CVE-2024-52052, -053, -054, -055, -056: Multiple vulnerabilitites in Wowza Streaming Engine, 5.1 - 9.4 rating 🔥
Five recent vulnerabilities we almost missed. RCE, stored XSS, file read, file write, and folder deletion - vulnerabilities for every taste!
Search at Netlas.io:
👉 Link: https://nt.ls/8BudC
👉 Dork: http.favicon.hash_sha256:3641ed4d68a0362f1ef45069584a71b0940acfcdb6abf8c13b8fc29837160a81 OR http.headers.server:"WowzaStreamingEngine"
Read more: https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/
Five recent vulnerabilities we almost missed. RCE, stored XSS, file read, file write, and folder deletion - vulnerabilities for every taste!
Search at Netlas.io:
👉 Link: https://nt.ls/8BudC
👉 Dork: http.favicon.hash_sha256:3641ed4d68a0362f1ef45069584a71b0940acfcdb6abf8c13b8fc29837160a81 OR http.headers.server:"WowzaStreamingEngine"
Read more: https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/
👍1
This media is not supported in your browser
VIEW IN TELEGRAM
1. Go to
chrome://extensions2. Turn on Developer mode
3. Copy the extension ID
4. Go to
~/Library/Application Support/Google/Chrome/Default/Extensions5. Find the matching
ID then find the manifest.json file!Please open Telegram to view this post
VIEW IN TELEGRAM
👍7
CVE-2024-8932, -8929, -11233, -11236, -11234: Multiple vulnerabilities in PHP, 4.8 - 9.8 rating 🔥
Five vulnerabilities in some PHP versions, which allowing attackers to leak sensitive information, execute arbitrary code, or launch DoS attacks.
More then 700k instances at Netlas.io:
👉 Link 1 (tag, more precisely): https://nt.ls/yIHH8
👉 Dork: tag.php.version:(>=8.1.0 AND <8.1.31) OR tag.php.version:(>=8.2.0 AND <8.2.26) OR tag.php.version:(>=8.3.0 AND <8.3.14)
👉 Link 2 (not tag, all PHP instances): https://nt.ls/9GJlg
👉 Dork: http.headers.x_powered_by:"php" OR http.headers.set_cookie:"PHPSESSID" OR http.headers.server:"PHP"
Vendor's advisories: https://github.com/php/php-src/security
Five vulnerabilities in some PHP versions, which allowing attackers to leak sensitive information, execute arbitrary code, or launch DoS attacks.
More then 700k instances at Netlas.io:
👉 Link 1 (tag, more precisely): https://nt.ls/yIHH8
👉 Dork: tag.php.version:(>=8.1.0 AND <8.1.31) OR tag.php.version:(>=8.2.0 AND <8.2.26) OR tag.php.version:(>=8.3.0 AND <8.3.14)
👉 Link 2 (not tag, all PHP instances): https://nt.ls/9GJlg
👉 Dork: http.headers.x_powered_by:"php" OR http.headers.set_cookie:"PHPSESSID" OR http.headers.server:"PHP"
Vendor's advisories: https://github.com/php/php-src/security
👍3❤2
Black Friday & Cyber Monday Discount at Netlas 🎉
Take advantage of our exclusive Black Friday & Cyber Monday deal: 20% off Freelancer and Business subscriptions for both monthly and annual billing cycles!
The best part? This isn’t just a one-time discount – it’s your forever price as long as your subscription remains active or until base prices are reconsidered 🔥
All you need to claim your forever discount is the code: BFCM2024.
👉 Learn more here: https://nt.ls/2WiQ0
Take advantage of our exclusive Black Friday & Cyber Monday deal: 20% off Freelancer and Business subscriptions for both monthly and annual billing cycles!
The best part? This isn’t just a one-time discount – it’s your forever price as long as your subscription remains active or until base prices are reconsidered 🔥
All you need to claim your forever discount is the code: BFCM2024.
