Release notes from nuclei-templates

v9.9.4

2024-09-02T10:38:47Z

What's Changed

🔥 Release Highlights 🔥

[CVE-2024-43425] Moodle - Remote Code Execution (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-29868] Apache StreamPipes - Weak PRNG in Recovery Token Generation (@alessandro - DEVisions) [critical] 🔥
[CVE-2024-24809] Traccar - Unrestricted File Upload (@dhiyaneshdk) [high] 🔥
[CVE-2024-7593] Ivanti vTM - Authentication Bypass (@gy741) [critical] 🔥
[CVE-2024-6670] WhatsUp Gold HasErrors SQL Injection - Authentication Bypass (@dhiyaneshdk, @princechaddha) [critical] 🔥
[CVE-2024-5932] GiveWP - PHP Object Injection (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥

Bug Fixes

Fixed typo in 'shodan-query' key in AirOS Panel detection (#10615).

False Positives

Fixed Nacos version detection false positive (#10647).
Fixed false positives for mixed active content (#10571).
Fixed false positives for weak login detection in XUI (#10533).
Fixed false positives in CVE-2023-33584 template (#10459).
Fixed false positives for CVE-2018-11784 detection (#10495).
Updated SQL injection delay time to reduce false positives in wp-statistics (#10377).
Updated SQL injection delay time for CVE-2023-6063 to reduce false positives (#10376).

Enhancements

Updated GitHub takeover matchers to match new 404 page (#10553).
Improved CVE-2014-6271 detection (#10621).
Enhanced detection of HashiCorp Vault login panel (#10599).
Added new endpoint detection for phpMyAdmin panel (#10451).

Template Updates

New Templates Added: `59` | CVEs Added: `30` | First-time contributions: `13`

[CVE-2024-45241] CentralSquare CryWolf - Path Traversal (@s4e-io) [high]
[CVE-2024-43425] Moodle - Remote Code Execution (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-32231] Stash < 0.26.0 - SQL Injection (@iamnoooob, @rootxharsh, @pdresearch) [critical]
[CVE-2024-29868] Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation (@alessandro Albani - DEVisions) [critical] 🔥
[CVE-2024-29272] VvvebJs < 1.7.5 - Arbitrary File Upload (@s4e-io) [medium]
[CVE-2024-24809] Traccar - Unrestricted File Upload (@dhiyaneshdk) [high] 🔥
[CVE-2024-23163] GestSup - Account Takeover (@eeche, @chae1xx1os, @persona-twotwo, @soonghee2, @gy741) [critical]
[CVE-2024-8181] Flowise <= 1.8.2 Authentication Bypass (@iamnoooob, @rootxharsh, @pdresearch) [high]
[CVE-2024-7954] SPIP Porte Plume Plugin - Remote Code Execution (@s4e-io) [critical]
[CVE-2024-7928] FastAdmin < V1.3.4.20220530 - Path Traversal (@s4e-io) [medium]
[CVE-2024-7593] Ivanti vTM - Authentication Bypass (@gy741) [critical] 🔥
[CVE-2024-6911] PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion (@s4e-io) [high]
[CVE-2024-6893] Journyx - XML External Entities Injection (XXE) (@s4eio) [high]
[CVE-2024-6842] AnythingLLM - Information Disclosure (@ingbunga, @rahaaaiii, @asteria121, @breakpack, @gy741) [high]
[CVE-2024-6670] WhatsUp Gold HasErrors SQL Injection - Authentication Bypass (@dhiyaneshdk, @princechaddha) [critical] 🔥
[CVE-2024-6095] LocalAI - Partial Local File Read (@iamnoooob, @pdresearch, @rootxharsh) [medium]
[CVE-2024-5932] GiveWP - PHP Object Injection (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-5827] Vanna - SQL injection (@olfloralo, @nukunga, @harksu, @nechyo, @gy741) [critical]
[CVE-2024-5765] WpStickyBar <= 2.1.0 - SQL Injection (@theamanrawat) [high]
[CVE-2024-5421] SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure (@bl4ckp4r4d1s3) [high]
[CVE-2024-5420] SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting (@bl4ckp4r4d1s3) [high]
[CVE-2024-3850] Uniview NVR301-04S2-P4 - Cross-Site Scripting (@bleron Rrustemi, @r3naissance) [medium]
[CVE-2023-46818] ISPConfig - PHP Code Injection (@non-things) [high]
[CVE-2023-40504] LG Simple Editor <= v3.21.0 - Command Injection (@s4e-io) [critical]
[CVE-2023-34754] Bloofox v0.5.2.1 - SQL Injection (@ritikchaddha) [critical]
[CVE-2023-29506] XWiki >= 13.10.8 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-22893] Strapi Versions <=4.5.6 - Authentication Bypass (@iamnoooob, @rootxharsh, @pdresearch) [high]
[CVE-2023-3521] FOSSBilling < 0.5.3 - Cross-Site Scripting (@ctflearner) [medium]
[CVE-2023-2624] KiviCare WordPress Plugin - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2020-28429] geojson2kml - Command Injection (@eeche, @chae1xx1os, @persona-twotwo, @soonghee2) [critical]
[cookie-consent-detection] Cookie Consent Detection (@rxerium) [info]
[couchdb-default-login] CouchDB - Default Login (@thefoggiest) [high]
[fuji-xerox-default-login] Fuji Xerox ApeosPort - Default Login (@morgan Robertson) [high]
[ispconfig-hcp-default-login] ISPConfig Hosting Control Panel - Default Login (@ritikchaddha) [high]
[jellyfin-default-login] Jellyfin Console - Default Login (@thefoggiest) [high]
[rundeck-default-login] Rundeck - Default Login (@karkis3c) [high]
[ivanti-traffic-manager-panel] Ivanti Traffic Manager Panel - Detect (@rxerium) [info]
[kiali-panel] Kiali - Detect (@righettod) [info]
[malwared-byob] Malwared (Build Your Own Botnet) - Detect (@pdteam) [info]
[procore-panel] Procore Login - Panel (@rxerium) [info]
[elgg-installer] Elgg - Installation (@s4e-io) [high]
[jackett-installer] Jackett - Installer (@ritikchaddha) [high]
[jackett-unauth] Jackett UI - Unauthenticated (@ProjectDiscoveryAI) [high]
[lidarr-dashboard-unauth] Lidarr Dashboard - Unauthenticated (@ProjectDiscoveryAI) [medium]
[prowlarr-dashboard-unauth] Prowlarr Dashboard - Unauthenticated (@ProjectDiscoveryAI) [medium]
[radarr-dashboard-unauth] Radarr Dashboard - Unauthenticated (@ProjectDiscoveryAI) [medium]
[readarr-dashboard-unauth] Readarr Dashboard - Unauthenticated (@ProjectDiscoveryAI) [medium]
[sonarr-dashboard-unauth] Sonarr Dashboard - Unauthenticated (@ProjectDiscoveryAI) [medium]
[whisparr-dashboard-unauth] Whisparr Dashboard - Unauthenticated (@ProjectDiscoveryAI) [medium]
[akamai-bot-manager-detect] Akamai Bot Manager Protection - Detect (@Fazle Arefin) [info]
[apache-streampipes-detect] Apache StreamPipes - Detect (@alessandro Albani - DEVisions) [info]
[bigip-apm-detect] BIGIP APM - Detect (@nodauf) [info]
[spip-detect] SPIP - Detect (@s4e-io) [info]
[malwared-byob-rce] Malwared BYOB - Unauthenticated Remote Code Execution (@pdteam) [critical]
[mobsf-apktool-lfi] MobSF - Path Traversal (@will Mccardell) [high]
[elgg-sqli] Elgg 5.1.4 - SQL Injection (@s4e-io) [high]
[prest-sqli-auth-bypass] pREST < 1.5.4 - SQLi Via Authentication Bypass (@mihail8531, @iamnoooob, @rootxharsh, @pdresearch) [critical]
[readymade-unilevel-sqli] Readymade Unilevel Ecommerce MLM - SQL Injection (@s4e-garage) [high]
[readymade-unilevel-xss] Readymade Unilevel Ecommerce MLM - Cross-Site Scripting (@s4e-garage) [high]

New Contributors

@Parshva87 made their first contribution in #10536
@syntacticNaCl made their first contribution in #10553
@fazlearefin made their first contribution in #10596
@flyingllama87 made their first contribution in #10600
@ingbunga made their first contribution in #10427
@thefoggiest made their first contribution in #10435
@oIfloraIo made their first contribution in #10429
@non-things made their first contribution in #10549
@DEVisions made their first contribution in #10131
@nil0x42 made their first contribution in #10615
@willmccardell made their first contribution in #10367
@BrunoTeixeira1996 made their first contribution in #10622
@eeche made their first contribution in #10489

Full Changelog: v9.9.3...v9.9.4

v9.9.3

2024-08-16T22:05:05Z

🔥 Release Highlights 🔥

[CVE-2024-41107] Apache CloudStack - SAML Signature Exclusion (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-40422] Devika v1 - Path Traversal (@s4e-garage, @alpernae) [critical] 🔥
[CVE-2024-39907] 1Panel SQL Injection - Authenticated (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-38856] Apache OFBiz - Remote Code Execution (@Co5mos) [critical] 🔥
[CVE-2024-36104] Apache OFBiz - Path Traversal (@Co5mos) [critical] 🔥
[CVE-2024-7339] TVT DVR Sensitive Device - Information Disclosure (@stuxctf) [medium] 🔥
[CVE-2024-6782] Calibre <= 7.14.0 Remote Code Execution (@dhiyaneshdk) [critical] 🔥

What's Changed

New Templates Added: `56` | CVEs Added: `33` | First-time contributions: `4`

[CVE-2024-41628] Cluster Control CMON API - Directory Traversal (@s4e-garage) [high]
[CVE-2024-41107] Apache CloudStack - SAML Signature Exclusion (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-40422] Devika v1 - Path Traversal (@s4e-garage, @alpernae) [critical] 🔥
[CVE-2024-39907] 1Panel SQL Injection - Authenticated (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-39903] Solara <1.35.1 - Local File Inclusion (@iamnoooob, @rootxharsh, @pdresearch) [high]
[CVE-2024-38856] Apache OFBiz - Remote Code Execution (@Co5mos) [critical] 🔥
[CVE-2024-38514] NextChat - Server-Side Request Forgery (@dhiyaneshdk) [high]
[CVE-2024-38288] TurboMeeting - Post-Authentication Command Injection (@rootxharsh, @iamnoooob, @pdresearch) [high]
[CVE-2024-36104] Apache OFBiz - Path Traversal (@Co5mos) [critical] 🔥
[CVE-2024-34061] Changedetection.io <=v0.45.21 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2024-24763] JumpServer < 3.10.0 - Open Redirect (@ritikchaddha) [medium]
[CVE-2024-7340] W&B Weave Server - Remote Arbitrary File Leak (@iamnoooob, @rootxharsh, @pdresearch) [high]
[CVE-2024-7339] TVT DVR Sensitive Device - Information Disclosure (@stuxctf) [medium] 🔥
[CVE-2024-7332] TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability (@s4e-garage) [critical]
[CVE-2024-7188] Bylancer Quicklancer 2.4 G - SQL Injection (@s4e-garage) [high]
[CVE-2024-7120] Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection (@pussycat0x) [medium]
[CVE-2024-7008] Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS) (@dhiyaneshdk) [medium]
[CVE-2024-6922] Automation Anywhere Automation 360 - Server-Side Request Forgery (@dhiyaneshdk) [high]
[CVE-2024-6782] Calibre <= 7.14.0 Remote Code Execution (@dhiyaneshdk) [critical] 🔥
[CVE-2024-6781] Calibre <= 7.14.0 Arbitrary File Read (@dhiyaneshdk) [high]
[CVE-2024-6396] Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite (@iamnoooob, @rootxharsh, @pdresearch) [critical]
[CVE-2024-6366] User Profile Builder < 3.11.8 - File Upload (@s4e-garage) [high]
[CVE-2024-6205] PayPlus Payment Gateway < 6.6.9 - SQL Injection (@s4e-garage) [critical]
[CVE-2024-5975] CZ Loan Management <= 1.1 - SQL Injection (@s4e-garage) [critical]
[CVE-2024-5936] PrivateGPT < 0.5.0 - Open Redirect (@ctflearner) [medium]
[CVE-2023-44393] Piwigo - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-43323] mooSocial 3.1.8 - External Service Interaction (@ritikchaddha) [medium]
[CVE-2023-6444] Seriously Simple Podcasting < 3.0.0 - Information Disclosure (@s4eio) [medium]
[CVE-2023-5863] phpMyFAQ < 3.2.0 - Cross-site Scripting (@ctflearner) [medium]
[CVE-2023-5222] Viessmann Vitogate 300 - Hardcoded Password (@ritikchaddha) [critical]
[CVE-2022-27043] Yearning - Directory Traversal (@Co5mos) [high]
[CVE-2022-3869] Froxlor < 0.10.38.2. - HTML Injection (@ctflearner) [medium]
[CVE-2004-2687] Distccd v1 - Remote Code Execution (@pussycat0x) [high]
[cloudstack-default-login] Apache CloudStack - Default Login (@dhiyaneshdk) [high]
[airos-panel] AirOS Panel - Detect (@rxerium) [info]
[fossbilling-panel] FOSSBilling Panel - Detect (@ritikchaddha) [info]
[metube-detect] MeTube Instance Detected (@rxerium) [info]
[openedge-panel] OpenEdge Login Panel - Detect (@rxerium) [info]
[photoprism-panel] PhotoPrism Panel - Detect (@rxerium) [info]
[privategpt-detect] PrivateGPT - Detect (@ritikchaddha) [info]
[whatsup-gold-panel] Whatsup Gold Login Panel - Detect (@rxerium) [info]
[gitlab-ci-yml] GitLab CI YAML - Exposure (@dhiyaneshdk) [medium]
[changedetection-unauth] Changedetection.io Dashboard - Exposure (@ritikchaddha) [medium]
[deployment-interface-exposed] Deployment Management Interface - Exposed (@dhiyaneshdk) [medium]
[fossbilling-installer] FOSSBilling - Installation (@ritikchaddha) [high]
[quickcms-installer] QuickCMS Installation Wizard (@dhiyaneshdk) [high]
[manage-cabinet-register] Manage Cabinet Register - Exposed (@noel) [low]
[substack] substack.com User Name Information - Detect (@cheesymoon) [info]
[apache-ofbiz-detect] Apache OFBiz - Detect (@rxerium) [info]
[apache-shenyu-detect] Apache Shenyu Gateway Management System - Detect (@icarot) [info]
[searxng-detect] SearXNG - Detect (@rxerium) [info]
[esafenet-netsecconfigajax-sqli] Esafenet CDG NetSecConfigAjax - Sql Injection (@adeljck) [high]
[esafenet-noticeajax-sqli] Esafenet CDG NoticeAjax - Sql Injection (@adeljck) [high]
[landray-oa-replaceextend-rce] Landray OA replaceExtend Function - Remote Code Execution (@adeljck) [critical]
[x11-unauth-access] x11 - Unauthenticated Access (@pussycat0x) [high]
[db2-discover] Broadcast DB2 Discover (@pussycat0x) [info]

New Contributors

@lanyi1998 made their first contribution in #10402
@eltociear made their first contribution in #10401
@NoelV11 made their first contribution in #10387
@gelim made their first contribution in #10420

Full Changelog: v9.9.2...v9.9.3

v9.9.2

2024-07-26T07:41:53Z

🔥 Release Highlights 🔥

[CVE-2024-40348] Bazarr < 1.4.3 - Arbitrary File Read (@s4e-garage) [high] 🔥
[CVE-2024-38526] Polyfill Supply Chain Attack Malicious Code Execution (@abut0n) [high] 🔥
[CVE-2024-34351] Next.js - Server Side Request Forgery (SSRF) (@righettod) [high] 🔥
[CVE-2024-5217] ServiceNow - Incomplete Input Validation (@dhiyaneshdk, @ritikchaddha) [critical] 🔥
[CVE-2024-4879] ServiceNow UI Macros - Template Injection (@dhiyaneshdk, @ritikchaddha) [unknown] 🔥
[CVE-2023-43662] ShokoServer System - Local File Inclusion (LFI) (@pussycat0x) [high] 🔥
[CVE-2023-4220] Chamilo LMS <= 1.11.24 - Remote Code Execution (@s4e-garage) [medium] 🔥
[CVE-2022-34267] RWS WorldServer - Auth Bypass (@pdresearch, @iamnoooob, @rootxharsh, @parthmalhotra) [critical] 🔥

What's Changed

Bug Fixes

Corrected issue with mismatched redirects (Issue #10125).
Resolved invalid template error for CVE-2024-36991 (Issue #10352).

False Negatives

Improved detection in the SVN configuration leak template, reducing underreporting (Issue #10344).
Addressed false negatives in the following:
Exposed SVN configuration (PR #10362)
CVE-2019-7139 template (PR #10339)

False Positives

Reduced false positives and improved accuracy in the following templates:
IdeMia biometrics default login (Issues #10126, #10277)
jan-file-upload (PR #10361)
Apache XSS (PR #10342)
Beanstalk service (PR #10334, duplicated issue)
DS-Store file discovery (PR #10278)
GOIP default login (PR #10276)

Enhancements

Enhanced detection capabilities in dom-xss.yaml (PR #10360).
Improved accuracy in generic-xxe.yaml (PR #10359).

New Templates Added: `67` | CVEs Added: `32` | First-time contributions: `7`

[CVE-2024-40348] Bazarr < 1.4.3 - Arbitrary File Read (@s4e-garage) [high] 🔥
[CVE-2024-39914] FOG Project < 1.5.10.34 - Remote Command Execution (@s4e-garage) [critical]
[CVE-2024-39250] EfroTech Timetrax v8.3 - Sql Injection (@s4e-garage, @efran) [high]
[CVE-2024-38526] Polyfill Supply Chain Attack Malicious Code Execution (@abut0n) [high] 🔥
[CVE-2024-38289] TurboMeeting - Boolean-based SQL Injection (@rootxharsh, @iamnoooob, @pdresearch) [critical]
[CVE-2024-37843] Craft CMS <=v3.7.31 - SQL Injection (@iamnoooob, @rootxharsh, @pdresearch) [critical]
[CVE-2024-34351] Next.js - Server Side Request Forgery (SSRF) (@righettod) [high] 🔥
[CVE-2024-34257] TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection (@pussycat0x) [high]
[CVE-2024-32238] H3C ER8300G2-X - Password Disclosure (@s4e-garage) [critical]
[CVE-2024-6746] EasySpider 0.6.2 - Arbitrary File Read (@s4e-garage) [medium]
[CVE-2024-6646] Netgear-WN604 downloadFile.php - Information Disclosure (@pussycat0x) [medium]
[CVE-2024-6587] LiteLLM - Server-Side Request Forgery (@pdresearch, @iamnoooob, @rootxharsh, @lambdasawa) [high]
[CVE-2024-6289] WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure (@s4e-garage) [medium]
[CVE-2024-5315] Dolibarr ERP CMS list.php - SQL Injection (@rootxharsh, @iamnoooob, @pdresearch) [critical]
[CVE-2024-5217] ServiceNow - Incomplete Input Validation (@dhiyaneshdk, @ritikchaddha) [critical] 🔥
[CVE-2024-4885] Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - RCE (@sinsinology,@iamnoooob,@rootxharsh,@pdresearch) [critical] 🔥
[CVE-2024-4879] ServiceNow UI Macros - Template Injection (@dhiyaneshdk, @ritikchaddha) [unknown] 🔥
[CVE-2024-4295] Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash (@iamnoooob, @rootxharsh, @pdresearch) [critical]
[CVE-2024-4257] BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection (@s4e-garage) [medium]
[CVE-2024-3742] Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure (@Farish) [high]
[CVE-2024-2330] NS-ASG Application Security Gateway 6.3 - Sql Injection (@s4e-garage) [medium]
[CVE-2024-1512] MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection (@s4e-garage) [critical]
[CVE-2023-48728] WWBN AVideo 11.6 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-44012] mojoPortal v.2.7.0.0 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-43662] ShokoServer System - Local File Inclusion (LFI) (@pussycat0x) [high] 🔥
[CVE-2023-29204] XWiki - Open Redirect (@ritikchaddha) [medium]
[CVE-2023-4450] JeecgBoot JimuReport - Template injection (@sumanth Vankineni) [critical]
[CVE-2023-4220] Chamilo LMS <= 1.11.24 - Remote Code Execution (@s4e-garage) [medium] 🔥
[CVE-2023-2309] wpForo Forum <= 2.1.8 - Cross-Site Scripting (@s4e-garage) [medium]
[CVE-2022-45269] Linx Sphere - Directory Traversal (@robotshell) [high]
[CVE-2022-38322] Temenos Transact - Cross-Site Scripting (@Qotoz) [high]
[CVE-2022-34267] RWS WorldServer - Auth Bypass (@pdresearch, @iamnoooob, @rootxharsh, @parthmalhotra) [critical] 🔥
[CNVD-2023-72138] LiveGBS user/save - Logical Flaw (@pussycat0x) [high]
[deluge-default-login] Deluge - Default Login (@ritikchaddha) [high]
[gitblit-default-login] Gitblit - Default Login (@ritikchaddha) [high]
[netflow-default-login] Netflow Analyzer - Default Login (@dhiyaneshdk) [high]
[adguard-panel] AdGuard Panel - Detect (@ritikchaddha) [info]
[falcosidekick-panel] Falcosidekick UI Login Panel - Detect (@righettod) [info]
[freshrss-panel] Freshrss Panel - Detect (@ritikchaddha) [info]
[gradle-develocity-panel] Gradle Develocity Build Cache Node Login Panel - Detect (@righettod) [info]
[hal-management-panel] HAL Management Console Panel (@dhiyaneshdk) [info]
[netflow-analyzer-panel] Netflow Analyzer Login - Panel (@dhiyaneshdk) [info]
[tomcat-exposed] Tomcat Exposed - Detect (@Podalirius, @righettod) [info]
[apache-ozone-conf] Apache Ozone - Exposure (@icarot) [info]
[snoop-servlet] Snoop Servlet - Information Disclosure (@omranisecurity) [low]
[adcs-certificate] Certification Authority Web Enrollment (ADCS) - Detection (@Pastaga, @DefTe) [info]
[freshrss-unauth] Freshrss Admin Dashboard - Exposed (@ritikchaddha) [high]
[adguard-installer] AdGuard - Installation (@ritikchaddha) [high]
[freshrss-installer] FreshRSS - Installation (@ritikchaddha) [high]
[mongod-exposure] MongoD Server - Exposure (@dhiyaneshdk) [low]
[servicenow-title-injection] Service Now - Title Injection (@dhiyaneshdk) [high]
[sftpgo-admin-setup] SFTPGo Admin - Setup (@ritikchaddha) [high]
[ssrpm-arbitrary-password-reset] SSRPM - Arbitary Password Reset on Default Client Interface Installation (@vince-isec) [high]
[apache-gravitino-detect] Apache Gravitino - Detect (@icarot) [info]
[apache-ozone-detect] Apache Ozone - Detect (@icarot) [info]
[wordpress-fluent-smtp] FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider Detection (@ricardomaia) [info]
[wordpress-wp-crontrol] WP Crontrol Detection (@ricardomaia) [info]
[hikvision-isecure-info-leak] HIKVISION iSecure Center - Information Leak (@adeljck) [high]
[nextjs-middleware-cache] Next.js - Cache Poisoning (@dhiyaneshdk) [high]
[nextjs-rsc-cache] Next.js - Cache Poisoning (@dhiyaneshdk) [high]
[jan-file-upload] Jan - Arbitrary File Upload (@pussycat0x) [high]
[lvs-download-lfi] LVS DownLoad.aspx - Local File Inclusion (LFI) (@pussycat0x) [high]
[ncast-lfi] Ncast HD Intelligent Recording - Arbitrary File Reading (@pussycat0x) [high]
[wifisky7-rce] WIFISKY-7 Layer Flow Control Router - Remote Code Execution (@pussycat0x) [high]
[7777botnet-detect] 7777-Botnet - Detect (@johnk3r) [info]
[thinkphp6-arbitrary-write] ThinkPHP 6.0.0~6.0.1 - Arbitrary File Write (@arliya) [critical]
[nacos-workflow] Nacos Security Checks (@Co5mos)

