Skip to content

Releases: projectdiscovery/nuclei-templates

GCP Cloud Configuration Templates - Nuclei Templates v10.2.0 🎉

27 Apr 17:31
@princechaddha princechaddha
v10.2.0
b01a0db
Compare
Choose a tag to compare
GCP Cloud Configuration Templates - Nuclei Templates v10.2.0 🎉

🔥 Release Highlights 🔥

We’re excited to announce the expansion of the Nuclei Templates with new templates specifically for Google Cloud Platform (GCP) Configurations. This release introduces a series of specialized security checks tailored for a wide range of GCP services, including Compute Engine, GKE clusters, Cloud Storage buckets, BigQuery datasets, and more. These new templates are crafted to pinpoint common misconfigurations, ensure compliance with regulatory standards, and maintain adherence to industry best practices, leveraging advanced features such as flow and code analysis.

The introduction of these GCP-specific templates empowers security teams to conduct thorough security audits of their GCP environments, uncovering critical misconfigurations and vulnerabilities. Moreover, these checks can be tailored to meet the unique operational demands of different teams, aiding in the prompt detection and remediation of security issues.

We encourage contributors and reviewers to provide their valuable feedback and suggestions to help enhance and evolve these GCP security templates further. For more details, please visit our latest blog post.

Other Highlights

What's Changed

New Templates Added: 268 | CVEs Added: 11 | First-time contributions: 4

  • [CVE-2025-34028] Commvault - SSRF via /commandcenter/deployWebpackage.do (@dhiyaneshdk, @abhishekrautela) [critical] 🔥
  • [CVE-2025-32433] Erlang/OTP SSH - Remote Code Execution (@iamnoooob, @rootxharsh, @pdresearch, @darses) [critical] 🔥
  • [CVE-2025-31324] SAP NetWeaver Visual Composer Metadata Uploader - Deserialization (@iamnoooob, @rootxharsh, @parthmalhotra, @pdresearch) [critical] 🔥
  • [CVE-2025-30406] Gladinet CentreStack < 16.4.10315.56368 - Unauth RCE (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
  • [CVE-2025-29306] FoxCMS v.1.2.5 - Remote Code Execution (@ritikchaddha) [critical] 🔥
  • [CVE-2025-28367] mojoPortal <=2.9.0.1 - Directory Traversal (@dhiyaneshdk) [medium]
  • [CVE-2025-27892] Shopware < 6.5.8.13 - SQL Injection (@iamnoooob, @rootxharsh, @pdresearch) [critical]
  • [CVE-2024-32870] iTop Hub Connector - Information Disclosure (@dhiyaneshdk) [medium]
  • [CVE-2024-6235] NetScaler Console - Sensitive Information Disclosure (@dhiyaneshdk) [critical] 🔥
  • [CVE-2022-35507] Proxmox - CRLF Injection (@dhiyaneshdk) [high]
  • [CVE-2022-28508] MantisBT < 2.25.2 - Cross-Site Scripting (@ritikchaddha) [medium]
  • [gcloud-api-key-restrictions-missing] Missing API Key API Restrictions (@princechaddha) [medium]
  • [gcloud-api-key-unrestricted] Unrestricted API Key Usage (@princechaddha) [medium]
  • [gcloud-api-keys-inactive-services] API Keys Should Only Exist for Active Services (@princechaddha) [low]
  • [gcloud-critical-service-apis-disabled] Critical Service APIs Not Enabled (@princechaddha) [critical]
  • [gcloud-security-center-api-disabled] Security Command Center API Disabled (@princechaddha) [high]
  • [gcloud-cloud-asset-disabled] Cloud Asset Inventory Not Enabled (@princechaddha) [high]
  • [gcloud-artifact-registry-public] Publicly Accessible Artifact Registry Repositories (@princechaddha) [high]
  • [gcloud-vuln-scan-missing] Artifact Registry Vulnerability Scanning Not Enabled (@princechaddha) [high]
  • [gcloud-bigquery-cmek-not-enabled] BigQuery Dataset Encryption with Customer-Managed Encryption Keys Not Enabled (@princechaddha) [high]
  • [gcloud-bigquery-cmk-not-enabled] BigQuery Datasets Not Encrypted with Customer-Managed Keys (@princechaddha) [high]
  • [gcloud-bigquery-public-datasets] Publicly Accessible BigQuery Datasets (@princechaddha) [high]
  • [gcloud-backend-bucket-missing-storage] Backend Buckets Referencing Missing Storage Buckets (@princechaddha) [high]
  • [gcloud-cdn-backend-bucket] Check Cloud CDN Backend Bucket Configuration (@princechaddha) [medium]
  • [gcloud-cdn-origin-auth-unconfigured] Unconfigured Cloud CDN Origin Authentication (@princechaddha) [medium]
  • [gcloud-cdn-ssl-enforcement] Cloud CDN SSL/TLS Not Enforced (@princechaddha) [medium]
  • [gcloud-cdn-tls-unenforced] Unenforced SSL/TLS on Cloud CDN Backend Service Origins (@princechaddha) [medium]
  • [gcloud-certificate-validity-exceeded] Exceeded SSL Certificate Validity Period (@princechaddha) [medium]
  • [gcloud-disk-image-public-access] Disk Images Publicly Shared (@princechaddha) [medium]
  • [gcloud-instance-group-autohealing-disabled] Instance Group Autohealing Not Enabled (@princechaddha) [high]
  • [gcloud-mig-no-load-balancer] Managed Instance Group Not Using Load Balancer (@princechaddha) [low]
  • [gcloud-mig-single-zone] Managed Instance Group Not Configured for Multiple Zones (@princechaddha) [low]
  • [gcloud-oslogin-disabled] OS Login Not Enabled for GCP Projects (@princechaddha) [low]
  • [gcloud-persistent-disks-suspended-vms] Persistent Disks Attached to Suspended Virtual Machines (@princechaddha) [high]
  • [gcloud-vm-automatic-restart-disabled] VM Instance Automatic Restart Not Enabled (@princechaddha) [medium]
  • [gcloud-vm-confidential-computing-disabled] VM Instance Confidential Computing Not Enabled (@princechaddha) [medium]
  • [gcloud-vm-default-service-account-full-access] VM Instance Using Default Service Account with Full API Access (@princechaddha) [medium]
  • [gcloud-vm-default-service-account] VM Instance Using Default Service Account (@princechaddha) [medium]
  • [gcloud-vm-deletion-protection-disabled] VM Instance Deletion Protection Not Enabled (@princechaddha) [medium]
  • [gcloud-vm-disk-autodelete-enabled] Auto-Delete Not Disabled for VM Instance Persistent Disks (@princechaddha) [medium]
  • [gcloud-vm-disk-cmk-not-enabled] Virtual Machine Disk Encryption with Customer-Managed Keys Not Enabled (@princechaddha) [high]
  • [gcloud-vm-disk-csek-disabled] VM Disk Encryption with Customer-Supplied Keys Disabled (@princechaddha) [high]
  • [gcloud-vm-disk-csek-not-enabled] Virtual Machine Disk Encryption with Customer-Supplied Keys Not Enabled (@princechaddha) [high]
  • [gcloud-vm-ip-forwarding-enabled] IP Forwarding Not Disabled for VM Instances (@princechaddha) [medium]
  • [gcloud-vm-maintenance-terminate] VM Instance Maintenance Policy Set to Terminate (@princechaddha) [high]
  • [gcloud-vm-oslogin-2fa-disabled] OS Login with 2FA Authentication Not Enabled for VM Instances (@princechaddha) [high]
  • [gcloud-vm-preemptible-enabled] VM Instance Preemptibility Not Disabled (@princechaddha) [high]
  • [gcloud-vm-project-ssh-keys-enabled] Block Project-Wide SSH Keys Not Enabled (@princechaddha) [medium]
  • [gcloud-vm-public-ip-enabled] VM Instance Using Public IP Address (@princechaddha) [high]
  • [gcloud-vm-serial-console-enabled] Interactive Serial Console Support Not Disabled (@princechaddha) [medium]
  • [gcloud-vm-shielded-disabled] Shielded VM Security Features Not Enabled (@princechaddha) [medium]
  • [gcloud-dataproc-no-cmk] Dataproc Cluster Not Using Customer-Managed Keys (@princechaddha) [high]
  • [gcloud-dataproc-public-access] Dataproc Cluster Publicly Accessible (@princechaddha) [high]
  • [gcloud-dns-dangling-records] Dangling DNS Records Check (@princechaddha) [high]
  • [gcloud-dns-dnssec-unenabled] DNSSEC Not Enabled for Google Cloud DNS Zones (@princechaddha) [medium]
  • [gcloud-dnssec-keysigning-rsasha1] DNSSEC RSASHA1 Algorithm Deprecated Usage (@princechaddha) [medium]
  • [gcloud-dnssec-rsasha1-deprecated] DNSSEC RSASHA1 Algorithm Deprecated (@princechaddha) [medium]
  • [gcloud-filestore-deletion-protection-disabled] Filestore Instance Deletion Protection Not Enabled (@princechaddha) [medium]
  • [gcloud-filestore-no-backups] Filestore Instance Not Using On-Demand Backup (@princechaddha) [high]
  • [gcloud-filestore-no-cmek] Filestore Instance Not Using Customer-Managed Encryption Keys (@princechaddha) [high]
  • [gcloud-filestore-no-vpc-controls] Filestore Instance Not Protected by VPC Service Controls (@princechaddha) [medium]
  • [gcloud-filestore-unrestricted-access] Filestore Instance Client Access Not Restricted by IP (@princechaddha) [medium]
  • [gcloud-func-auto-runtime-updates-disabled] Automatic Runtime Security Updates Disabled in Google Cloud Functions (@princechaddha) [medium]
  • [gcloud-func-cmek-not-used] No Customer-Managed Encryption Keys in Google Cloud Functions (@princechaddha) [high]
  • [gcloud-func-inactive-svc-acc] Inactive Service Accounts in Google Cloud Functions (@princechaddha) [high]
  • [gcloud-func-min-instances-unset] Unset Minimum Instances for Cloud Functions (@princechaddha) [medium]
  • [gcloud-func-missing-labels] Missing User-Defined Labels in Google Cloud Functions (@princechaddha) [low]
  • [gcloud-func-no-vpc-access] No Serverless VPC Access in Google Cloud Functions (@princechaddha) [high]
  • [gcloud-func-public-access] Publicly Accessible Google Cloud Functions (@princechaddha) [high]
  • [gcloud-func-pubsub-dlt-missing] Configure Dead Lettering for Pub/Sub-Triggered Functions (@princechaddha) [low]
  • [gcloud-func-secrets-unmanaged] Use Secrets Manager for Managing Secrets in Google Cloud Functions (@princechaddha) [medium]
  • [gcloud-func-unrestricted-outbound] Unrestricted Outbound Network Access in Google Cloud Functions (@princechaddha) [high]
  • [gcp-cloud-fu...
Read more

Contributors

righettod, matusso, and 17 other contributors
Loading

v10.1.7

12 Apr 13:43
@princechaddha princechaddha
v10.1.7
196ed9f
Compare
Choose a tag to compare
v10.1.7

What's Changed

🔥 Release Highlights 🔥

False Negatives

  • Improved detection in halo-tism-sqli.yaml (PR #11892).

False Positives

  • Reduced false positives in hashicorp-consul-unauth.yaml (Issues #11852, #11881)
  • Corrected misdetection in headless-open-redirect.yaml with specific redirect target (Issue #11885)

Enhancements

  • Applied waitdialog handling to improve detection in dom-xss.yaml (PR #11921).
  • Updated detection logic in CVE-2025-1974.yaml for Ingress-Nginx RCE (PR #11917).
  • Updated smb-shares.yaml to refine share enumeration (PR #11880).
  • Improved login detection in emqx-default-login.yaml (PR #11865).
  • Refined credential detection in apache-hertzbeat-default-login.yaml (PR #11850).

Bug Fixes

  • Fixed metadata resolution issue in ldap-metadata.yaml (PR #11922).

Template Updates

New Templates Added: 64 | CVEs Added: 28 | First-time contributions: 6

New Contributors

Full Changelog: v10.1.6...v10.1.7

Contributors

micktaiwan, nvn1729, and 20 other contributors
Loading

v10.1.6

28 Mar 11:35
@princechaddha princechaddha
v10.1.6
30af57b
Compare
Choose a tag to compare
v10.1.6

What's Changed

🔥 Release Highlights 🔥

False Negatives

False Positives

Enhancements

Bug Fixes

Template Updates

New Templates Added: 78 | CVEs Added: 45 | First-time contributions: 8

New Contributors

Read more

Contributors

lee, sean, and 30 other contributors
Loading

CSP Bypass Templates - Nuclei Templates v10.1.5 🎉

10 Mar 12:01
@princechaddha princechaddha
v10.1.5
f41c1e9
Compare
Choose a tag to compare
CSP Bypass Templates - Nuclei Templates v10.1.5 🎉

🔥 Release Highlights 🔥

With this release, we are adding new CSP Bypass (DAST) Nuclei Templates to help security teams and bug hunters efficiently identify Content Security Policy (CSP) misconfigurations. These templates automate the detection of CSP bypass techniques, allowing testers to analyze real-world attack scenarios where CSP restrictions can be circumvented in the presence of existing XSS vulnerabilities.

