CVE-2024-50550: Privilege Escalation in LiteSpeed Cache WP Plugin, 8.1 rating 🔥
Weak security hash verification vulnerability allows an attacker to gain administrative privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/A60iV
👉 Dork: http.body:"plugins/litespeed-cache"
Read more: https://patchstack.com/articles/rare-case-of-privilege-escalation-patched-in-litespeed-cache-plugin/
Weak security hash verification vulnerability allows an attacker to gain administrative privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/A60iV
👉 Dork: http.body:"plugins/litespeed-cache"
Read more: https://patchstack.com/articles/rare-case-of-privilege-escalation-patched-in-litespeed-cache-plugin/
👾5👍3🔥3
CVE-2024-49768: Race Condition in Waitress Python server, 9.1 rating 🔥
Due to an error, the server can process a request even if the connection should have been closed.
Search at Netlas.io:
👉 Link: https://nt.ls/VYS9t
👉 Dork: http.headers.server:"waitress"
Vendor's advisory: https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj
Due to an error, the server can process a request even if the connection should have been closed.
Search at Netlas.io:
👉 Link: https://nt.ls/VYS9t
👉 Dork: http.headers.server:"waitress"
Vendor's advisory: https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj
👾4🔥3👍2
CVE-2024-46538: XSS in pfSense, 9.3 rating 🔥
XSS injection allows an attacker to perform arbitrary code execution in the user's browser. The vulnerability is not the freshest, but now it has a PoC!
Search at Netlas.io:
👉 Link: https://nt.ls/BuwaN
👉 Dork: http.noscript:"pfSense - Login"
Vendor's advisory: https://redmine.pfsense.org/issues/15778
XSS injection allows an attacker to perform arbitrary code execution in the user's browser. The vulnerability is not the freshest, but now it has a PoC!
Search at Netlas.io:
👉 Link: https://nt.ls/BuwaN
👉 Dork: http.noscript:"pfSense - Login"
Vendor's advisory: https://redmine.pfsense.org/issues/15778
🔥4👍3👾3
🚧 Planned Maintenance 🚧
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on November 6, 2024, at 08:00 UTC ⏰. It is expected to take about an hour, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on November 6, 2024, at 08:00 UTC ⏰. It is expected to take about an hour, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
👎2👾2😴1
Reminder: The maintenance begins in one hour. Netlas will be temporarily offline. We apologize for any inconvenience caused.
👌3
Smart Recon to PWN the Panel with Netlas.io 🔥
There's nothing we enjoy more than seeing Netlas in action, uncovering real vulnerabilities. This time, we're excited to share a write-up from Rood Space!
👉 Read it now: https://ro0od.medium.com/smart-recon-to-pwn-the-panel-a23b0b9466bb
👉 Check author's TG: @alien_rood
There's nothing we enjoy more than seeing Netlas in action, uncovering real vulnerabilities. This time, we're excited to share a write-up from Rood Space!
👉 Read it now: https://ro0od.medium.com/smart-recon-to-pwn-the-panel-a23b0b9466bb
👉 Check author's TG: @alien_rood
Medium
Smart recon to PWN the panel
بسم الله الرحمن الرحيم
👾4❤3🔥3
🚧 Planned Maintenance 🚧
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on November 10, 2024, at 08:00 UTC ⏰. It is expected to take about an hour, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on November 10, 2024, at 08:00 UTC ⏰. It is expected to take about an hour, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
👍1
CVE-2024-42509: RCE in Aruba, 9.8 rating 🔥
The vulnerability allows an attacker to perform RCE by sending specially crafted packets.
Search at Netlas.io:
👉 Link: https://nt.ls/Q71sc
👉 Dork: http.favicon.hash_sha256:dfa04944308ed6c96563ff88cdb767ed5177c76c8a386f7a5803b534e9bff753
Vendor's advisory: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US
The vulnerability allows an attacker to perform RCE by sending specially crafted packets.
Search at Netlas.io:
👉 Link: https://nt.ls/Q71sc
👉 Dork: http.favicon.hash_sha256:dfa04944308ed6c96563ff88cdb767ed5177c76c8a386f7a5803b534e9bff753
Vendor's advisory: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US
🔥5🤯3👍1👾1
PAN-SA-2024-0015: RCE in Palo Alto PAN-OS 🔥
In a recent advisory from Palo Alto, developers warn about the emergence of an RCE vulnerability. Administrators of potentially vulnerable devices are advised to take action as quickly as possible to minimize the damage.
Search at Netlas.io:
👉 Link: https://nt.ls/UdzF8
👉 Dork: http.body_sha256:"7bc15a9ba71464596444ad648fa144937b848b302459c4103deae105cf42ce42" OR http.favicon.hash_sha256:a03ff6778b0535b9c4388e88c674eeeac91c0cc4b25bd23bf30f8d0bd98ac854
Vendor's advisory: https://security.paloaltonetworks.com/PAN-SA-2024-0015
In a recent advisory from Palo Alto, developers warn about the emergence of an RCE vulnerability. Administrators of potentially vulnerable devices are advised to take action as quickly as possible to minimize the damage.