New Contributors

@kimtruth made their first contribution in #10260
@omranisecurity made their first contribution in #10178
@divatchyano made their first contribution in #10275
@Sumanthsec made their first contribution in #10280
@allendemoura made their first contribution in #10279
@Matsue made their first contribution in #10165
@adeljck made their first contribution in #10370

Full Changelog: v9.9.1...v9.9.2

v9.9.1

2024-07-10T13:33:12Z

🔥 Release Highlights 🔥

[CVE-2024-37032] Ollama - Remote Code Execution (@kaks3c) [critical] 🔥
[CVE-2024-36991] Splunk Enterprise - Local File Inclusion (@dhiyaneshdk) [high] 🔥
[CVE-2024-36401] GeoServer RCE in Evaluating Property Name Expressions (@dhiyaneshdk) [critical] 🔥
[CVE-2024-34102] Adobe Commerce & Magento - CosmicSting (@dhiyaneshdk) [critical] 🔥
[CVE-2024-33113] D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure (@pussycat0x) [medium] 🔥
[CVE-2024-29972] Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account (@gy741) [critical] 🔥
[CVE-2024-6028] Quiz Maker <= 6.5.8.3 - SQL Injection (@s4e-garage) [critical] 🔥
[CVE-2023-52251] Kafka UI 0.7.1 Command Injection (@yhy0, @iamnoooob) [high] 🔥
[CVE-2020-10189] ManageEngine Desktop Central Java Deserialization (@king-alexander) [critical] 🔥

What's Changed

New Templates Added: `75` | CVEs Added: `29` | First-time contributions: `5`

[CVE-2024-37881] SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure (@s4e-garage) [medium]
[CVE-2024-37152] Argo CD Unauthenticated Access to sensitive setting (@dhiyaneshdk) [medium]
[CVE-2024-37032] Ollama - Remote Code Execution (@kaks3c) [critical] 🔥
[CVE-2024-36991] Splunk Enterprise - Local File Inclusion (@dhiyaneshdk) [high] 🔥
[CVE-2024-36401] GeoServer RCE in Evaluating Property Name Expressions (@dhiyaneshdk) [critical] 🔥
[CVE-2024-34102] Adobe Commerce & Magento - CosmicSting (@dhiyaneshdk) [critical] 🔥
[CVE-2024-33610] Sharp Multifunction Printers - Cookie Exposure (@gy741) [medium]
[CVE-2024-33605] Sharp Multifunction Printers - Directory Listing (@gy741) [high]
[CVE-2024-33113] D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure (@pussycat0x) [medium] 🔥
[CVE-2024-32709] WP-Recall <= 16.26.5 - SQL Injection (@s4e-garage) [critical]
[CVE-2024-29972] Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account (@gy741) [critical] 🔥
[CVE-2024-27292] Docassemble - Local File Inclusion (@johnk3r) [high]
[CVE-2024-25852] Linksys RE7000 - Command Injection (@s4e-garage) [high]
[CVE-2024-6188] TrakSYS 11.x.x - Sensitive Data Exposure (@s4e-garage) [medium]
[CVE-2024-6028] Quiz Maker <= 6.5.8.3 - SQL Injection (@s4e-garage) [critical] 🔥
[CVE-2024-5947] Deep Sea Electronics DSE855 - Authentication Bypass (@s4e-garage) [medium]
[CVE-2024-5522] WordPress HTML5 Video Player < 2.5.27 - SQL Injection (@JohnDoeAnonITA) [critical]
[CVE-2024-5084] Hash Form <= 1.1.0 - Arbitrary File Upload (@s4e-garage) [critical]
[CVE-2024-4836] Edito CMS - Sensitive Data Leak (@s4e-garage) [high]
[CVE-2024-4434] LearnPress WordPress LMS Plugin <= 4.2.6.5 - SQL Injection (@s4e-garage) [critical]
[CVE-2023-52251] Kafka UI 0.7.1 Command Injection (@yhy0, @iamnoooob) [high] 🔥
[CVE-2023-47117] Label Studio - Sensitive Information Exposure (@iamnoooob, @rootxharsh, @pdresearch) [high]
[CVE-2023-41599] JFinalCMS v5.0.0 - Directory Traversal (@pussycat0x) [medium]
[CVE-2023-35161] XWiki >= 6.2-milestone-1 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-35160] XWiki >= 2.5-milestone-2 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-35159] XWiki >= 3.4-milestone-1 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-35156] XWiki >= 6.0-rc-1 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-3380] WAVLINK WN579X3 - Remote Command Execution (@pussycat0x) [critical]
[CVE-2020-10189] ManageEngine Desktop Central Java Deserialization (@king-alexander) [critical] 🔥
[CNVD-2023-03903] EduSoho < v22.4.7 - Local File Inclusion (@s4e-garage) [high]
[CNVD-2021-64035] Leadsec VPN - Arbitrary File Read (@xiaoWangSec) [high]
[spring4shell-CVE-2022-22965] Spring Framework RCE via Data Binding on JDK 9+ (@dhiyaneshdk, @ritikchaddha) [critical] 🔥
[csv-injection] CSV Injection Detection (@dhiyaneshdk, @ritikchaddha) [medium]
[xinclude-injection] XInclude Injection - Detection (@dhiyaneshdk, @ritikchaddha) [high]
[apache-apollo-default-login] Apache Apollo - Default Login (@ritikchaddha) [high]
[caprover-default-login] Caprover - Default Login (@ritikchaddha) [high]
[dialogic-xms-default-login] Dialogic XMS Admin Console - Default Login (@ritikchaddha) [high]
[jeedom-default-login] Jeedom - Default Login (@ritikchaddha) [high]
[ruijie-nbr-default-login] Ruijie NBR Series Routers - Default Login (@pussycat0x) [high]
[apache-apollo-panel] Apache Apollo Panel - Detect (@ritikchaddha) [info]
[dialogic-xms-console] Dialogic XMS Admin Console - Detect (@ritikchaddha) [info]
[endpoint-protector-panel] Endpoint Protector Login Panel - Detect (@pussycat0x) [info]
[label-studio-panel] Label Studio - Login Panel (@dhiyaneshdk) [info]
[sql-server-dump] SQL Server - Dump Files (@userdehghani) [medium]
[apache-pinot-config] Apache Pinot - Exposure (@icarot) [medium]
[filestash-admin-config] Filestash Admin Password Configuration (@dhiyaneshdk) [high]
[neo4j-neodash-config] Neo4j Neodash Config - Exposure (@icarot) [medium]
[jwk-json-leak] JSON Web Key File - Exposure (@mohsen Yaghoubi) [low]
[coolify-register-account] Coolify Register User Account - Enabled (@dhiyaneshdk) [medium]
[forgejo-repo-exposure] Forgejo Repositories - Exposure (@dhiyaneshdk) [medium]
[kodbox-installer] Kodbox Installation Page - Exposure (@dhiyaneshdk) [high]
[piwigo-installer] Piwigo Installation Page - Exposure (@dhiyaneshdk) [high]
[poste-io-installer] Poste.io - Installer (@dhiyaneshdk) [high]
[subrion-installer] Subrion CMS Web Installer - Exposure (@ritikchaddha) [high]
[label-studio-signup] Label Studio - Sign-up Detect (@dhiyaneshdk) [unknown]
[laragon-phpinfo] Laragon - phpinfo Disclosure (@dhiyaneshdk) [low]
[seq-dashboard-unauth] Seq Dashboard - Unauthenticated (@dhiyaneshdk) [high]
[apache-cloudstack-detect] Apache CloudStack - Detect (@pussycat0x) [info]
[apache-pinot-detect] Apache Pinot - Detect (@icarot) [info]
[neo4j-neodash-detect] Neo4j Neodash - Detect (@icarot) [info]
[wordpress-chaty] Floating Chat Widget' Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty Detection (@ricardomaia) [info]
[polyfill-backdoor] Polyfill.io - Detection (@kazet) [low]
[hjsoft-hcm-lfi] Hongjing HCM - Local File Inclusion (@s4e-garage) [high]
[hjsoft-hcm-sqli] Hongjing HCM - Sql Injection (@s4e-garage) [high]
[hjsoft-hcm-tb-sqli] Hongjing HCM - Time-Based Sql Injection (@s4e-garage) [high]
[jinhe-oa-c6-upload-lfi] Jinhe OA_C6_UploadFileDownLoadnew - Arbitrary File Read (@pussycat0x) [high]
[next-js-cache-poisoning] Next.js Cache Poisoning (@Ice3man543) [high]
[azon-dominator-sqli] Azon Dominator - SQL Injection (@s4e-garage) [high]
[bagisto-csti] Bagisto 2.1.2 Client-Side Template Injection (@s4e-garage) [medium]
[crocus-lfi] Crocus system Service.do - Arbitrary File Read (@pussycat0x) [high]
[enjoyrmis-sqli] EnjoyRMIS - SQL Injection (@s4e-garage) [high]
[h3c-cnsss-arbitrary-file-upload] H3C CNSSS - Arbitrary File Upload (@s4e-garage) [critical]
[pingsheng-electronic-sqli] Pingsheng Electronic Reservoir Supervision Platform - Sql Injection (@s4e-garage) [high]
[sharp-printers-lfi] Sharp Multifunction Printers - Local File Inclusion (@gy741) [high]
[ldap-metadata] LDAP Metadata - Enumeration (@pussycat0x) [info]

New Contributors

@yhy0 made their first contribution in #9345
@JohnDoeAnonITA made their first contribution in #10137
@zeroc00I made their first contribution in #10171
@IPv4v6 made their first contribution in #10212
@BitThr3at made their first contribution in #10224

Full Changelog: v9.9.0...v9.9.1

v9.9.0 - Kubernetes Cluster Security 🎉

2024-06-28T06:51:12Z

🔥 Release Highlights 🔥

We are expanding the Nuclei Templates to include a specialized set of security checks dedicated to Kubernetes environments. This initiative will cover various Kubernetes components such as Pods, Deployments, StatefulSets, Services, and Network Policies. The new templates will focus on common misconfigurations, compliance issues, and adherence to industry best practices, utilizing the enhanced capabilities like flow, code & javascript protocol.

The addition of these Kubernetes-specific templates will enable security teams to perform in-depth security assessments of Kubernetes clusters, identifying critical misconfigurations and vulnerabilities. Additionally, this update will support customizable checks that align with unique operational needs, helping teams efficiently detect and address security gaps in their Kubernetes setups.

We invite contributors and reviewers to offer their insights and suggestions to refine and advance the development of these Kubernetes security templates. You can read more about it in this blog post.

Other Highlights

[CVE-2024-32113] Apache OFBiz Directory Traversal - Remote Code Execution (@dhiyaneshdk) [high] 🔥
[CVE-2024-31982] XWiki < 4.10.20 - Remote code execution (@ritikchaddha) [critical] 🔥
[CVE-2024-29973] Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection (@ritikchaddha) [critical] 🔥
[CVE-2024-29895] Cacti cmd_realtime.php - Command Injection (@pussycat0x) [critical] 🔥
[CVE-2024-29824] Ivanti EPM - Remote Code Execution (@dhiyaneshdk) [critical] 🔥
[CVE-2024-28995] SolarWinds Serv-U - Directory Traversal (@dhiyaneshdk) [high] 🔥
[CVE-2024-23692] Rejetto HTTP File Server - Template injection (@johnk3r) [critical] 🔥
[CVE-2023-51449] Gradio Hugging Face - Local File Inclusion (@nvn1729) [high] 🔥
[CVE-2023-50719] XWiki < 4.10.15 - Sensitive Information Disclosure (@ritikchaddha) [high] 🔥
[CVE-2023-43472] MLFlow < 2.8.1 - Sensitive Information Disclosure (@ritikchaddha) [high] 🔥

What's Changed

New Templates Added: `164` | CVEs Added: `41` | First-time contributions: `4`

[CVE-2024-37393] SecurEnvoy Two Factor Authentication - LDAP Injection (s4e-garage) [critical]
[CVE-2024-36837] CRMEB v.5.2.2 - SQL Injection (@dhiyaneshdk) [high]
[CVE-2024-36527] Puppeteer Renderer - Directory Traversal (@Stux) [medium]
[CVE-2024-36412] SuiteCRM - SQL Injection (s4e-garage) [critical]
[CVE-2024-34982] LyLme-Spage - Arbitary File Upload (@dhiyaneshdk) [high]
[CVE-2024-32113] Apache OFBiz Directory Traversal - Remote Code Execution (@dhiyaneshdk) [high] 🔥
[CVE-2024-31982] XWiki < 4.10.20 - Remote code execution (@ritikchaddha) [critical] 🔥
[CVE-2024-31750] F-logic DataCube3 - SQL Injection (@dhiyaneshdk) [high]
[CVE-2024-29973] Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection (@ritikchaddha) [critical] 🔥
[CVE-2024-29895] Cacti cmd_realtime.php - Command Injection (@pussycat0x) [critical] 🔥
[CVE-2024-29824] Ivanti EPM - Remote Code Execution (@dhiyaneshdk) [critical] 🔥
[CVE-2024-28995] SolarWinds Serv-U - Directory Traversal (@dhiyaneshdk) [high] 🔥
[CVE-2024-27718] Smart s200 Management Platform v.S200 - SQL Injection (@dhiyaneshdk) [high]
[CVE-2024-24565] CrateDB Database - Arbitrary File Read (@dhiyaneshdk) [medium]
[CVE-2024-24112] Exrick XMall - SQL Injection (@dhiyaneshdk) [critical]
[CVE-2024-23692] Rejetto HTTP File Server - Template injection (@johnk3r) [critical] 🔥
[CVE-2024-21650] XWiki < 4.10.20 - Remote code execution (@ritikchaddha) [critical]
[CVE-2024-4443] Business Directory Plugin <= 6.4.2 - SQL Injection (s4e-garage) [critical]
[CVE-2024-3922] Dokan Pro <= 3.10.3 - SQL Injection (s4e-garage) [critical]
[CVE-2024-3552] Web Directory Free < 1.7.0 - SQL Injection (s4e-garage) [critical]
[CVE-2024-3274] D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure (@dhiyaneshdk) [medium]
[CVE-2024-2621] Fujian Kelixin Communication - Command Injection (@dhiyaneshdk) [medium]
[CVE-2024-1728] Gradio > 4.19.1 UploadButton - Path Traversal (@isacaya) [high]
[CVE-2024-0939] Smart S210 Management Platform - Arbitary File Upload (@dhiyaneshdk) [critical]
[CVE-2024-0250] Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect (s4e-garage) [medium]
[CVE-2023-51449] Gradio Hugging Face - Local File Inclusion (@nvn1729) [high] 🔥
[CVE-2023-50720] XWiki < 4.10.15 - Email Disclosure (@ritikchaddha) [medium]
[CVE-2023-50719] XWiki < 4.10.15 - Sensitive Information Disclosure (@ritikchaddha) [high] 🔥
[CVE-2023-48241] XWiki < 4.10.15 - Information Disclosure (@ritikchaddha) [high]
[CVE-2023-46732] XWiki < 14.10.14 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-45136] XWiki < 14.10.14 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-43472] MLFlow < 2.8.1 - Sensitive Information Disclosure (@ritikchaddha) [high] 🔥
[CVE-2023-38194] SuperWebMailer - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-37645] EyouCms v1.6.3 - Information Disclosure (@pussycat0x) [medium]
[CVE-2023-32068] XWiki - Open Redirect (@ritikchaddha) [medium]
[CVE-2023-6786] Payment Gateway for Telcell < 2.0.4 - Open Redirect (s4e-garage) [medium]
[CVE-2023-6505] Prime Mover < 1.9.3 - Sensitive Data Exposure (s4e-garage) [high]
[CVE-2021-43831] Gradio < 2.5.0 - Arbitrary File Read (@isacaya) [high]
[CVE-2021-38147] Wipro Holmes Orchestrator 20.4.1 - Information Disclosure (s4e-garage) [high]
[CVE-2021-38146] Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download (s4e-garage) [high]
[CVE-2021-4436] 3DPrint Lite < 1.9.1.5 - Arbitrary File Upload (s4e-garage) [critical]
[sns-public-subscribe-access] Public Subscription Access of SNS Topics via Policy (@Ritesh_Gohil(#L4stPL4Y3R)) [high]
[k8s-cpu-limits-not-set] CPU limits not set in Deployments (@princechaddha) [medium]
[k8s-cpu-requests-not-set] CPU Requests not set in Deployments (@princechaddha) [medium]
[k8s-default-namespace-used] Default Namespace Usage in Deployments (@princechaddha) [high]
[k8s-host-ports-check] Host ports should not be used (@princechaddha) [medium]
[k8s-image-pull-policy-always] Image Pull Policy set to Always (@princechaddha) [low]
[k8s-image-tag-not-fixed] Image Tag should be fixed - not latest or blank (@princechaddha) [low]
[k8s-liveness-probe-not-configured] Liveness Probe Not Configured in Deployments (@princechaddha) [medium]
[k8s-memory-limits-not-set] Memory limits not set in Deployments (@princechaddha) [medium]
[k8s-memory-requests-not-set] Memory requests not set in Deployments (@princechaddha) [medium]
[minimize-added-capabilities] Minimize container added capabilities (@princechaddha) [high]
[k8s-privileged-containers] Privileged Containers Found in Deployments (@princechaddha) [critical]
[k8s-readiness-probe-not-set] Readiness Probes not set in Deployments (@princechaddha) [medium]
[k8s-root-container-admission] Minimize the admission of root containers (@princechaddha) [critical]
[k8s-seccomp-profile-set] Set appropriate seccomp profile (@princechaddha) [medium]
[kubernetes-code-env] Kubernetes Cluster Validation (@princechaddha) [info]
[k8s-netpol-egress-rules] Network policies define egress rules (@princechaddha) [medium]
[k8s-netpol-namespace] Network Policies specify namespace (@princechaddha) [medium]
[k8s-network-ingress-rules] Define network ingress rules (@princechaddha) [medium]
[k8s-allow-privilege-escalation-set] Containers run with allowPrivilegeEscalation enabled (@princechaddha) [critical]
[k8s-containers-share-host-ipc] Containers sharing host IPC namespace (@princechaddha) [critical]
[k8s-host-network-namespace-shared] Host Network Namespace Sharing (@princechaddha) [high]
[k8s-host-pid-namespace-sharing] Host PID Namespace Sharing (@princechaddha) [critical]
[k8s-readonly-fs] Enforce Read-Only Filesystem for Containers (@princechaddha) [critical]
[k8s-readonly-rootfs] Pods with read-only root filesystem (@princechaddha) [medium]
[k8s-root-user-id] Pods run with root user ID (@princechaddha) [low]
[audit-log-path-set] Ensure audit-log-path set (@princechaddha) [medium]
[k8s-enc-prov-conf] Ensure that encryption providers are configured (@princechaddha) [medium]
[k8s-etcd-cafile-set] Ensure etcd-cafile argument set (@princechaddha) [medium]
[k8s-etcd-files-set] Ensure etcd cert and key set (@princechaddha) [medium]
[k8s-ns-usage-check] Ensure namespaces are utilized (@princechaddha) [info]
[k8s-svc-acct-issuer-set] Checks if service-account-issuer is correctly configured (@princechaddha) [medium]
[k8s-svc-acct-key] Ensure service-account-key-file set (@princechaddha) [medium]
[k8s-svc-acct-lookup-set] Ensure service-account-lookup set (@princechaddha) [medium]
[k8s-tls-config-set] Ensure TLS config appropriately set (@princechaddha) [medium]
[time-based-sqli] Time-Based Blind SQL Injection (@0xKayala) [critical]
[anthem-deeppanda-malware-hash] Anthem DeepPanda Trojan Kakfum Malware Hash - Detect (@pussycat0x) [info]
[applejeus-malware-hash] AppleJeus Malware Hash - Detect (@pussycat0x) [info]
[avburner-malware-hash] AVBurner Malware Hash - Detect (@pussycat0x) [info]
[backwash-malware-hash] Backwash Malware Hash - Detect (@pussycat0x) [info]
[blackenergy-driver-amdide-hash] Blackenergy-Driver Amdide Hash - Detect (@pussycat0x) [info]
[blackenergy-driver-malware-hash] BlackEnergy Driver USBMDM Malware Hash - Detect (@pussycat0x) [info]
[blackenergy-killdisk-malware-hash] BlackEnergy KillDisk Malware Hash - Detect (@pussycat0x) [info]
[blackenergy-ssh-malware-hash] BlackEnergy BackdoorPass DropBear SSH Malware Hash - Detect (@pussycat0x) [info]
[blackenergy-vbs-malware-hash] BlackEnergy VBS Agent Malware Hash - Detect (@pussycat0x) [info]
[bluelight-malware-hash] bluelight Malware Hash - Detect (@pussycat0x) [info]
[bluetermite-emdivi-malware-hash] Bluetermite Emdivi Malware Hash - Detect (@pussycat0x) [info]
[bluetermite-emdivi-sfx-hash] Bluetermite Emdivi SFX Malware Hash - Detect (@pussycat0x) [info]
[charmingcypress-malware-hash] CharmingCypress Malware Hash - Detect (@pussycat0x) [info]
[cheshirecat-malware-hash] CheshireCat Malware Hash - Detect (@pussycat0x) [info]
[cloudduke-malware-hash] CloudDuke Malware Hash - Detect (@pussycat0x) [info]
[codoso-gh0st-malware] Codoso APT Gh0st Malware Hash - Detect (@pussycat0x) [info]
[codoso-malware-hash] Codoso APT Malware Hash - Detect (@pussycat0x) [info]
[codoso-pgv-malware-hash] Codoso APT PGV_PVID Malware Hash - Detect (@pussycat0x) [info]
[codoso-plugx-malware-hash] Codoso APT PlugX Malware Hash - Detect (@pussycat0x) [info]
[disgomoji-malware-hash] DISGOMOJI Malware Hash - Detect (@pussycat0x) [info]
[dubnium-malware-hash] Dubnium Malware Hash - Detect (@pussycat0x) [info]
[dubnium-sshopenssl-malware-hash] Dubnium Sample SSHOpenSSL Hash - Detect (@pussycat0x) [info]
[emissary-malware-hash] Emissary APT Malware Hash - Detect (@pussycat0x) [info]
[evilbamboo-malware-hash] EvilBamboo Malware Hash - Detect (@pussycat0x) [info]
[fakem-malware-hash] FakeM_Generic Malware Hash - Detect (@pussycat0x) [info]
[flipflop-ldr-malware-hash] Flipflop Loader Hash - Detect (@pussycat0x) [info]
[furtim-malware-hash] Furtim Malware Hash - Detect (@pussycat0x) [info]
[gimmick-malware-hash] GIMMICK Malware Hash - Detect (@pussycat0x) [info]
[godzilla-webshell-hash] Godzilla Webshell Hash - Detect (@pussycat0x) [info]
[greenbug-malware-hash] Greenbug Malware Hash - Detect (@pussycat0x) [info]
[ico-malware-hash] ICO Malware Hash - Detect (@pussycat0x) [info]
[industroyer-malware-hash] Industroyer Malware Hash - Detect (@pussycat0x) [info]
[ironpanda-htran-malware-hash] Iron Panda Malware Htran Hash - Detect (@pussycat0x) [info]
[ironpanda-dnstunclient-malware-hash] Iron Panda malware DnsTunClient Hash - Detect (@pussycat0x) [info]
[ironpanda-malware-hash] Iron Panda Malware Hash - Detect (@pussycat0x) [info]
[locky-ransomware-hash] Locky Ransomware Hash - Detect (@pussycat0x) [info]
[minidionis-readerview-malware-hash] MiniDionis Malware Hash - Detect (@pussycat0x) [info]
[minidionis-vbs-malware-hash] MiniDionis VBS Dropped File Hash - Detect (@pussycat0x) [info]
[naikon-apt-malware-hash] Backdoor Naikon APT Malware Hash - Detect (@pussycat0x) [info]
[neuron2-malware-hash] Neuron2 Loader Strings Turla APT loader Hash - Detect (@pussycat0x) [info]
[oilrig-malware-hash] OilRig Malware Campaign Gen1 Hash - Detect (@pussycat0x) [info]
[passcv-ntscan-malware-hash] PassCV Sabre Tool NTScan Malware Hash - Detect (@pussycat0x) [info]
[passcv-sabre-malware-hash] PassCV Sabre Malware Hash - Detect (@pussycat0x) [info]
[passcv-signingcert-malware-hash] PassCV Sabre Malware Signing Cert Hash - Detect (@pussycat0x) [info]
[petya-ransomware-hash] Petya Ransomware Hash - Detect (@pussycat0x) [info]
[poseidongroup-maldoc-malware-hash] Poseidon Group Malicious Word Document Hash - Detect (@pussycat0x) [info]
[poseidongroup-malware-hash] Poseidon Group Malware Hash - Detect (@pussycat0x) [info]
[powerstar-malware-hash] PowerStar Malware Hash - Detect (@pussycat0x) [info]
[purplewave-malware-hash] PurpleWave v1.0 Malware Hash - Detect (@pussycat0x) [info]
[red-leaves-malware-hash] Red Leaves Malware Hash - Detect (@pussycat0x) [info]
[regeorg-webshell-hash] ReGeorg Webshell Hash - Detect (@pussycat0x) [info]
[revil-ransomware-hash] Revil Ransomware Hash - Detect (@pussycat0x) [info]
[rokrat-malware-hash] ROKRAT Loader Malware Hash- Detect (@pussycat0x) [info]
[sauron-malware-hash] Sauron Malware Hash - Detect (@pussycat0x) [info]
[seaduke-malware-hash] SeaDuke Malware Hash - Detect (@pussycat0x) [info]
[sfx1-malware-hash] Malicious SFX1 Hash - Detect (@pussycat0x) [info]
[sfxrar-acrotray-malware-hash] SFXRAR Acrotray Malware Hash - Detect (@pussycat0x) [info]
[sharpext-malware-hash] Sharpext Malware Hash - Detect (@pussycat0x) [info]
[sofacy-winexe-malware-hash] Sofacy Group Winexe Tool Hash - Detect (@pussycat0x) [info]
[sofacy-bundestag-malware-hash] Sofacy Group Malware - Detect (@pussycat0x) [info]
[sofacy-fybis-malware-hash] Sofacy Fybis Linux Backdoor Hash - Detect (@pussycat0x) [info]
[tidepool-malware-hash] TidePool Malware Hash - Detect (@pussycat0x) [info]
[turla-malware-hash] Turla APT Malware - Detect (@pussycat0x) [info]
[unit78020-malware-hash] Unit 78020 Malware Hash - Detect (@pussycat0x) [info]
[upstyle-malware-hash] Upstyle Malware Hash - Detect (@Kazgangap) [info]
[wildneutron-malware-hash] WildNeutron APT Sample Hash - Detect (@pussycat0x) [info]
[mantisbt-anonymous-login] mantisbt - Anonymous Login (@pussycat0x) [medium]
[lorex-panel] Lorex Panel - Detect (@rxerium) [info]
[oracle-application-server-panel] Oracle Application Server Panel - Detect (@righettod) [info]
[trellix-panel] Trellix Login Panel (@johnk3r) [info]
[turnkey-lamp-panel] TurnKey LAMP Panel - Detect (@ritikchaddha) [info]
[veeam-backup-manager-login] Veeam Backup Enterprise Manager Login - Detect (@charles D) [info]
[wildix-collaboration-panel] Wildix Collaboration Panel - Detect (@rxerium) [info]
[apache-server-status-localhost] Server Status Disclosure (@pdteam, @geeknik, @NaN-KL) [low]
[cookies-without-secure] Cookies without Secure attribute - Detect (@vthiery) [info]
[apache-allura-detect] Apache Allura - Detection (@icarot) [info]
[nperf-server-detect] nPerf Server - Detect (@rxerium) [info]
[wordpress-copy-delete-posts] Duplicate Post Detection (@ricardomaia) [info]
[wordpress-image-optimization] Image Optimizer by Elementor (@ricardomaia) [info]
[wordpress-royal-elementor-addons] Royal Elementor Addons and Templates Detection (@ricardomaia) [info]
[wordpress-simple-history] Simple History – Track, Log, and Audit WordPress Changes Detection (@ricardomaia) [info]
[wordpress-sticky-header-effects-for-elementor] Sticky Header Effects for Elementor Detection (@ricardomaia) [info]
[wordpress-woocommerce-legacy-rest-api] WooCommerce Legacy REST API Detection (@ricardomaia) [info]
[gradio-lfi] Gradio 3.47 – 3.50.2 - Local File Inclusion (@nvn1729) [high]
[gradio-ssrf] Gradio 3.47 - 3.50.2 - Server-Side Request Forgery (@nvn1729) [high]
[fastadmin-lfi] Fastadmin framework - Arbitrary File Read (@Hel10-Web) [high]
[mikrotik-ssh-detect] MikroTik RouterOS SSH - Detect (@staticnoise) [info]

