albinolobster

6 ms·

1. 1.▲
   Joomla CVE-2023-23752 to Code Execution(vulncheck.com)

   1 points by albinolobster 4y ago|0 comments
2. 2.▲
   A Memory Resident Payload for CVE-2022-47966(vulncheck.com)

   9 points by albinolobster 4y ago|0 comments
3. 3.▲
   Moobot Uses a Fake Vulnerability(vulncheck.com)

   1 points by albinolobster 4y ago|0 comments
4. 4.▲
   Xiongmai IoT Exploitation(vulncheck.com)

   2 points by albinolobster 4y ago|0 comments
5. 5.▲
   CVE-2021-38406 or CISA KEV Catalog Lacks Accountability(attackerkb.com)

   2 points by albinolobster 4y ago|0 comments
6. 6.▲
   Dropping Files on a Domain Controller Using CVE-2021-43893(rapid7.com)

   2 points by albinolobster 5y ago|0 comments
7. 7.▲
   Cisco ASDM: Manage at Your Own Risk(attackerkb.com)

   1 points by albinolobster 5y ago|0 comments
8. 8.▲
   Writing an Exploit for CVE-2021-20038 (SonicWall SSL VPN)(attackerkb.com)

   1 points by albinolobster 5y ago|0 comments
9. 9.▲
   Driver-Based Attacks: Past and Present(rapid7.com)

   1 points by albinolobster 5y ago|0 comments
10. 10.▲
    by albinolobster 5y ago

    Not only that, but it still works in exactly this way. I would have thought they would have fixed this "feature." But an unauthenticated user can still provide GitLab with tiff/jpeg images and have them reach ExifTool.
11. 11.▲
    by albinolobster 5y ago

    Full disclosure, I wrote both of these. The following describes the entire unauthenticated attack: https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapi... And, if you like that sort of thing, there is