We encourage contributors and reviewers to provide their valuable feedback and suggestions to help enhance and update these CSP Bypass templates further. For more details, please visit our latest blog post.

Other Highlights

What's Changed

New Templates Added: 281 | CVEs Added: 23 | First-time contributions: 4

Read more

Contributors

eric, geeknik, and 24 other contributors
Loading

v10.1.3

21 Feb 18:41
@princechaddha princechaddha
v10.1.3
b98b28b
Compare
Choose a tag to compare
v10.1.3

What's Changed

🔥 Release Highlights 🔥

False Negatives

  • [FALSE-NEGATIVE] wp-user-enum.yaml #11533
    Fix FN wp-user-enum.yaml #11556

False Positives

Enhancements

  • Update CVE-2023-26360.yaml #11524
  • Update Duplicate id #11530
  • Update prestashop-cartabandonmentpro-file-upload.yaml (Added Additional Path) #11573
  • fix(apache): make reference links correct #11604
  • Add new title support for jenkins-openuser-register.yaml #11606
  • Update siteminder-dom-xss.yaml #11613
  • Update CVE-2020-11710.yaml #11619
  • Update fingerprinthub-web-fingerprints.yaml #11622
  • Disabling redirects for mixed-active-content template #11628
  • Refactor the "NETDATA" template. #11629

Bug Fixes

  • NA

Template Updates

New Templates Added: 52 | CVEs Added: 25 | First-time contributions: 11

New Contributors

Full Changelog: v10.1.2...v10.1.3

Contributors

lee, chirag, and 24 other contributors
Loading

v10.1.2

22 Jan 07:04
@princechaddha princechaddha
v10.1.2
7c90874
Compare
Choose a tag to compare
v10.1.2

What's Changed

🔥 Release Highlights 🔥

Bug Fixes

  • NA

False Negatives

  • Report Google Client ID from headers #11443
  • kong-detect misses valid kong endpoint [nuclei-template] #11468
  • False Negatives in missing-sri #11337

False Positives

Enhancements

  • Update crxde-lite.yaml #11477 (Based on AdobeDocs for AEM 6.5)
  • Update kong-detect.yaml #11484
  • Update google-client-id.yaml #11470
  • Update mfa-console-password-disabled.yaml #11437
  • Updated hybris-default-login template with default HAC locations #11431
  • Update jolokia-createstandardhost-rce.yaml #11428
  • Update old-copyright.yaml #11425
  • Update sonarqube-cloud-token.yaml #11422
  • Severity Update Of DAST Templates #11413
  • Update missing-sri.yaml with css checks #11338
  • Update php-debugbar-exposure.yaml #10968

