect
author: DhiyaneshDK
severity: info
description: Amazon Web Services Account ID token was detected.
reference:
- https://github.com/praetorian-inc/noseyparker/blob/main/data/default/rules/aws.yml
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: aws,amazon,token,file
@ -18,4 +23,6 @@ file:
- type: regex
part: body
regex:
- '(?i)aws_?(?:account)_?(?:id)?["''`]?\s{0,30}(?::|=>|=)\s{0,30}["''`]?([0-9]{4}-?[0-9]{4}-?[0-9]{4})'
- '(?i)aws_?(?:account)_?(?:id)?["''`]?\s{0,30}(?::|=>|=)\s{0,30}["''`]?([0-9]{4}-?[0-9]{4}-?[0-9]{4})'
# Enhanced by md on 2023/05/04

9
file/keys/amazon/amazon-mws-auth-token.yaml
View File

@ -1,9 +1,14 @@
id: amazon-mws-auth-token-value
info:
name: Amazon MWS Auth Token
name: Amazon MWS Authentication Token - Detect
author: gaurang
severity: medium
description: Amazon MWS authentication token was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-200
tags: token,file,amazon,auth
file:
@ -14,3 +19,5 @@ file:
- type: regex
regex:
- "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
# Enhanced by md on 2023/05/04

11
file/keys/amazon/amazon-session-token.yaml
View File

@ -1,11 +1,16 @@
id: amazon-session-token
info:
name: Amazon Session Token
name: Amazon Session Token - Detect
author: DhiyaneshDK
severity: info
description: Amazon session token was detected.
reference:
- https://github.com/praetorian-inc/noseyparker/blob/main/data/default/rules/aws.yml
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: aws,amazon,token,file,session
@ -18,4 +23,6 @@ file:
- type: regex
part: body
regex:
- '(?i)(?:aws.?session|aws.?session.?token|aws.?token)["''`]?\s{0,30}(?::|=>|=)\s{0,30}["''`]?([a-z0-9/+=]{16,200})[^a-z0-9/+=]'
- '(?i)(?:aws.?session|aws.?session.?token|aws.?token)["''`]?\s{0,30}(?::|=>|=)\s{0,30}["''`]?([a-z0-9/+=]{16,200})[^a-z0-9/+=]'
# Enhanced by md on 2023/05/04

9
file/keys/amazon/amazon-sns-token.yaml
View File

@ -1,9 +1,14 @@
id: amazon-sns-token
info:
name: Amazon SNS Token Detect
name: Amazon SNS Token - Detect
author: TheBinitGhimire
severity: info
description: Amazon SNS token was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: file,token,amazon,aws
file:
@ -15,3 +20,5 @@ file:
name: amazon-sns-topic
regex:
- 'arn:aws:sns:[a-z0-9\-]+:[0-9]+:[A-Za-z0-9\-_]+'
# Enhanced by md on 2023/05/04

9
file/keys/amazon/aws-access-id.yaml
View File

@ -1,9 +1,14 @@
id: aws-access-key
info:
name: AWS Access Key ID
name: Amazon Web Services Access Key ID - Detect
author: gaurang
severity: info
description: Amazon Web Services Access Key ID token was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: token,file
file:
@ -14,3 +19,5 @@ file:
- type: regex
regex:
- "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
# Enhanced by md on 2023/05/04

9
file/keys/amazon/aws-cognito.yaml
View File

@ -1,9 +1,14 @@
id: aws-cognito-pool
info:
name: AWS Cognito Pool ID
name: Amazon Web Services Cognito Pool ID - Detect
author: gaurang
severity: info
description: Amazon Web Services Cognito Pool ID token was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: token,file
file:
@ -30,3 +35,5 @@ file:
- "us-west-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
- "us-west-2:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
- "sa-east-1:[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}"
# Enhanced by md on 2023/05/04

