Recently found a SAML vulnerability, any website that allows users to configure SAML also takes a x509 certificate as input there will be an implicit trust between IDP and SP. (You can easily perform an account takeover via using your own x509 cert, Signed saml response with the victim's email)

Also SAML can be used for session hijacking/login csrf

- User is entering his credit card details while attacker's site is open
- Attacker swaps the session using SAML session hijacking and now card details will be saved in attacker's account

CVE-2024-37288, -37285: RCE in Kibana, 9.9 rating 🔥🔥🔥

By improperly deserializing YAML, attackers can perform RCE. The attack is quite complex, but Elastic still recommends updating.

Search at Netlas.io:
👉 Link: https://nt.ls/cVF9O
👉 Dork: http.favicon.hash_sha256:30db4185530d8617e9f08858787a24b219ac5102321b48515baf5da7ac43b590

Read more: https://securityonline.info/critical-kibana-flaws-cve-2024-37288-cve-2024-37285-expose-systems-to-arbitrary-code-execution/

CVE-2024-29847 and other: Multiple vulns in Ivanti EPM, 4.3 - 10.0 rating 🔥🔥🔥

Numerous vulnerabilities in Ivanti. Includes, but is not limited to, RCE with the highest severity score!

Search at Netlas.io:
👉 Link: https://nt.ls/pHqay
👉 Dork: http.headers.set_cookie:("JSESSIONID" "Path" "/mifs")

Vendor's advisory: https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022?language=en_US

Add the file configurations.xml to your wordlist.
Credit- @NoRed0x

#bugbountytips #bugbountytip

Add to your wordlist:

auth/jwt/register
auth-demo/register/classic
auth-demo/register/modern

Reminder: The update begins in one hour. Netlas will be temporarily offline. We apologize for any inconvenience caused.