Template Updates

New Templates Added: 52 | CVEs Added: 23 | First-time contributions: 14

  • [CVE-2024-57727] SimpleHelp <= 5.5.7 - Unauth Path Traversal (@iamnoooob, @rootxharsh, @pdresearch, @3th1cyuk1) [high] 🔥
  • [CVE-2024-56512] Apache NiFi - Information Disclosure (@dhiyaneshdk) [medium]
  • [CVE-2024-56145] Craft CMS - Remote Code Execution via Template Path Manipulation (@jackhax) [critical] 🔥
  • [CVE-2024-55457] MasterSAM Star Gate v11 - Local File Inclusion (@dhiyaneshdk) [high]
  • [CVE-2024-55218] IceWarp Server 10.2.1 - Cross-Site Scripting (@s4e-io) [medium]
  • [CVE-2024-54385] Radio Player <= 2.0.82 - Server-Side Request Forgery (@s4e-io) [high]
  • [CVE-2024-54330] Hurrakify <= 2.4 - Server-Side Request Forgery (@s4e-io) [high]
  • [CVE-2024-50603] Aviatrix Controller - Remote Code Execution (@newlinesec, @securing.pl) [critical] 🔥
  • [CVE-2024-48455] Netis Wifi Router - Information Disclosure (@s4e-io) [high]
  • [CVE-2024-38353] CodiMD <2.5.4 - Insecure Filename Randomization (@denandz, @PulseSecurity.co.nz) [medium]
  • [CVE-2024-12849] Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read (@s4e-io) [high]
  • [CVE-2024-11921] Give WP Plugin < 3.19.0 - Cross-Site Scripting (@Splint3r7) [high]
  • [CVE-2024-9989] Crypto <= 2.15 - Authentication Bypass (@s4e-io) [critical]
  • [CVE-2024-9264] Grafana Post-Auth DuckDB - SQL Injection To File Read (@princechaddha) [critical] 🔥
  • [CVE-2024-9047] WordPress File Upload <= 4.24.11 - Arbitrary File Read (@s4e-io) [critical] 🔥
  • [CVE-2024-7097] WSO2 User Registration - Arbitrary Account Creation (@iamnoooob, @rootxharsh, @pdresearch) [medium] 🔥
  • [CVE-2024-0986] Issabel Authenticated - Remote Code Execution (@EunJi) [medium]
  • [CVE-2023-48788] Fortinet Forticlient Endpoint Management Server - SQL Injection (@james Horseman, @ItshMoh) [critical] 🔥
  • [CVE-2022-40624] pfSense pfBlockerNG - OS Command Injection (@ritikchaddha) [critical]
  • [CVE-2022-40443] ZZCMS 2022 - Path Information Disclosure (@ritikchaddha) [low]
  • [CVE-2021-35394] RealTek AP Router SDK - Arbitrary Command Injection (@king-alexander) [critical] 🔥
  • [CVE-2021-31324] CentOS Web Panel - OS Command Injection (@ritikchaddha) [critical]
  • [CVE-2021-31316] CentOS Web Panel - SQL Injection (@ritikchaddha) [critical]
  • [privesc-agetty] agetty - Privilege Escalation (@bobAKAbill) [high]
  • [CNVD-2024-33023] UFIDA U8 Cloud - SQL Injection (@s4e-io) [high]
  • [cloudlog-panel] Cloudlog Panel - Detect (@s4e-io) [info]
  • [frappe-helpdesk-panel] Frappe Helpdesk Login Panel - Detect (@righettod) [info]
  • [huly-panel] Huly Login Panel - Detect (@righettod) [info]
  • [i-librarian-panel] I-Librarian Panel - Detect (@s4e-io) [info]
  • [opnsense-panel] OPNsense Panel - Detect (@Splint3r7, @johnk3r) [info]
  • [stirling-pdf-panel] Stirling PDF Panel - Detect (@s4e-io) [info]
  • [tabby-panel] Tabby Panel - Detect (@s4e-io) [info]
  • [vaultwarden-panel] Vaultwarden Login Panel - Detect (@righettod) [info]
  • [yunohost-admin-panel] YunoHost Admin Panel - Detect (@s4e-io) [info]
  • [javascript-env] JavaScript Environment Configuration - Detect (@pdp, @geeknik, @hetyh) [low]
  • [sonarqube-cloud-token] SonarQube Cloud Token Disclosure (@dhiyaneshdk) [high]
  • [crxde-lite] CRXDE Lite - Exposure (@Nadino) [low]
  • [symfony-rce] Symfony _fragment - Default Key RCE (@Yablargo) [critical]
  • [khoj-detect] Khoj - Detect (@s4e-io) [info]
  • [stirling-pdf-detect] Stirling PDF - Detect (@s4e-io) [info]
  • [tyk-gateway-detect] Tyk API Gateway - Detection (@davidfegyver) [info]
  • [codimd-unauth-file-upload] CodiMD - File Upload (@denandz, @PulseSecurity.co.nz) [medium]
  • [jolokia-acceslogvalve-rce] Jolokia write to RCE valve (@pathtaga) [critical]
  • [jolokia-createstandardhost-rce] Jolokia file write to RCE jfr (@laluka, @pathtaga) [critical]
  • [jolokia-tomcat-creds-leak] Jolokia <= 1.7.1 Information Leakage (@pathtaga) [critical]
  • [mamp-server-xss] MAMP Server - Cross-Site Scripting (@ritikchaddha) [medium]
  • [cloudlog-system-sqli] Cloudlog System - SQL Injection (@s4e-io) [high]
  • [cpas-managment-lfi] CPAS Management System - Arbitrary Fi23le Read (@s4e-io) [high]
  • [cpas-managment-sqli] CPAS Management System - SQL Injection (@s4e-io) [high]
  • [jeeplus-cms-resetpassword-sqli] JeePlus CMS - SQL Injection (@WingBy_fkalis) [high]
  • [xhibiter-nft-sqli] Xhibiter NFT Marketplace 1.10.2 - SQL Injection (@projectdiscoveryai) [high]
  • [lantronix-xport-unauth] Lantronix XPort 6.10.0.1 - Unauthenticated Access (@john Osborn (Summit Security Group, @LLC)) [high]