22
file/keys/asana/asana-clientid.yaml Normal file
View File

@ -0,0 +1,22 @@
id: asana-clientid
info:
name: Asana Client ID
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/asana-client-id.go
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/asana-client-id.yaml
metadata:
verified: true
tags: asana,client,file,keys
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)(?:asana)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([0-9]{16})(?:['|\"|\n|\r|\s|\x60|;]|$)

22
file/keys/asana/asana-clientsecret.yaml Normal file
View File

@ -0,0 +1,22 @@
id: asana-clientsecret
info:
name: Asana Client Secret
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/asana-client-secret.go
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/asana-client-secret.yaml
metadata:
verified: true
tags: asana,client,file,keys,secret
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)(?:asana)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

22
file/keys/atlassian/atlassian-api-token.yaml Normal file
View File

@ -0,0 +1,22 @@
id: atlassian-api-token
info:
name: Atlassian API Token
author: DhiyaneshDK
severity: info
reference:
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/atlassian-api-token.go
- https://github.com/returntocorp/semgrep-rules/blob/develop/generic/secrets/gitleaks/atlassian-api-token.yaml
metadata:
verified: true
tags: atlassian,file,token,api
file:
- extensions:
- all
extractors:
- type: regex
part: body
regex:
- (?i)(?:atlassian|confluence|jira)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:=|\|\|:|<=|=>|:)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{24})(?:['|\"|\n|\r|\s|\x60|;]|$)

9
file/keys/branch-key.yaml
View File

@ -1,11 +1,16 @@
id: branch-key
info:
name: Branch.io Live Key
name: Branch.io Live Key - Detect
author: 0xh7ml
severity: info
description: Branch.io live key token was detected.
reference:
- https://github.com/BranchMetrics/android-branch-deep-linking-attribution/issues/74
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: token,file
file:
@ -16,3 +21,5 @@ file:
- type: regex
regex:
- "key_live_.{32}"
# Enhanced by md on 2023/05/04

9
file/keys/cloudinary.yaml
View File

@ -1,9 +1,14 @@
id: cloudinary-basic-auth
info:
name: Cloudinary Basic Auth
name: Cloudinary Basic Authorization - Detect
author: gaurang
severity: high
description: Cloudinary basic authorization token was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-200
tags: token,file,cloudinary
file:
@ -14,3 +19,5 @@ file:
- type: regex
regex:
- "cloudinary://[0-9]{15}:[0-9A-Za-z\\-_]+@[0-9A-Za-z\\-_]+"
# Enhanced by md on 2023/05/04

11
file/keys/code-climate-token.yaml
View File

@ -1,12 +1,17 @@
id: code-climate-token
info:
name: Code Climate Token
name: Code Climate Token - Detect
author: DhiyaneshDK
severity: info
description: Code Climate token was detected.
reference:
- https://github.com/praetorian-inc/noseyparker/blob/main/data/default/rules/codeclimate.yml
- https://github.com/codeclimate/ruby-test-reporter/issues/34
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: codeclimate,token,file
@ -19,4 +24,6 @@ file:
- type: regex
part: body
regex:
- '(?i)codeclima.{0,50}\b([a-f0-9]{64})\b'
- '(?i)codeclima.{0,50}\b([a-f0-9]{64})\b'
# Enhanced by md on 2023/05/04

11
file/keys/cratesio-api-key.yaml
View File

@ -1,13 +1,18 @@
id: cratesio-api-key
info:
name: Crates.io API Key
name: Crates.io API Key - Detect
author: DhiyaneshDK
severity: info
description: Crates.io API key was detected.
reference:
- https://github.com/praetorian-inc/noseyparker/blob/main/data/default/rules/crates.io.yml
- https://crates.io/data-access
- https://github.com/rust-lang/crates.io/blob/master/src/util/token.rs
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
metadata:
verified: true
tags: crates,token,file
@ -20,4 +25,6 @@ file:
- type: regex
part: body
regex:
- '\bcio[a-zA-Z0-9]{32}\b'
- '\bcio[a-zA-Z0-9]{32}\b'
# Enhanced by md on 2023/05/04

