PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2020-13650] DigDash Enterprise: Versions 2018R2-2020R1

bishopfox.com | vulnerability | CVE-2020-13650 | #xss | #vulnerability | #advisory | #ssrf | #content-injection | #digdash
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Bishop Fox advisory on three DigDash Enterprise flaws (2018R2–2020R1): a pre-auth SSRF disclosing service credentials plus content injection and XSS bugs; patches released.
CVE
CVE-2020-13650
Published
Collected

Related coverage

vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
vulnerability · slcyber.io
Advisory: VMWare Workspace One Access (CVE-2021-22056)
A post-auth SSRF in VMware Workspace One Access allows stealing administrative JWTs leading to remote code execution.
vulnerability · slcyber.io
Advisory: Websphere Portal SSRFs & Post Auth RCE - CVE-2021-27748
Websphere Portal 9 is vulnerable to multiple unauthenticated SSRFs and a post-auth RCE via directory traversal in Zip file upload.
vulnerability · slcyber.io
Advisory: Jamf Pro SSRF - CVE-2021-39303 & CVE-2021-40809
Jamf Pro before version 10.32 is vulnerable to a post-auth SSRF allowing attackers to read arbitrary URLs including cloud metadata endpoints.
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
Back