Search at Netlas.io:
👉 Link: https://nt.ls/UdzF8
👉 Dork: http.body_sha256:"7bc15a9ba71464596444ad648fa144937b848b302459c4103deae105cf42ce42" OR http.favicon.hash_sha256:a03ff6778b0535b9c4388e88c674eeeac91c0cc4b25bd23bf30f8d0bd98ac854
Vendor's advisory: https://security.paloaltonetworks.com/PAN-SA-2024-0015
2👾5🔥3
CVE-2024-45763 and other: Multiple vulnerabilities in Dell Sonic OS, 9.0 - 9.1 rating 🔥
Some Sonic OS entities are vulnerable to OS Command Injection. Additionally, the vulnerabilities include a weakness in the authentication process that could allow a remote attacker to gain unauthorized access.
Search at Netlas.io:
👉 Link: https://nt.ls/TAX1W
👉 Dork: http.favicon.hash_sha256:d39342cbe7b9717529eb07f697779c55cdae7e0fc26c9672f64c49cbd8411eea
Vendor's advisory: https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities
Some Sonic OS entities are vulnerable to OS Command Injection. Additionally, the vulnerabilities include a weakness in the authentication process that could allow a remote attacker to gain unauthorized access.
Search at Netlas.io:
👉 Link: https://nt.ls/TAX1W
👉 Dork: http.favicon.hash_sha256:d39342cbe7b9717529eb07f697779c55cdae7e0fc26c9672f64c49cbd8411eea
Vendor's advisory: https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities
🔥3👾3👍2
CVE-2024-39710 and other: Multiple vulnerabilities in Ivanti Connect Secure, 4.4 - 9.1 rating 🔥
Lots (25!) of vulnerabilities in the latest Ivanti bulletin. DoS, RCE, Auth Bypass - vulnerabilities on every taste.
Search at Netlas.io:
👉 Link: https://nt.ls/v0fEW
👉 Dork: http.body:"welcome.cgi?p=logo"
Vendor's advisory: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US
Lots (25!) of vulnerabilities in the latest Ivanti bulletin. DoS, RCE, Auth Bypass - vulnerabilities on every taste.
Search at Netlas.io:
👉 Link: https://nt.ls/v0fEW
👉 Dork: http.body:"welcome.cgi?p=logo"
Vendor's advisory: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US
🔥2👾2👍1
CVE-2024-52301: Improper Input Validation in Laravel Framework, 8.7 rating❗️
The vulnerability allows an attacker to change environment using a special crafted query string.
More then 830k instances at Netlas.io:
👉 Link: https://nt.ls/CDJgv
👉 Dork: http.headers.set_cookie:"laravel_session="
Vendor's advisory: https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h
The vulnerability allows an attacker to change environment using a special crafted query string.
More then 830k instances at Netlas.io:
👉 Link: https://nt.ls/CDJgv
👉 Dork: http.headers.set_cookie:"laravel_session="
Vendor's advisory: https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h
🔥3👍2👾1
Automated search for sites by favicon 🔍
When mapping an attack surface or searching for vulnerable web interfaces, favicon matching often plays a critical role. Some IoT search engines, such as Shodan or Netlas, already offer this functionality.
However, today we want to introduce a tool that simplifies this process, developed by a member of the Netlas community. This utility supports searching for favicons across several search engines, including Shodan, Netlas, ZoomEye, and more.
Introducing FAVICORN – a collaborative creation by @soxoj, @seelwersowl, and @osint_mindset 🦄
👉 FAVICORN's GitHub: https://github.com/sharsil/favicorn
When mapping an attack surface or searching for vulnerable web interfaces, favicon matching often plays a critical role. Some IoT search engines, such as Shodan or Netlas, already offer this functionality.
However, today we want to introduce a tool that simplifies this process, developed by a member of the Netlas community. This utility supports searching for favicons across several search engines, including Shodan, Netlas, ZoomEye, and more.
Introducing FAVICORN – a collaborative creation by @soxoj, @seelwersowl, and @osint_mindset 🦄
👉 FAVICORN's GitHub: https://github.com/sharsil/favicorn
GitHub
GitHub - sharsil/favicorn: All-sources tool to search websites by favicons
All-sources tool to search websites by favicons. Contribute to sharsil/favicorn development by creating an account on GitHub.
1👾4👍2👏2
CVE-2024-52316, -52317, -52318: Multiple vulnerabilities in Apache Tomcat, 6.1 - 9.8 rating 🔥
Three new vulnerabilities, including Auth Bypass, XSS injection, and Inadequate Encryption Strength, could pose a threat to thousands of web services.
Search at Netlas.io:
👉 Link: https://nt.ls/dbwDi
👉 Dork: http.noscript:"Apache Tomcat"
Vendor's advisory: https://lists.apache.org/thread/dokwlz7k57sgphfj3ko36vn8xrys3o6r
Three new vulnerabilities, including Auth Bypass, XSS injection, and Inadequate Encryption Strength, could pose a threat to thousands of web services.