👉 Learn more here: https://nt.ls/2WiQ0
👍2❤1🐳1
CyberWarFare Labs is offering 90% OFF for some of its certifications, perfect especially for those looking for their first certification or to improve your skills. I highly recommend it, especially if you want an affordable option for certifications.
#NotAPaidPromotion
#NotAPaidPromotion
👍4
Please open Telegram to view this post
VIEW IN TELEGRAM
👍4
CVE-2024-11667: Directory Traversal in Zyxel Firewalls, 7.3 rating❗️
A vulnerability in the web interface of some firewalls allows an attacker to download or upload files using a special URL.
Search at Netlas.io:
👉 Link: https://nt.ls/agozE
👉 Dork: http.favicon.hash_sha256:9a02f3cf948f9409c25070f2f057b69dda5d0aaf7fa8d056552e8bda8295ca1f
Vendor's advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024
A vulnerability in the web interface of some firewalls allows an attacker to download or upload files using a special URL.
Search at Netlas.io:
👉 Link: https://nt.ls/agozE
👉 Dork: http.favicon.hash_sha256:9a02f3cf948f9409c25070f2f057b69dda5d0aaf7fa8d056552e8bda8295ca1f
Vendor's advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024
👍9❤1🗿1
Please open Telegram to view this post
VIEW IN TELEGRAM
1👍3🔥2❤1
This media is not supported in your browser
VIEW IN TELEGRAM
“It’s the 1st of December Again!”
Another year is slipping by, but guess what? There’s still a whole month left to make it count. For all the bug hunters out there, this is your sign to look back and appreciate how far you’ve come—and to push even harder.
Remember that first bounty? That late-night rush when you cracked a tough challenge? The time you got that “Valid Vulnerability” email that made the sleepless nights worth it?
Bug bounty is a journey. It’s a grind, a game of patience, persistence, and passion. It’s about falling in love with the process—of learning, breaking, fixing, and growing.
If you’re stuck or frustrated, don’t let it define you. Learn from your misses, keep reading, practicing, and hunting. The next breakthrough might be just a scan, payload, or overlooked endpoint away.
December is the perfect month to reflect and refocus. Write those reports, finish that pending recon, or master a new skill. Close the year knowing you gave it your all.
Let’s finish this year strong, hunters. The world’s full of bugs waiting to be squashed—and the next one could be yours.
✈️BrutSecurity
#KeepHunting #BugBountyLife #1stDecemberMomentum
Another year is slipping by, but guess what? There’s still a whole month left to make it count. For all the bug hunters out there, this is your sign to look back and appreciate how far you’ve come—and to push even harder.
Remember that first bounty? That late-night rush when you cracked a tough challenge? The time you got that “Valid Vulnerability” email that made the sleepless nights worth it?
Bug bounty is a journey. It’s a grind, a game of patience, persistence, and passion. It’s about falling in love with the process—of learning, breaking, fixing, and growing.
If you’re stuck or frustrated, don’t let it define you. Learn from your misses, keep reading, practicing, and hunting. The next breakthrough might be just a scan, payload, or overlooked endpoint away.
December is the perfect month to reflect and refocus. Write those reports, finish that pending recon, or master a new skill. Close the year knowing you gave it your all.
Let’s finish this year strong, hunters. The world’s full of bugs waiting to be squashed—and the next one could be yours.
✈️BrutSecurity
#KeepHunting #BugBountyLife #1stDecemberMomentum
2👍14❤5🗿3
Exploit AWS metadata & user data access in Bug Bounty & CTF challenges!
🔗 https://github.com/Lu3ky13/Unauthorized-Access-to-Metadata-and-User-Data-like-CTF
#BugBounty #bugbountytip
🔗 https://github.com/Lu3ky13/Unauthorized-Access-to-Metadata-and-User-Data-like-CTF
#BugBounty #bugbountytip
👍9
🔖Ex-param - an automated tool designed for finding reflected parameters for XSS vulnerabilities
✅https://github.com/rootDR/ex-param
✅https://github.com/rootDR/ex-param
❤7👍3🗿1
This media is not supported in your browser
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥14👍6❤5🤨1