daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,600 Commits
18 Branches
0 Tags
171 MiB
Commit Graph

527 Commits (c05df76ed27ef2ce0607d9f571f6aaedc44509e8)

Author SHA1 Message Date
Prince Chaddha 58fd372498
Update and rename qihang-media-web-lfi.yaml to qihang-media-lfi.yaml 2021-10-01 16:28:20 +05:30
Prince Chaddha ea71661d79
Update and rename qihang-media-web-credentials-disclosure.yaml to qihang-media-disclosure.yaml 2021-10-01 16:26:25 +05:30
GwanYeong Kim f750bf5ba5 Create qihang-media-web-credentials-disclosure.yaml 
The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack.

Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
 2021-10-01 15:42:48 +09:00
GwanYeong Kim 90138f44d1 Create qihang-media-web-lfi.yaml 
The application suffers from an unauthenticated file disclosure vulnerability when input passed thru the filename parameter when using the download action or thru path parameter when using the getAll action is not properly verified before being used. This can be exploited to disclose contents of files and directories from local resources.

Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
 2021-10-01 15:35:12 +09:00
Sullo c9a374bed5 renamed: simple-employee-rce.yaml -> ../../cves/2019/CVE-2019-20183.yaml 2021-09-30 13:06:46 -04:00
Sullo 28def083f6 Merge branch 'master' of https://github.com/sullo/nuclei-templates 
Fix typo for cvss
 2021-09-30 13:03:09 -04:00
Sullo 3878138bfe * Added Host headers where needed (validated via disclosures/posts) 
* Added CVE simple-employee-rce.yaml
 2021-09-30 12:52:05 -04:00
Prince Chaddha f839f628b6
Update and rename fatpipe-networks-warp-backdoor.yaml to fatpipe-backdoor.yaml 2021-09-30 17:18:45 +05:30
Prince Chaddha b65719103f
Update and rename fatpipe-networks-warp-auth-bypass.yaml to fatpipe-auth-bypass.yaml 2021-09-30 17:18:21 +05:30
Prince Chaddha 9e25b4871e
Update fatpipe-networks-warp-backdoor.yaml 2021-09-30 16:13:19 +05:30
GwanYeong Kim 606d2b5ea4 Create fatpipe-networks-warp-backdoor.yaml 
The application has a hidden administrative account cmuser that has no password and has write access permissions to the device. The user cmuser is not visible in Users menu list of the application.

Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
 2021-09-30 13:38:01 +09:00
GwanYeong Kim 263cadaacf Create fatpipe-networks-warp-auth-bypass.yaml 
Improper access control occurs when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages.

Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
 2021-09-30 11:07:24 +09:00
Prince Chaddha 8d7e5b2d24
Merge pull request #2748 from gy741/rule-add-v60 
Create commax-cctv-rtsp-credentials-disclosure.yaml
 2021-09-25 11:49:18 +05:30
Prince Chaddha 2808f46429
Update and rename commax-cctv-rtsp-credentials-disclosure.yaml to commax-credentials-disclosure.yaml 2021-09-25 11:32:31 +05:30
Prince Chaddha 2e7e35eb70
Update and rename ecoa-building-directory-traversal.yaml to ecoa-building-lfi.yaml 2021-09-25 11:22:48 +05:30
GwanYeong Kim fac7f96b34 Create ecoa-building-directory-traversal.yaml 
The BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device

Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
 2021-09-25 08:58:58 +09:00
GwanYeong Kim 59e0eb7ad3 Create commax-cctv-rtsp-credentials-disclosure.yaml 
The COMMAX CCTV Bridge for the DVR service allows an unauthenticated attacker
to disclose RTSP credentials in plain-text.

Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
 2021-09-25 08:43:18 +09:00
sandeep 18142906f0 moving files around 2021-09-22 18:09:43 +05:30
PikPikcU 991963fe4a
Update Severity 2021-09-20 12:11:56 +07:00
Muhammad Daffa 50dfd3dc3d
Update Severity 2021-09-18 21:07:47 +07:00
Sandeep Singh 0f03f5ff55
Merge pull request #2692 from projectdiscovery/metadata-attribute-update 2021-09-18 18:19:07 +05:30
sandeep 8c28120218 Update luftguitar-arbitrary-file-upload.yaml 2021-09-18 14:32:13 +05:30
sandeep fb1aee75ce Update luftguitar-arbitrary-file-upload.yaml 2021-09-18 14:28:03 +05:30
Prince Chaddha 63cc624c4a
Update luftguitar-arbitrary-file-upload.yaml 2021-09-18 12:14:32 +05:30
PikPikcU 2a1341274a
Create luftguitar-arbitrary-file-upload.yaml 2021-09-17 21:04:21 +07:00
Prince Chaddha df59ad5670
Update and rename ecoa-building-automation-lfd.yaml to vulnerabilities/other/ecoa-building-automation-lfd.yaml 2021-09-17 16:39:09 +05:30
sandeep 676b51d20c Metadata attribute update 2021-09-16 21:24:33 +05:30
Prince Chaddha 18879698fa
Update bullwark-momentum-lfi.yaml 2021-09-13 15:55:14 +05:30
Prince Chaddha e18cc14218
Update bullwark-momentum-lfi.yaml 2021-09-13 15:34:18 +05:30
sandeep 546bd6a038 matcher update 2021-09-13 15:28:35 +05:30
sandeep 207c140c50 moving files around 2021-09-11 21:06:36 +05:30
Sandeep Singh cf4ef2ac5a
Merge pull request #2622 from projectdiscovery/missing-tags 2021-09-10 12:32:47 +05:30
sandeep bd24dc198e Coverage for all templates using tags 2021-09-09 19:08:13 +05:30
Prince Chaddha 67766f381a
Merge pull request #2600 from Akokonunes/patch-35 
Create phpwiki-lfi.yaml
 2021-09-09 15:02:41 +05:30
Prince Chaddha 6ce33e2f47
Rename phpwiki-lfi.yaml to vulnerabilities/other/phpwiki-lfi.yaml 2021-09-09 15:01:35 +05:30
Prince Chaddha 08dac56385
Update simple-employee-rce.yaml 2021-09-09 12:06:24 +05:30
sandeep 609705f676 removed extra headers not required for template 2021-09-08 17:47:19 +05:30
Prince Chaddha 9b75486616
Rename homeautomation-v3-openredirect.yaml to vulnerabilities/other/homeautomation-v3-openredirect.yaml 2021-09-07 18:07:48 +05:30
Sandeep Singh e6a71e0e80
Merge pull request #2593 from projectdiscovery/openvpn-hhi 
Added OpenVPN Host Header Injection
 2021-09-06 18:56:27 +05:30
Prince Chaddha 4075664390
Merge pull request #2580 from Akokonunes/patch-29 
Create gSOAP-LFl.yaml
 2021-09-06 17:36:18 +05:30
Prince Chaddha e9d5665383
Update gsoap-lfi.yaml 2021-09-06 17:34:51 +05:30
Prince Chaddha 1942d13ed6
Update openvpn-hhi.yaml 2021-09-06 17:15:30 +05:30
sandeep cec54e6d51 tags update 
Co-Authored-By: me_dheeraj <9442273+Dheerajmadhukar@users.noreply.github.com>
 2021-09-06 16:15:07 +05:30
sandeep c105e41fa4 Added OpenVPN Host Header Injection 
Co-Authored-By: me_dheeraj <9442273+Dheerajmadhukar@users.noreply.github.com>
 2021-09-06 16:13:17 +05:30
Prince Chaddha f6e52a6739
Merge pull request #2585 from sullo/master 
Updates across many templates for clarity, spelling, and grammar.
 2021-09-06 15:02:52 +05:30
Prince Chaddha 7579fe98c2
Update and rename minimouse-lfi.yaml to vulnerabilities/other/minimouse-lfi.yaml 2021-09-06 14:44:39 +05:30
sullo ef1f7c5e92 Updates across many templates for clarity, spelling, and grammar. 2021-09-05 17:13:45 -04:00
Prince Chaddha bf1d6374b2
Rename gSOAP-LFl.yaml to vulnerabilities/other/gsoap-lfi.yaml 2021-09-05 19:22:07 +05:30
sandeep 90f8caf302 Merge branch 'master' of https://github.com/projectdiscovery/nuclei-templates into pr/2481 2021-09-03 14:55:30 +05:30
sandeep c266084621 Added stop-at-first-match in applicable templates 2021-09-02 17:29:10 +05:30