New Contributors

@chovanecadam made their first contribution in #10016
@NaN-KL made their first contribution in #9825
@vthiery made their first contribution in #10048
@KristinnVikar made their first contribution in #9996

Full Changelog: v9.8.9...v9.9.0

Added CVE-2024-4577 + Bug fixes

2024-06-13T07:23:53Z

🔥 Release Highlights 🔥

[CVE-2024-4577] PHP CGI - Argument Injection (@hüseyin TINTAŞ, @sw0rk17, @s4e-garage, @pdresearch) [critical]

What's Changed

Lorex Favicon Hash by @rxerium in #10001
add cve-2024-4577 by @Kazgangap in #9997

Full Changelog: v9.8.8...v9.8.9

v9.8.8

2024-06-25T12:11:01Z

🔥 Release Highlights 🔥

[CVE-2024-27348] Apache HugeGraph-Server - Remote Command Execution (@dhiyaneshdk) [high] 🔥
[CVE-2024-24919] Check Point Quantum Gateway - Information Disclosure (@johnk3r) [high] 🔥
[CVE-2024-21683] Atlassian Confluence Data Center and Server - Remote Code Execution (@pdresearch) [high] 🔥
[CVE-2024-4358] Progress Telerik Report Server - Authentication Bypass (@dhiyaneshdk) [critical] 🔥
[CVE-2024-3495] Wordpress Country State City Dropdown <=2.7.2 - SQL Injection (@apple) [critical] 🔥

