Include SubDomains
As seen in:
The Code Project,
cnblogs.com,
Packetst Storm,
Blogarama,
sec-consult.com,
unSafe.,
unsafe.sh
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Include SubDomains
The File That Answered Back — XXE Hidden in Cell A2
The File That Answered Back — XXE Hidden in Cell A2 Press enter or click to view image in full sizeMost people know XXE. Few think to look for it inside 2026-7-6 06:28:59 Author: infosecwriteups.com(查看原文) 阅读量:2 收藏 Press enter or click to view image in full size Most people know XXE. Few think to look for it inside a spreadsheet upload. But beneath every .xlsx is really a ZIP archive full of XML, and the parser reading it doesn’t always know where to stop.
Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)
Full Disclosure mailing list archives From: Yuffie Kisaragi via Fulldisclosure <fulldisclosure () seclists org> Date: Thu, 04 Dec 2025 16:27:53 +0000 Advisory ID: CONVERCENT-2025-001 Title: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group) Date: 2025-12-04 Vendor: EQS Group Product: Convercent Whistleblowing Platform (app.convercent.com) Severity: Critical CVSS v4.0 Base Score: 9.3 Vector:...
🔒 Kubernetes Ingress Playlist – Part 5: Secure Your App with HTTPS using Self-Signed TLS Certificates
🔧 Kubernetes Ingress Playlist – Part 5: Secure Your App with HTTPS using Self-Signed TLS Certificates 🕛 Zeit seit Veröffentlichung: 38 Minuten 📆 Veröffentlicht am: 06.08.2025 um 11:56 Uhr Nachrichtenbereich: 🔧 Programmierung 🔗 Quelle: dev.to So far in our Kubernetes Ingress playlist, we've covered what Ingress is, how to install NGINX Ingress Controller, configure routing, and enable basic authentication.
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
Management Summary ONLYOFFICE Docs (DocumentServer) was affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which were reflected in the server's HTML response.
Ping Identity PingIDM 7.5.0 Query Filter Injection
SEC Consult Vulnerability Lab Security Advisory < 20241030-0 > ======================================================================= title: Query Filter Injection product: Ping Identity PingIDM (formerly known as ForgeRock Identity Management) vulnerable version: v7.0.0 - v7.5.0 (and older unsupported versions) fixed version: various patches; v8.0 CVE number: CVE-2024-23600 impact: medium homepage: https://backstage.forgerock.com/docs/idm found: 2024-04-10 by: Ksandros Apostoli Miguel...
SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600)
SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600) From: SEC Consult Vulnerability Lab via Fulldisclosure <fulldisclosure () seclists org> Date: Wed, 30 Oct 2024 09:57:55 +0000 SEC Consult Vulnerability Lab Security Advisory < 20241030-0 > ======================================================================= title: Query Filter Injection product: Ping Identity PingIDM (formerly known as ForgeRock...
IBM Security Verify Access 10.0.8 Open Redirection
- IBM Security Verify Access >= 10.0.0 <= 10.0.8 - Open Redirect during OAuth Flow ======== < Table of Contents > ================================================ 0. Overview 1. Detailed Description 2. Proof Of Concept 3. Solution 4. Disclosure Timeline 5. References 6. Credits 7. Legal Notices ======== < 0.
How to upgrade online collector with first verification steps
This article describes how to upgrade the collector with the verification step and is a complement to the Upgrade guide that remains the reference. Make sure to follow the Upgrade Guide first and the steps specific to the version. The next steps will help to upgrade the collector with a few additional checks. Scope Solution Requirements: Super and collector require access to update.fortiguard.net on port 443.
Check Point - Wrong Check Point (CVE-2024-24919)
Gather round, gather round - it’s time for another blogpost tearing open an SSLVPN appliance and laying bare a recent in-the-wild exploited bug. This time, it is Check Point who is the focus of our penetrative gaze. Check Point, for those unaware, is the vendor responsible for the 'CloudGuard Network Security' appliance, yet another device claiming to be secure and hardened. Their slogan - "you deserve the best security" - implies they are a company you can trust with the security of your network.
配置Ingress支持HTTPS访问(二)：使用cert-manager申请证书 - 人生的哲理 - 博客园
服务器版本 docker软件版本 Kubernetes(k8s)集群版本 kube-bench版本 CPU架构 Ubuntu 18.04.5 LTS Docker version 20.10.14 v1.22.2 0.6.7 x86_64 Kubernetes集群架构：k8scludes1作为master节点，k8scludes2，k8scludes3作为worker节点。 服务器 操作系统版本 CPU架构 进程 功能描述 k8scludes1/192.168.110.128 Ubuntu 18.04.5 LTS x86_64 docker，kube-apiserver，etcd，kube-scheduler，kube-controller-manager，kubelet，kube-proxy，coredns，calico k8s master节点 k8scludes2/192.168.110.129 Ubuntu 18.04.5 LTS x86_64 docker，kubelet，kube-proxy，calico k8s worker节点...
Kubernetes集群中配置Ingress支持HTTPS访问(一)：cfssl - 人生的哲理 - 博客园
本文主要基于Kubernetes1.22.2和Linux操作系统Ubuntu 18.04。 服务器版本 docker软件版本 Kubernetes(k8s)集群版本 kube-bench版本 CPU架构 Ubuntu 18.04.5 LTS Docker version 20.10.14 v1.22.2 0.6.7 x86_64 Kubernetes集群架构：k8scludes1作为master节点，k8scludes2，k8scludes3作为worker节点。 服务器 操作系统版本 CPU架构 进程 功能描述 k8scludes1/192.168.110.128 Ubuntu 18.04.5 LTS x86_64 docker，kube-apiserver，etcd，kube-scheduler，kube-controller-manager，kubelet，kube-proxy，coredns，calico k8s master节点 k8scludes2/192.168.110.129 Ubuntu 18.04.5 LTS x86_64...
Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management)
Solution The vendor provides patches for the affected versions which can be downloaded from their download site.
Zero Touch Pwn: Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk Phones
In this blog post, we describe several vulnerabilities that were discovered during a security analysis of AudioCodes desk phones and Zoom’s Zero Touch Provisioning. We also discuss and demonstrate the potential attack scenarios that could arise from these vulnerabilities.
Tiva Events Calender 1.4 Cross Site Scripting
Edit Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023070039 Below is a copy: Tiva Events Calender 1.4 Cross Site Scripting Document Title: =============== Tiva Events Calender v1.4 - Cross Site Scripting Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2276 Release Date: ============= 2023-07-05 Vulnerability Laboratory ID (VL-ID): ==================================== 2276 Common Vulnerability Scoring System:...
Tiva Events Calender v1.4 - Cross Site Scripting Vulnerability
Full Disclosure mailing list archives From: "info () vulnerability-lab com" <info () vulnerability-lab com> Date: Wed, 19 Jul 2023 09:10:24 +0200 Document Title: =============== Tiva Events Calender v1.4 - Cross Site Scripting Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2276 Release Date: ============= 2023-07-05 Vulnerability Laboratory ID (VL-ID): ==================================== 2276 Common Vulnerability Scoring System:...
Tiva Events Calender 1.4 Cross Site Scripting
Document Title: =============== Tiva Events Calender v1.4 - Cross Site Scripting Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2276 Release Date: ============= 2023-07-05 Vulnerability Laboratory ID (VL-ID): ==================================== 2276 Common Vulnerability Scoring System: ==================================== 5 Vulnerability Class: ==================== Cross Site Scripting - Persistent Current Estimated Price:...
Announcing Hurl 4.0.0
The Hurl team is happy to announce Hurl 4.0.0 ! Hurl is a command line tool powered by curl, that runs HTTP requests defined in a simple plain text format: GET https://example.org/api/tests/4567 HTTP 200 header "x-foo" contains "bar" certificate "Expire-Date" daysAfterNow > 15 jsonpath "$.status" == "RUNNING" jsonpath "$.tests" count == 25 jsonpath "$.id" matches /\d{4}/ What’s new in this release: Detailed Error for CI/CD JSONPath Change Custom HTTP Methods We’ve improved Hurl HTML report.
Protecting Data Transfer in Documentum REST Services
Overview Web security is a field that includes many threat models and counter-attack techniques. Since from Documentum REST Services release 7.3, we have provided users with a number of web security related configuration parameters that help to protect the transfer data in the REST API. In this article, we will talk about what they are, and how to configure them.
Reverse engineering the Facebook Messenger API
I recently had occasion to reverse engineer the Facebook Messenger API for personal use, and realized the case study would make a great tutorial. This blog post lays out how I deciphered the API, and explains the reverse engineering techniques I used, so that you can go forth and do the same. The required background knowledge is fairly minimal.
Arris DG3450 AR01.02.056.18_041520_711.NCS.10 XSS / Missing Authentication
Edit Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023030019 Below is a copy: Arris DG3450 AR01.02.056.18_041520_711.NCS.10 XSS / Missing Authentication SEC Consult Vulnerability Lab Security Advisory < 20230306-0 > ======================================================================= title: Multiple Vulnerabilities product: Arris DG3450 Cable Gateway vulnerable version: AR01.02.056.18_041520_711.NCS.10 fixed version: - CVE number: CVE-2023-27571, CVE-2023-27572...
Arris DG3450 AR01.02.056.18_041520_711.NCS.10 XSS / Missing Authentication
SEC Consult Vulnerability Lab Security Advisory < 20230306-0 > ======================================================================= title: Multiple Vulnerabilities product: Arris DG3450 Cable Gateway vulnerable version: AR01.02.056.18_041520_711.NCS.10 fixed version: - CVE number: CVE-2023-27571, CVE-2023-27572 impact: medium homepage: https://www.commscope.com found: 2022-10-21 by: S.
SEC Consult SA-20230306-0 :: Multiple Vulnerabilities in Arris DG3450 Cable Gateway
Full Disclosure mailing list archives From: "SEC Consult Vulnerability Lab, Research via Fulldisclosure" <fulldisclosure () seclists org> Date: Mon, 6 Mar 2023 10:58:09 +0000 SEC Consult Vulnerability Lab Security Advisory < 20230306-0 > ======================================================================= title: Multiple Vulnerabilities product: Arris DG3450 Cable Gateway vulnerable version: AR01.02.056.18_041520_711.NCS.10 fixed version: - CVE number: CVE-2023-27571, CVE-2023-27572...
Multiple Vulnerabilities in Arris DG3450 Cable Gateway
Vendor description Arris has been acquired by CommScope in 2019. "At CommScope we push the boundaries of communications technology to create the world’s most advanced networks. We design, manufacture, install and support the hardware infrastructure and software intelligence that enable our digital society to interact and thrive. Working with customers, we advance broadband, enterprise and wireless networks to power progress and create lasting connections.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Include
Contact Include, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack