PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Zamzar API Advisory

bishopfox.com | vulnerability | #api-security | #vulnerability | #advisory | #ssrf | #lfi | #file-conversion
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Bishop Fox advisory on an SSRF flaw in the Zamzar file-conversion API: malicious XML in an ODT file let attackers read remote and local objects, achieving file inclusion as root.
Published
Collected

Related coverage

vulnerability · slcyber.io
Advisory: VMWare Workspace One Access (CVE-2021-22056)
A post-auth SSRF in VMware Workspace One Access allows stealing administrative JWTs leading to remote code execution.
vulnerability · slcyber.io
Advisory: Websphere Portal SSRFs & Post Auth RCE - CVE-2021-27748
Websphere Portal 9 is vulnerable to multiple unauthenticated SSRFs and a post-auth RCE via directory traversal in Zip file upload.
vulnerability · slcyber.io
Advisory: Jamf Pro SSRF - CVE-2021-39303 & CVE-2021-40809
Jamf Pro before version 10.32 is vulnerable to a post-auth SSRF allowing attackers to read arbitrary URLs including cloud metadata endpoints.
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
research · slcyber.io
Advisory: Next.js SSRF (CVE-2024-34351)
# Advisory: Next.js SSRF (CVE-2024-34351) Get research alerts Share on social ) May 9, 2024 1 min read ### Table of Contents TOC Element Summary Impact Affected Software Product Description...
research · slcyber.io
Advisory: Flarum LFI - CVE-2023-40033
# Advisory: Flarum LFI - CVE-2023-40033 Get research alerts Share on social August 28, 2023 1 min read ### Table of Contents TOC Element Summary Impact Affected Software Product Description...
Back