What's Changed

New Templates Added: `77` | CVEs Added: `17` | First-time contributions: `8`

[CVE-2024-34470] HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion (@topscoder) [high]
[CVE-2024-27348] Apache HugeGraph-Server - Remote Command Execution (@dhiyaneshdk) [high] 🔥
[CVE-2024-25723] ZenML ZenML Server - Improper Authentication (@david Botelho Mariano) [critical]
[CVE-2024-24919] Check Point Quantum Gateway - Information Disclosure (@johnk3r) [high] 🔥
[CVE-2024-21683] Atlassian Confluence Data Center and Server - Remote Code Execution (@pdresearch) [high] 🔥
[CVE-2024-5230] FleetCart 4.1.1 - Information Disclosure (@SecurityForEveryone) [medium]
[CVE-2024-4358] Progress Telerik Report Server - Authentication Bypass (@dhiyaneshdk) [critical] 🔥
[CVE-2024-3822] Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Scripting (@omranisecurity) [medium]
[CVE-2024-3495] Wordpress Country State City Dropdown <=2.7.2 - SQL Injection (@apple) [critical] 🔥
[CVE-2024-1380] Relevanssi (A Better Search) <= 4.22.0 - Query Log Export (@flx) [medium]
[CVE-2023-48084] Nagios XI < 5.11.3 - SQL Injection (@ritikchaddha) [critical]
[CVE-2023-35162] XWiki < 14.10.5 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-3077] MStore API < 3.9.8 - SQL Injection (@dhiyaneshdk) [critical]
[CVE-2023-2059] DedeCMS 5.7.87 - Directory Traversal (@pussycat0x) [medium]
[CVE-2022-34534] Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure (@ritikchaddha) [high]
[CVE-2022-1580] Site Offline WP Plugin < 1.5.3 - Authorization Bypass (@Kazgangap) [medium]
[CVE-2022-0666] Microweber < 1.2.11 - CRLF Injection (@ritikchaddha) [high]
[sns-topic-public-accessible] Public Access of SNS Topics via Policy (@Ritesh_Gohil(#L4stPL4Y3R)) [high]
[webpack-sourcemap] Webpack Sourcemap (@Lucky0x0D, @PulseSecurity.co.nz) [low]
[CNVD-2024-15077] AJ-Report Open Source Data Screen - Remote Code Execution (@pussycat0x) [high]
[ampjuke-default-login] AmpJuke - Default Login (@ritikchaddha) [high]
[cambium-networks-default-login] Canopy 5.7GHz Access Point - Default Login (@defektive) [high]
[digital-watchdog-default-login] Digital Watchdog - Default Login (@omranisecurity) [high]
[busybox-repository-browser] Busybox Repository Browser - Detect (@ritikchaddha) [info]
[cisco-firepower-panel] Cisco Firepower Management Center login - Detect (@charles D) [info]
[cox-business-panel] Cox Business Dominion Gateway Login Panel - Detect (@dhiyaneshdk) [info]
[digital-watchdog-panel] Digital Watchdog - Detect (@ritikchaddha) [info]
[f5-admin-interface] F5 Admin Interface - Detect (@drewvravick) [info]
[fortisiem-panel] FortiSIEM Login Panel - Detect (@pussycat0x) [info]
[oracle-access-management] Oracle Access Management Login Panel - Detect (@righettod) [info]
[oracle-peoplesoft-panel] Oracle PeopleSoft Login Panel - Detect (@idealphase, @righettod) [info]
[vrealize-hyperic-panel] vRealize Hyperic Login Panel - Detect (@charles D) [info]
[wechat-corpsecret-key] Enterprise WeChat Corpsecret Key (@N0el4kLs) [info]
[netgear-boarddataww-rce] Netgear Devices boardDataWW.php - Unauth RCE (@pussycat0x) [critical]
[directory-listing] Directory Listing Enabled (@themiddle) [low]
[dont-panic-traceback] DON'T PANIC Traceback (@ritikchaddha) [low]
[cowboy-detect] Cowboy - Detect (@Sechunt3r) [info]
[gabia-server-detect] Gabia Server - Detection (@jadu101) [info]
[gotweb-detect] GotWeb Detect (@lu4nx) [info]
[sparklighter-detect] Spark Lighter Detection (@icarot) [info]
[aquatronica-info-leak] Aquatronica Control System 5.1.6 - Information Disclosure (@SecurityForEveryone) [high]
[array-vpn-lfi] Array VPN - Arbitrary File Reading Vulnerability (@pussycat0x) [high]
[cerio-dt-rce] CERIO-DT Interface - Command Execution (@pussycat0x) [critical]
[easycvr-info-leak] EasyCVR video management - Users Information Exposure (@pussycat0x) [high]
[proftpd-backdoor] ProFTPd-1.3.3c - Backdoor Command Execution (@pussycat0x) [critical]
[samba-detect] Samba - Detection (@pussycat0x) [info]
[rsync-list-modules] Rsync List Modules - Enumeration (@pussycat0x) [low]
[bitvise-detect] SSH Bitvise Service - Detect (@abdullahisik) [info]
[activecollab-installer] ActiveCollab Installation Page - Exposure (@dhiyaneshdk) [high]
[call-com-installer] Call.com Setup Page - Exposure (@dhiyaneshdk) [high]
[cms-made-simple-installer] CMS Made Simple Installation Page - Exposure (@dhiyaneshdk) [high]
[confluence-installer] Confluence Installation Page - Exposure (@dhiyaneshdk) [high]
[cubebackup-setup-installer] CubeBackup Setup Page - Exposure (@dhiyaneshdk) [high]
[easy-wi-installer] Easy-WI Installation Page - Exposure (@dhiyaneshdk) [high]
[ejbca-enterprise-installer] EJBCA Enterprise Cloud Configuration Wizard - Exposure (@dhiyaneshdk) [high]
[flarum-installer] Flarum Installation Page - Exposure (@dhiyaneshdk) [high]
[fleetcart-installer] FleetCart Installation Page - Exposure (@dhiyaneshdk) [high]
[glpi-installer] GLPI Installation Page - Exposure (@dhiyaneshdk) [high]
[invicti-enterprise-installer] Invicti Enterprise Installation Page - Exposure (@dhiyaneshdk) [high]
[invoice-ninja-installer] Invoice Ninja Setup Page - Exposure (@dhiyaneshdk) [high]
[jfa-go-installer] jfa-go Setup Page - Exposure (@dhiyaneshdk) [high]
[justfans-installer] JustFans Installation Page - Exposure (@dhiyaneshdk) [high]
[librenms-installer] LibreNMS Installation Page - Exposure (@dhiyaneshdk) [high]
[mura-cms-setup-installer] Mura CMS Setup Page - Exposure (@dhiyaneshdk) [high]
[onlyoffice-installer] OnlyOffice Wizard Page - Exposure (@dhiyaneshdk) [high]
[openemr-setup-installer] OpenEMR Setup Installation Page - Exposure (@dhiyaneshdk) [high]
[orchard-installer] Orchard Setup Wizard - Exposure (@dhiyaneshdk) [high]
[pandora-fms-installer] Pandora FMS Installation Page - Exposure (@dhiyaneshdk) [high]
[profittrailer-installer] ProfitTrailer Setup Page - Exposure (@dhiyaneshdk) [high]
[projectsend-installer] ProjectSend Installation Page - Exposure (@dhiyaneshdk) [high]
[snipe-it-installer] Snipe-IT Setup Page - Exposure (@dhiyaneshdk) [high]
[stackposts-installer] StackPosts Installation Page - Exposure (@dhiyaneshdk) [high]
[tastyigniter-installer] TastyIgniter Setup Page - Exposure (@dhiyaneshdk) [high]
[ubersmith-installer] Ubersmith Setup Page - Exposure (@dhiyaneshdk) [high]
[uvdesk-helpdesk-installer] UVDesk Helpdesk Installation Page - Exposure (@dhiyaneshdk) [high]
[virtual-smartzone-installer] Virtual SmartZone Setup Wizard - Exposure (@dhiyaneshdk) [high]
[wowonder-installer] WoWonder Installation Page - Exposure (@dhiyaneshdk) [high]

New Contributors

@defektive made their first contribution in #9845
@N0el4kLs made their first contribution in #9867
@moyue83 made their first contribution in #9929
@isikabdullah44 made their first contribution in #9850
@Dev0psSec made their first contribution in #9967
@icarot made their first contribution in #9827
@pdteamx made their first contribution in #9978
@L4stPL4Y3R made their first contribution in #9988

Full Changelog: v9.8.7...v9.8.8

v9.8.7

2024-05-23T15:31:32Z

🔥 Release Highlights 🔥

[CVE-2024-0200] Github Enterprise - Authenticated RCE (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-4956] Sonatype Nexus Repository Manager 3 - Local File Inclusion (@ritikchaddha) [high] 🔥
[CVE-2024-0195] SpiderFlow Crawler Platform - Remote Code Execution (@pussycat0x) [critical] 🔥
[CVE-2023-43374] Hoteldruid v3.0.5 - SQL Injection (@ritikchaddha) [critical] 🔥

What's Changed

New Templates Added: `62` | CVEs Added: `16` | First-time contributions: `3`

[CVE-2024-33288] Prison Management System - SQL Injection Authentication Bypass (@Kazgangap) [high]
[CVE-2024-4956] Sonatype Nexus Repository Manager 3 - Local File Inclusion (@ritikchaddha) [high] 🔥
[CVE-2024-3097] NextGEN Gallery <= 3.59 - Missing Authorization to Unauth Information Disclosure (@DhiyanesDK) [medium]
[CVE-2024-1561] Gradio Applications - Local File Read (@diablo) [high]
[CVE-2024-0200] Github Enterprise - Authenticated RCE (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
[CVE-2024-0195] SpiderFlow Crawler Platform - Remote Code Execution (@pussycat0x) [critical] 🔥
[CVE-2023-45855] qdPM 9.2 - Directory Traversal (@dhiyaneshdk) [high]
[CVE-2023-44813] mooSocial v.3.1.8 - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-43374] Hoteldruid v3.0.5 - SQL Injection (@ritikchaddha) [critical] 🔥
[CVE-2023-36347] POS Codekop v2.0 - Broken Authentication (@princechaddha) [high]
[CVE-2023-36284] QloApps 1.6.0 - SQL Injection (@ritikchaddha) [high]
[CVE-2023-35158] XWiki - Cross-Site Scripting (@ritikchaddha) [medium]
[CVE-2023-29827] Embedded JavaScript(EJS) 3.1.6 - Template Injection (@ritikchaddha) [critical]
[CVE-2023-6065] Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure (@Kazgangap) [medium]
[CVE-2023-5991] Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion (@Kazgangap) [critical]
[CVE-2023-4542] D-Link DAR-8000-10 - Command Injection (@pussycat0x) [critical]
[CNVD-2017-06001] Dahua DSS - SQL Injection (@napgh0st, @ritikchaddha) [high]
[softether-vpn-default-login] SoftEther VPN Admin Console - Default Login (@bhutch) [high]
[ackee-panel] Ackee Panel - Detect (@userdehghani) [info]
[craftercms-panel] CrafterCMS Login Panel - Detect (@righettod) [info]
[easyvista-panel] EasyVista Login Panel - Detect (@righettod) [info]
[f5-next-central-manager] F5 Next Central Manager Panel - Detect (@EgemenKochisarli) [info]
[ghost-panel] Ghost Panel - Detect (@userdehghani) [info]
[matomo-panel] Matomo Panel - Detect (@Arr0way, @userdehghani) [info]
[microfocus-lifecycle-panel] Micro Focus Application Lifecycle Management - Panel (@righettod) [info]
[n8n-panel] n8n Panel - Detect (@userdehghani) [info]
[nocodb-panel] NocoDB Panel - Detect (@userdehghani) [info]
[oracle-ebusiness-panel] Oracle E-Business Suite Login Panel - Detect (@righettod) [info]
[pocketbase-panel] PocketBase Panel - Detect (@userdehghani) [info]
[qlikview-accesspoint-panel] QlikView AccessPoint Login Panel - Detect (@righettod) [info]
[tiny-rss-panel] Tiny RSS Panel - Detect (@userdehghani) [info]
[unleash-panel] Unleash Panel - Detect (@userdehghani) [info]
[tpot-honeypot-detect] T-Pot Honeypot - Detect (@rxerium) [info]
[imgproxy-unauth] Imgproxy Unauthorized Access (@userdehghani) [low]
[custom-xoops-installer] XOOPS Custom - Installation (@dhiyaneshdk) [high]
[easy-viserlabs-installer] Easy Installer by ViserLab - Exposure (@dhiyaneshdk) [high]
[forgejo-installer] Forgejo Installation Page - Exposure (@dhiyaneshdk) [high]
[froxlor-installer] Froxlor Server Management - Installer (@dhiyaneshdk) [high]
[growi-installer] GROWI Installer - Exposure (@dhiyaneshdk) [high]
[ids-skills-installer] IDP Skills Installer - Exposure (@dhiyaneshdk) [high]
[moosocial-installer] mooSocial Installation - Exposure (@ritikchaddha) [high]
[octoprint-installer] OctoPrint Installation Page - Exposure (@dhiyaneshdk) [high]
[openfire-setup] Openfire Setup - Exposure (@dhiyaneshdk) [high]
[phpmyfaq-installer] phpMyFAQ Installation - Exposure (@ritikchaddha) [high]
[qloapps-installer] QloApps - Installation (@ritikchaddha) [high]
[trilium-notes-installer] Trilium Notes Installer - Exposure (@dhiyaneshdk) [high]
[wiki-js-installer] Wiki.js Setup - Exposure (@dhiyaneshdk) [high]
[xbackbone-installer] XBackBone Installer - Exposure (@dhiyaneshdk) [high]
[unigui-server-monitor-exposure] UniGUI Server Monitor Panel - Exposure (@serrapa) [low]
[apache-answer-detect] Apache Answer - Detection (@omranisecurity) [info]
[boa-web-server] Boa Web Server - Detect (@johnk3r) [info]
[craftercms-detect] CrafterCMS - Detect (@righettod) [info]
[imgproxy-detect] Imgproxy Detect (@userdehghani) [info]
[meilisearch-detect] Meilisearch - Detect (@userdehghani) [info]
[microfocus-iprint-detect] Micro Focus iPrint Appliance - Detect (@righettod) [info]
[statamic-detect] Statamic - Detect (@geeknik) [info]
[tinyproxy-detect] Tinyproxy - Detect (@bhutch) [info]
[uni-gui-framework] UniGUI Framework - Detect (@serrapa) [info]
[wp-bricks-builder-theme] WordPress Bricks Builder Theme Version (@Anonymous) [info]
[castel-digital-sqli] Castel Digital - Authentication Bypass (@Kazgangap) [high]
[tendat-credential] Tendat Router Credential - Exposure (@pussycat0x) [high]
[checkpoint-firewall-enum] Check Point Firewall - Detect (@pussycat0x) [info]