Search at Netlas.io:
👉 Link: https://nt.ls/dbwDi
👉 Dork: http.noscript:"Apache Tomcat"
Vendor's advisory: https://lists.apache.org/thread/dokwlz7k57sgphfj3ko36vn8xrys3o6r
🔥4👾2
Minor App Improvements
In update 1.0.3, we've introduced several features to enhance the payment experience.
Here’s what’s new:
📔 Added a Payment Guide
📌 Clarified subnoscription options for the Freelancer tier
🖥 A few other minor improvements
👉 Read more: https://docs.netlas.io/changelog/
In update 1.0.3, we've introduced several features to enhance the payment experience.
Here’s what’s new:
📔 Added a Payment Guide
📌 Clarified subnoscription options for the Freelancer tier
🖥 A few other minor improvements
👉 Read more: https://docs.netlas.io/changelog/
docs.netlas.io
Changelog - Netlas Docs
Explore the latest updates, enhancements, and fixes on the Netlas platform. Stay informed with our Changelog for all product and feature developments.
👾3👍1
PAN-OS RCE PoC by Chirag Artani 🔥
Our friend’s channel posted another interesting video about one of the latest vulnerabilities, where he demonstrated Proof of Concept using Netlas 🔍
We also recommend checking out his website and Twitter for more tips:
👉 Site: 3rag.com
👉 Twitter: x.com/Chirag99Artani
Our friend’s channel posted another interesting video about one of the latest vulnerabilities, where he demonstrated Proof of Concept using Netlas 🔍
We also recommend checking out his website and Twitter for more tips:
👉 Site: 3rag.com
👉 Twitter: x.com/Chirag99Artani
YouTube
PAN-OS RCE Again - Authentication Bypass in the Management Web Interface & Command Injection | POC
POC written by me - https://github.com/Sachinart/CVE-2024-0012-POC
Please do not exploit any target without written permission, that's not ethical way.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with…
Please do not exploit any target without written permission, that's not ethical way.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with…
1👾6👏2
Netlas and Shodan: Comprehensive Analysis 🧮
With Netlas recently emerging from beta and reaching version 1.0, we felt it was the perfect time to conduct a comprehensive comparison with its competitors.
We’ve started with one of the toughest challenges: an in-depth, objective comparison of Netlas and the veteran in the field, Shodan. Using over 10 key indicators, we’ve analyzed both platforms to help you understand pros and cons of the two solutions.
👉 Read now: https://netlas.io/blog/netlas_vs_shodan/
With Netlas recently emerging from beta and reaching version 1.0, we felt it was the perfect time to conduct a comprehensive comparison with its competitors.
We’ve started with one of the toughest challenges: an in-depth, objective comparison of Netlas and the veteran in the field, Shodan. Using over 10 key indicators, we’ve analyzed both platforms to help you understand pros and cons of the two solutions.
👉 Read now: https://netlas.io/blog/netlas_vs_shodan/
netlas.io
Netlas vs Shodan: Platforms Comparison - Netlas Blog
Compare IoT search engines Netlas and Shodan, highlighting their features, strengths, and ideal use cases for security research.
1🔥6👾2
CVE-2024-48990 and other: Multiple vulnerabilities in Needrestart utility for Ubuntu (including Ubuntu Server), 5.3 - 7.8 rating❗️
Five vulnerabilities discovered by researchers from Qualys allow LPE to be carried out on machines running Ubuntu OS and gain root rights.
Search at Netlas.io:
👉 Link: https://nt.ls/ZhaO6
👉 Dork: http.headers.server:"Ubuntu"
Read more: https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
Five vulnerabilities discovered by researchers from Qualys allow LPE to be carried out on machines running Ubuntu OS and gain root rights.
Search at Netlas.io:
👉 Link: https://nt.ls/ZhaO6
👉 Dork: http.headers.server:"Ubuntu"
Read more: https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
👾4🔥3👍2
🚧 Planned Maintenance 🚧
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on November 24, 2024, at 08:00 UTC ⏰. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on November 24, 2024, at 08:00 UTC ⏰. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
👾4🌚1🗿1
Blind Spot in the Fortinet VPNs, no CVE❗️
Researchers from Pentera have discovered a potential vulnerability in Fortinet VPNs, probably allowing an attacker to hide the fact that a brute force attack was successfully completed.
Search at Netlas.io:
👉 Link: https://nt.ls/zJEUh
👉 Dork: http.body_sha256:"6e24d74ebc881e1e97331bb72d6edee8431485a8a0cafd7c4a913a3819817b84"
Read more: https://pentera.io/blog/FortiClient-VPN_logging-blind-spot-revealed/
Researchers from Pentera have discovered a potential vulnerability in Fortinet VPNs, probably allowing an attacker to hide the fact that a brute force attack was successfully completed.
Search at Netlas.io:
👉 Link: https://nt.ls/zJEUh
👉 Dork: http.body_sha256:"6e24d74ebc881e1e97331bb72d6edee8431485a8a0cafd7c4a913a3819817b84"
Read more: https://pentera.io/blog/FortiClient-VPN_logging-blind-spot-revealed/
🔥4👾3