19
file/keys/credential-exposure.yaml
View File

@ -1,6 +1,13 @@
id: credentials-disclosure-file
# Extract secrets regex like api keys, password, token, etc ... for different services
info:
name: Credentials Disclosure Check
author: Sy3Omda,geeknik,forgedhallpass,ayadi
severity: unknown
description: Check for multiple keys/tokens/passwords hidden inside of files.
tags: exposure,token,file,disclosure
# Extract secrets regex like api keys, password, token, etc ... for different services.
# Always validate the leaked key/tokens/passwords to make sure it's valid, a token/keys without any impact is not an valid issue.
# Severity is not fixed in this case, it varies from none to critical depending upon impact of disclosed key/tokes.
# Regex count:- 687
@ -9,14 +16,6 @@ id: credentials-disclosure-file
# This template requires manual inspection once found valid match.
# Generic token could be anything matching below regex.
# Impact of leaked token depends on validation of leaked token.
info:
name: Credentials Disclosure Check
author: Sy3Omda,geeknik,forgedhallpass,ayadi
severity: unknown
description: Look for multiple keys/tokens/passwords hidden inside of files.
tags: exposure,token,file,disclosure
# The regexes are copied from exposures/tokens/generic/credentials-disclosure.yaml
# TODO After https://github.com/projectdiscovery/nuclei/issues/1510 is implemented, we should be able to re-use them, instead of duplicating
# Example cases to match against: https://regex101.com/r/HPtaU2/1
@ -719,3 +718,5 @@ file:
- "(?i)[\"']?access[_-]?secret[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
- "(?i)[\"']?access[_-]?key[_-]?secret[\"']?[^\\S\r\n]*[=:][^\\S\r\n]*[\"']?[\\w-]+[\"']?"
- "(?i)(([a-z0-9]+)[-|_])?(key|password|passwd|pass|pwd|private|credential|auth|cred|creds|secret|access|token)([-|_][a-z]+)?(\\s)*(:|=)+"
# Enhanced by md on 2023/05/04

9
file/keys/credentials.yaml
View File

@ -1,9 +1,14 @@
id: basic-auth-creds
info:
name: Basic Auth Credentials
name: Basic Authorization Credentials Check
author: gaurang
severity: high
description: Basic authorization credentials check was conducted.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-200
tags: token,file,auth
file:
@ -14,3 +19,5 @@ file:
- type: regex
regex:
- "[a-zA-Z]{3,10}://[^/\\s:@]{3,20}:[^/\\s:@]{3,20}@.{1,100}[\"'\\s]"
# Enhanced by md on 2023/05/04

11
file/keys/dynatrace-token.yaml
View File

@ -1,9 +1,14 @@
id: dynatrace-token
info:
name: Dynatrace Token
name: Dynatrace Token - Detect
author: gaurang
severity: high
description: Dynatrace token was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-200
tags: token,file
file:
@ -13,4 +18,6 @@ file:
extractors:
- type: regex
regex:
- "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}"
- "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}"
# Enhanced by md on 2023/05/04

9
file/keys/facebook/facebook-client-id.yaml
View File

@ -1,9 +1,14 @@
id: facebook-client-id
info:
name: Facebook Client ID
name: Facebook Client ID - Detect
author: gaurang
severity: info
description: Facebook client ID token was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0.0
cwe-id: CWE-200
tags: token,file,facebook
file:
@ -14,3 +19,5 @@ file:
- type: regex
regex:
- "(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]"
# Enhanced by md on 2023/05/04