New Contributors

@x676f64 made their first contribution in #9690
@Ahsraeisi made their first contribution in #9793
@jmac774 made their first contribution in #9844

Full Changelog: v9.8.6...v9.8.7

v9.8.6

2024-05-12T02:34:20Z

🔥 Release Highlights 🔥

http/cves/2024/CVE-2024-23917.yaml by @iamnoooob,@rootxharsh,@pdresearch 🔥
http/cves/2024/CVE-2024-27956.yaml by @dhiyaneshdk 🔥
http/cves/2024/CVE-2024-2876.yaml by @iamnoooob,@rootxharsh,@pdresearch 🔥
http/cves/2024/CVE-2024-3136.yaml by @iamnoooob,@rootxharsh,@pdresearch 🔥
http/cves/2024/CVE-2024-31848.yaml by @pussycat0x 🔥
http/cves/2024/CVE-2024-4040.yaml by @dhiyaneshdk,@pussycat0x 🔥
http/cves/2023/CVE-2023-2227.yaml by @ritikchaddha,@princechaddha 🔥
http/cves/2023/CVE-2023-31446.yaml by @dhiyaneshdk 🔥
http/cves/2023/CVE-2023-43208.yaml by @princechaddha 🔥
http/cves/2023/CVE-2023-6989.yaml by @Kazgangap 🔥
http/cves/2019/CVE-2019-7139.yaml by @mastercho 🔥

What's Changed

New Templates Added: `65` | CVEs Added: `41` | First-time contributions: `3`

http/cves/2024/CVE-2024-0235.yaml by @princechaddha
http/cves/2024/CVE-2024-0881.yaml by @Kazgangap
http/cves/2024/CVE-2024-1183.yaml by @dhiyaneshdk
http/cves/2024/CVE-2024-22927.yaml by @ritikchaddha
http/cves/2024/CVE-2024-2340.yaml by @t3l3machus
http/cves/2024/CVE-2024-23917.yaml by @iamnoooob,@rootxharsh,@pdresearch 🔥
http/cves/2024/CVE-2024-24131.yaml by @dhiyaneshdk
http/cves/2024/CVE-2024-27956.yaml by @dhiyaneshdk 🔥
http/cves/2024/CVE-2024-2876.yaml by @iamnoooob,@rootxharsh,@pdresearch 🔥
http/cves/2024/CVE-2024-3136.yaml by @iamnoooob,@rootxharsh,@pdresearch 🔥
http/cves/2024/CVE-2024-31621.yaml by @dhiyaneshdk
http/cves/2024/CVE-2024-31848.yaml by @pussycat0x 🔥
http/cves/2024/CVE-2024-31849.yaml by @dhiyaneshdk
http/cves/2024/CVE-2024-31850.yaml by @dhiyaneshdk
http/cves/2024/CVE-2024-31851.yaml by @dhiyaneshdk
http/cves/2024/CVE-2024-32399.yaml by @dhiyaneshdk
http/cves/2024/CVE-2024-32640.yaml by @iamnoooob,@rootxharsh,@pdresearch
http/cves/2024/CVE-2024-32651.yaml by @edoardottt
http/cves/2024/CVE-2024-33575.yaml by @Kazgangap
http/cves/2024/CVE-2024-33724.yaml by @Kazgangap
http/cves/2024/CVE-2024-4040.yaml by @dhiyaneshdk,@pussycat0x 🔥
http/cves/2024/CVE-2024-4348.yaml by @Kazgangap
http/cves/2023/CVE-2023-1892.yaml by @ritikchaddha,@princechaddha
http/cves/2023/CVE-2023-2227.yaml by @ritikchaddha,@princechaddha 🔥
http/cves/2023/CVE-2023-27032.yaml by @mastercho
http/cves/2023/CVE-2023-2948.yaml by @ritikchaddha,@princechaddha
http/cves/2023/CVE-2023-2949.yaml by @ritikchaddha,@princechaddha
http/cves/2023/CVE-2023-31446.yaml by @dhiyaneshdk 🔥
http/cves/2023/CVE-2023-32077.yaml by @iamnoooob,@rootxharsh,@pdresearch
http/cves/2023/CVE-2023-38964.yaml by @ritikchaddha
http/cves/2023/CVE-2023-43208.yaml by @princechaddha 🔥
http/cves/2023/CVE-2023-44812.yaml by @ritikchaddha
http/cves/2023/CVE-2023-4521.yaml by @princechaddha
http/cves/2023/CVE-2023-45375.yaml by @mastercho
http/cves/2023/CVE-2023-46347.yaml by @mastercho
http/cves/2023/CVE-2023-4973.yaml by @ritikchaddha,@princechaddha
http/cves/2023/CVE-2023-5003.yaml by @Kazgangap
http/cves/2023/CVE-2023-6389.yaml by @Kazgangap
http/cves/2023/CVE-2023-6989.yaml by @Kazgangap 🔥
http/cves/2019/CVE-2019-7139.yaml by @mastercho 🔥
http/cves/2015/CVE-2015-4455.yaml by @mastercho
http/vulnerabilities/citrix/citrix-oob-memory-read.yaml by @Ice3man
http/vulnerabilities/prestashop/prestashop-cartabandonmentpro-file-upload.yaml by @mastercho
http/vulnerabilities/titan/titannit-web-rce.yaml by @dhiyaneshdk
http/vulnerabilities/vbulletin/vbulletin-search-sqli.yaml by @mastercho
http/default-logins/crushftp/crushftp-anonymous-login.yaml by @pussycat0x
http/default-logins/crushftp/crushftp-default-login.yaml by @pussycat0x
http/default-logins/soplanning/soplanning-default-login.yaml by @Kazgangap
http/misconfiguration/installer/eyoucms-installer.yaml by @ritikchaddha
http/misconfiguration/installer/sabnzbd-installer.yaml by @dhiyaneshdk
http/misconfiguration/microsoft/ms-exchange-local-domain.yaml by @userdehghani
http/misconfiguration/titannit-web-exposure.yaml by @dhiyaneshdk
http/takeovers/squadcast-takeover.yaml by @philippedelteil
http/exposed-panels/bmc/bmc-remedy-sso-panel.yaml by @righettod
http/exposed-panels/bonobo-server-panel.yaml by @bhutch
http/exposed-panels/cassia-bluetooth-gateway-panel.yaml by @dhiyaneshdk
http/exposed-panels/cyberchef-panel.yaml by @rxerium
http/exposed-panels/femtocell-panel.yaml by @dhiyaneshdk
http/exposed-panels/monitorr-panel.yaml by @ritikchaddha
http/exposed-panels/openwebui-panel.yaml by @rxerium
http/exposed-panels/teamforge-panel.yaml by @lstatro
http/exposed-panels/tixeo-panel.yaml by @righettod
http/exposed-panels/umami-panel.yaml by @userdehghani
network/detection/aix-websm-detect.yaml by @righettod
network/detection/bluecoat-telnet-proxy-detect.yaml by @righettod

New Contributors

@theMiddleBlue made their first contribution in #9637
@userdehghani made their first contribution in #9666
@jason3e7 made their first contribution in #9731

Full Changelog: v9.8.5...v9.8.6

v9.8.5 - AWS Cloud Config Review

2024-04-22T16:51:11Z

🔥 Release Highlights 🔥

We're excited to share about Nuclei-Templates v9.8.5! This new version includes newly added AWS cloud config review templates.
These templates can be used by companies or pentesters for identifying misconfigurations in the AWS cloud environment.

Similarly by leveraging aws code templates, security teams will be able to write their own checks for identifying misconfigurations that are specific to their particular workflows. This will enable them to effectively identify and remediate potential security issues within AWS environments.

To use cloud configuration review templates, first we need set up the environment. This setup is similar to using the aws-cli, where you either add aws_access_key_id and aws_secret_access_key to the ~/.aws/credentials file or export them as environment variables.

nuclei -id aws-code-env -code

We've also introduced the concept of profiles, which allow users to run a specific set of templates tailored for a particular use case. For running AWS templates, we have a profile named aws-cloud-config.