5
file/keys/facebook/facebook-secret.yaml
View File

@ -1,9 +1,10 @@
id: facebook-secret-key
info:
name: Facebook Secret Key
name: Facebook Secret Key - Detect
author: gaurang
severity: low
description: Facebook secret key token was detected.
tags: token,file,facebook
file:
@ -14,3 +15,5 @@ file:
- type: regex
regex:
- "(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]"
# Enhanced by md on 2023/05/04

4
file/logs/python-app-sql-exceptions.yaml
View File

@ -22,6 +22,4 @@ file:
- 'DataError'
- 'IntegrityError'
- 'ProgrammingError'
- 'OperationalError'
# Enhanced by mp on 2022/10/05
- 'OperationalError'

4
file/logs/suspicious-sql-error-messages.yaml
View File

@ -39,6 +39,4 @@ file:
part: body
regex:
- 'near \"\*\"\: syntax error'
- 'SELECTs to the left and right of UNION do not have the same number of result columns'
# Enhanced by mp on 2022/10/12
- 'SELECTs to the left and right of UNION do not have the same number of result columns'

5
file/xss/dom-xss.yaml
View File

@ -18,6 +18,7 @@ file:
- js
- ts
- html
- htm
- php
- cs
- rb
@ -48,6 +49,4 @@ file:
regex:
- 'location(\.href|\.hash|\.search|\.pathname)?'
- 'window\.name'
- 'document(\.URL|\.referrer|\.documentURI|\.baseURI|\.cookie)'
# Enhanced by mp on 2022/09/14
- 'document(\.URL|\.referrer|\.documentURI|\.baseURI|\.cookie)'

4
headless/headless-open-redirect.yaml
View File

@ -121,6 +121,4 @@ headless:
words:
- "evil.com"
- "Evil.Com - We get it...Daily."
condition: and
# Enhanced by cs on 2023/03/10
condition: and

4
headless/window-name-domxss.yaml
View File

@ -91,6 +91,4 @@ headless:
- type: kval
part: alerts
kval:
- alerts
# Enhanced by mp on 2022/09/14
- alerts

2
helpers/wordpress/plugins/all-in-one-seo-pack.txt
View File

@ -1 +1 @@
4.4.0.1
4.4.1

2
helpers/wordpress/plugins/breeze.txt
View File

@ -1 +1 @@
2.0.26
2.0.27

2
helpers/wordpress/plugins/code-snippets.txt
View File

@ -1 +1 @@
3.4.1
3.4.2

2
helpers/wordpress/plugins/complianz-gdpr.txt
View File

@ -1 +1 @@
6.4.7
6.5.0

2
helpers/wordpress/plugins/essential-addons-for-elementor-lite.txt
View File

@ -1 +1 @@
5.8.0
5.8.1

2
helpers/wordpress/plugins/facebook-for-woocommerce.txt
View File

@ -1 +1 @@
3.0.26
3.0.27

2
helpers/wordpress/plugins/forminator.txt
View File

@ -1 +1 @@
1.24.4
1.24.6

2
helpers/wordpress/plugins/gutenberg.txt
View File

@ -1 +1 @@
16.1.0
16.1.1

2
helpers/wordpress/plugins/header-footer-code-manager.txt
View File

@ -1 +1 @@
1.1.34
1.1.35

2
helpers/wordpress/plugins/jetpack.txt
View File

@ -1 +1 @@
12.2.1
12.3

2
helpers/wordpress/plugins/mailpoet.txt
View File

@ -1 +1 @@
4.20.0
4.20.1

2
helpers/wordpress/plugins/ml-slider.txt
View File

@ -1 +1 @@
3.32.0
3.33.0

2
helpers/wordpress/plugins/nextgen-gallery.txt
View File

@ -1 +1 @@
3.36
3.37

2
helpers/wordpress/plugins/ninja-forms.txt
View File

@ -1 +1 @@
3.6.25
3.6.28

2
helpers/wordpress/plugins/pixelyoursite.txt
View File

@ -1 +1 @@
9.3.9
9.4.0.1

Some files were not shown because too many files have changed in this diff Show More