Now you're all set to run the templates!

nuclei -config ~/nuclei-templates/profiles/aws-cloud-config.yml -cloud-upload

What's Changed

New Templates Added: `142` | CVEs Added: `10` | First-time contributions: `6`

http/cves/2024/CVE-2024-26331.yaml by @carsonchan12345 🔥
http/cves/2024/CVE-2024-3400.yaml by @Salts,@parthmalhotra 🔥
http/cves/2024/CVE-2024-3273.yaml by @pussycat0x 🔥
code/cves/2024/CVE-2024-3094.yaml by @pdteam 🔥
http/cves/2024/CVE-2024-2879.yaml by @d4ly 🔥
http/cves/2024/CVE-2024-2389.yaml by @pdresearch,@parthmalhotra 🔥
http/cves/2024/CVE-2024-0337.yaml by @Kazgangap
javascript/cves/2023/CVE-2023-48795.yaml by @pussycat0x
http/cves/2022/CVE-2022-24627.yaml by @geeknik
http/cves/2022/CVE-2022-0424.yaml by @Kazgangap
http/vulnerabilities/other/opencart-core-sqli.yaml by @Kazgangap
http/vulnerabilities/other/quick-cms-sqli.yaml by @Kazgangap
http/vulnerabilities/other/user-management-system-sqli.yaml by @f0xy
cloud/aws/acm/acm-cert-expired.yaml by @princechaddha
cloud/aws/acm/acm-cert-renewal-30days.yaml by @princechaddha
cloud/aws/acm/acm-cert-renewal-45days.yaml by @princechaddha
cloud/aws/acm/acm-cert-validation.yaml by @princechaddha
cloud/aws/acm/acm-wildcard-cert.yaml by @princechaddha
cloud/aws/aws-code-env.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-data-events.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-disabled.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-dup-logs.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-global-disabled.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-integrated-cloudwatch.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-log-integrity.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-logs-not-encrypted.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-mfa-delete.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-mgmt-events.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-public-buckets.yaml by @princechaddha
cloud/aws/cloudtrail/cloudtrail-s3-bucket-logging.yaml by @princechaddha
cloud/aws/cloudtrail/s3-object-lock-not-enabled.yaml by @princechaddha
cloud/aws/cloudwatch/cw-alarm-action-set.yaml by @princechaddha
cloud/aws/cloudwatch/cw-alarms-actions.yaml by @princechaddha
cloud/aws/ec2/ec2-imdsv2.yaml by @princechaddha
cloud/aws/ec2/ec2-public-ip.yaml by @princechaddha
cloud/aws/ec2/ec2-sg-egress-open.yaml by @princechaddha
cloud/aws/ec2/ec2-sg-ingress.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-cifs.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-dns.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-ftp.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-http.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-https.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-icmp.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-memcached.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-mongodb.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-mssql.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-mysql.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-netbios.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-opensearch.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-oracle.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-pgsql.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-rdp.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-redis.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-smtp.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-ssh.yaml by @princechaddha
cloud/aws/ec2/ec2-unrestricted-telnet.yaml by @princechaddha
cloud/aws/ec2/publicly-shared-ami.yaml by @princechaddha
cloud/aws/ec2/unencrypted-aws-ami.yaml by @princechaddha
cloud/aws/iam/iam-access-analyzer.yaml by @princechaddha
cloud/aws/iam/iam-expired-ssl.yaml by @princechaddha
cloud/aws/iam/iam-full-admin-privileges.yaml by @princechaddha
cloud/aws/iam/iam-key-rotation-90days.yaml by @princechaddha
cloud/aws/iam/iam-mfa-enable.yaml by @princechaddha
cloud/aws/iam/iam-password-policy.yaml by @princechaddha
cloud/aws/iam/iam-root-mfa.yaml by @princechaddha
cloud/aws/iam/iam-ssh-keys-rotation.yaml by @princechaddha
cloud/aws/iam/iam-unapproved-policy.yaml by @princechaddha
cloud/aws/iam/iam-user-password-change.yaml by @princechaddha
cloud/aws/iam/ssl-cert-renewal.yaml by @princechaddha
cloud/aws/rds/aurora-copy-tags-snap.yaml by @princechaddha
cloud/aws/rds/aurora-delete-protect.yaml by @princechaddha
cloud/aws/rds/iam-db-auth.yaml by @princechaddha
cloud/aws/rds/rds-backup-enable.yaml by @princechaddha
cloud/aws/rds/rds-deletion-protection.yaml by @princechaddha
cloud/aws/rds/rds-encryption-check.yaml by @princechaddha
cloud/aws/rds/rds-event-notify.yaml by @princechaddha
cloud/aws/rds/rds-event-sub-enable.yaml by @princechaddha
cloud/aws/rds/rds-event-sub.yaml by @princechaddha
cloud/aws/rds/rds-gp-ssd-usage.yaml by @princechaddha
cloud/aws/rds/rds-public-snapshot.yaml by @princechaddha
cloud/aws/rds/rds-public-subnet.yaml by @princechaddha
cloud/aws/rds/rds-ri-payment-fail.yaml by @princechaddha
cloud/aws/rds/rds-snapshot-encryption.yaml by @princechaddha
cloud/aws/s3/s3-access-logging.yaml by @princechaddha
cloud/aws/s3/s3-auth-fullcontrol.yaml by @princechaddha
cloud/aws/s3/s3-bucket-key.yaml by @princechaddha
cloud/aws/s3/s3-bucket-policy-public-access.yaml by @princechaddha
cloud/aws/s3/s3-mfa-delete-check.yaml by @princechaddha
cloud/aws/s3/s3-public-read-acp.yaml by @princechaddha
cloud/aws/s3/s3-public-read.yaml by @princechaddha
cloud/aws/s3/s3-public-write-acp.yaml by @princechaddha
cloud/aws/s3/s3-public-write.yaml by @princechaddha
cloud/aws/s3/s3-server-side-encryption.yaml by @princechaddha
cloud/aws/s3/s3-versioning.yaml by @princechaddha
cloud/aws/vpc/nacl-open-inbound.yaml by @princechaddha
cloud/aws/vpc/nacl-outbound-restrict.yaml by @princechaddha
cloud/aws/vpc/nat-gateway-usage.yaml by @princechaddha
cloud/aws/vpc/unrestricted-admin-ports.yaml by @princechaddha
cloud/aws/vpc/vpc-endpoint-exposed.yaml by @princechaddha
cloud/aws/vpc/vpc-endpoints-not-deployed.yaml by @princechaddha
cloud/aws/vpc/vpc-flowlogs-not-enabled.yaml by @princechaddha
cloud/aws/vpc/vpn-tunnel-down.yaml by @princechaddha
http/misconfiguration/apple-cups-exposure.yaml by @dhiyaneshdk
http/misconfiguration/dlink-unauth-cgi-script.yaml by @pussycat0x
http/misconfiguration/helm-dashboard-exposure.yaml by @dhiyaneshdk
http/misconfiguration/installer/phpipam-installer.yaml by @dhiyaneshdk
http/misconfiguration/intelbras-dvr-unauth.yaml by @pussycat0x
http/misconfiguration/sentinel-license-monitor.yaml by @dhiyaneshdk
http/misconfiguration/thanos-prometheus-exposure.yaml by @dhiyaneshdk
http/default-logins/allnet/allnet-default-login.yaml by @ritikchaddha
http/default-logins/asus/asus-rtn16-default-login.yaml by @ritikchaddha
http/default-logins/asus/asus-wl500g-default-login.yaml by @ritikchaddha
http/default-logins/asus/asus-wl520GU-default-login.yaml by @ritikchaddha
http/default-logins/barco-clickshare-default-login.yaml by @ritikchaddha
http/exposed-panels/akhq-panel.yaml by @dhiyaneshdk
http/exposed-panels/algonomia-panel.yaml by @righettod
http/exposed-panels/beyondtrust-priv-panel.yaml by @righettod
http/exposed-panels/chemotargets-clarityvista-panel.yaml by @righettod
http/exposed-panels/mitel-micollab-panel.yaml by @righettod
http/exposed-panels/mitric-checker-panel.yaml by @righettod
http/exposed-panels/ni-web-based-panel.yaml by @dhiyaneshdk
http/exposed-panels/ollama-llm-panel.yaml by @pbuff07
http/exposed-panels/outsystems-servicecenter-panel.yaml by @righettod
http/exposed-panels/powerchute-network-panel.yaml by @dhiyaneshdk
http/exposed-panels/rtm-web-panel.yaml by @dhiyaneshdk
http/exposed-panels/suprema-biostar-panel.yaml by @ritikchaddha
http/exposed-panels/tibco-spotfire-panel.yaml by @righettod
http/exposed-panels/uipath-orchestrator-panel.yaml by @righettod
http/exposed-panels/urbackup-panel.yaml by @dhiyaneshdk
http/exposed-panels/zenml-dashboard-panel.yaml by @dhiyaneshdk
http/exposures/apis/aspnet-soap-webservices-asmx.yaml by @righettod
http/exposures/apis/redfish-api.yaml by @righettod
http/exposures/files/ht-deployment.yaml by @Michal-Mikolas
http/takeovers/gohire-takeover.yaml by @philippedelteil
http/takeovers/helpdocs-takeover.yaml by @philippedelteil
http/takeovers/softr-takeover.yaml by @philippedelteil
http/takeovers/uptime-takeover.yaml by @philippedelteil
http/technologies/citrix-xenmobile-version.yaml by @Puben
http/technologies/splunkhec-detect.yaml by @idealphase
http/technologies/tibco-spotfire-services-detect.yaml by @righettod
ssl/c2/sliver-c2.yaml by @johnk3r
dns/bimi-detect.yaml by @rxerium

New Contributors

@d4lyw made their first contribution in #9512
@Puben made their first contribution in #9530
@carsonchan12345 made their first contribution in #9566
@0xKayala made their first contribution in #9573
@scottdharvey made their first contribution in #9585
@Eyub-kurnaz made their first contribution in #9450

Full Changelog: v9.8.1...v9.8.5

Release notes from nuclei-templates

v9.9.4

What's Changed

🔥 Release Highlights 🔥

Bug Fixes

False Positives

Enhancements

Template Updates

New Templates Added: 59 | CVEs Added: 30 | First-time contributions: 13

New Contributors

v9.9.3

🔥 Release Highlights 🔥

What's Changed

New Templates Added: 56 | CVEs Added: 33 | First-time contributions: 4

New Contributors

v9.9.2

🔥 Release Highlights 🔥

What's Changed

New Templates Added: 67 | CVEs Added: 32 | First-time contributions: 7

New Contributors

v9.9.1

🔥 Release Highlights 🔥

What's Changed

New Templates Added: 75 | CVEs Added: 29 | First-time contributions: 5

New Contributors

v9.9.0 - Kubernetes Cluster Security 🎉

🔥 Release Highlights 🔥

Other Highlights

What's Changed

New Templates Added: 164 | CVEs Added: 41 | First-time contributions: 4

New Contributors

Added CVE-2024-4577 + Bug fixes

🔥 Release Highlights 🔥

What's Changed

v9.8.8

🔥 Release Highlights 🔥

What's Changed

New Templates Added: 77 | CVEs Added: 17 | First-time contributions: 8

New Contributors

v9.8.7

🔥 Release Highlights 🔥

What's Changed

New Templates Added: 62 | CVEs Added: 16 | First-time contributions: 3

New Contributors

v9.8.6

🔥 Release Highlights 🔥

What's Changed

New Templates Added: 65 | CVEs Added: 41 | First-time contributions: 3

New Contributors

v9.8.5 - AWS Cloud Config Review

🔥 Release Highlights 🔥

What's Changed

New Templates Added: 142 | CVEs Added: 10 | First-time contributions: 6

New Contributors

New Templates Added: `59` | CVEs Added: `30` | First-time contributions: `13`

New Templates Added: `56` | CVEs Added: `33` | First-time contributions: `4`

New Templates Added: `67` | CVEs Added: `32` | First-time contributions: `7`

New Templates Added: `75` | CVEs Added: `29` | First-time contributions: `5`

New Templates Added: `164` | CVEs Added: `41` | First-time contributions: `4`

New Templates Added: `77` | CVEs Added: `17` | First-time contributions: `8`

New Templates Added: `62` | CVEs Added: `16` | First-time contributions: `3`

New Templates Added: `65` | CVEs Added: `41` | First-time contributions: `3`

New Templates Added: `142` | CVEs Added: `10` | First-time contributions: `6`