New Contributors

Full Changelog: v10.1.1...v10.1.2

Contributors

james, john, and 35 other contributors
Loading

Alibaba Cloud Config Review - Nuclei Templates v10.1.1 🎉

23 Dec 10:40
@princechaddha princechaddha
v10.1.1
0783b20
Compare
Choose a tag to compare
Alibaba Cloud Config Review - Nuclei Templates v10.1.1 🎉

🔥 Release Highlights 🔥

We’re excited to announce the expansion of the Nuclei Templates with new templates specifically for Alibaba Cloud Configurations. This release introduces a series of specialized security checks tailored for the comprehensive components of Alibaba Cloud services, including ECS instances, RDS databases, OSS buckets, and more. These new templates are crafted to pinpoint common misconfigurations, ensure compliance with regulatory standards, and maintain adherence to industry best practices, leveraging advanced features such as flow and code analysis.

The introduction of these Alibaba Cloud-specific templates empowers security teams to conduct thorough security audits of their Alibaba Cloud environments, uncovering crucial misconfigurations and vulnerabilities. Moreover, this release offers customizable checks that can be tailored to meet the unique operational demands of different teams, aiding in the prompt detection and remediation of security issues.

We encourage contributors and reviewers to provide their valuable feedback and suggestions to help enhance and evolve these Alibaba Cloud security templates further. For more details, please visit our latest blog post.

Other Highlights

What's Changed

New Templates Added: 154 | CVEs Added: 31 | First-time contributions: 4

  • [CVE-2024-55956] Cleo Harmony < 5.8.0.24 - File Upload Vulnerability (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
  • [CVE-2024-52875] Kerio Control v9.2.5 - CRLF Injection (@ritikchaddha, @iamnoooob, @rootxharsh, @pdresearch) [high] 🔥
  • [CVE-2024-52433] My Geo Posts Free <= 1.2 - PHP Object Injection (@s4e-io) [critical]
  • [CVE-2024-50623] Cleo Harmony < 5.8.0.21 - Arbitary File Read (@dhiyaneshdk) [high] 🔥
  • [CVE-2024-48307] JeecgBoot v3.7.1 - SQL Injection (@lbb, @s4e-io) [critical]
  • [CVE-2024-45309] OneDev.io < 11.0.9 - Arbitrary File Read (@isacaya) [high] 🔥
  • [CVE-2024-45293] TablePress < 2.4.3 - XXE Injection (@iamnoooob, @ritikchaddha) [high]
  • [CVE-2024-41713] Mitel MiCollab - Authentication Bypass (@dhiyaneshdk, @watchtowr) [high] 🔥
  • [CVE-2024-39887] Apache Superset < 4.0.2 - SQL Injection (@iamnoooob, @rootxharsh, @pdresearch) [medium]
  • [CVE-2024-36404] GeoServer and GeoTools - Remote Code Execution (@ritikchaddha) [critical] 🔥
  • [CVE-2024-24116] Ruijie RG-NBS2009G-P - Improper Authentication (@friea) [critical]
  • [CVE-2024-12209] WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion (@s4e-io) [critical] 🔥
  • [CVE-2024-11728] KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection (@samogod, @s4e-io) [high]
  • [CVE-2024-11305] Altenergy Power Control Software - SQL Injection (@s4e-io) [medium]
  • [CVE-2024-11303] Korenix JetPort 5601v3 - Path Traversal (@geeknik) [high]
  • [CVE-2024-10516] Swift Performance Lite < 2.3.7.2 - Local PHP File Inclusion (@ritikchaddha) [high]
  • [CVE-2024-10400] Tutor LMS <= 2.7.6 - SQL Injection (@iamnoooob, @rootxharsh, @pdresearch) [high]
  • [CVE-2024-8859] Mlflow < 2.17.0 - Local File Inclusion (@gy741) [critical]
  • [CVE-2024-8856] WP Time Capsule Plugin - Remote Code Execution (@iamnoooob, @rootxharsh, @pdresearch) [critical] 🔥
  • [CVE-2023-50094] reNgine 2.2.0 - Command Injection (@Zierax) [high]
  • [CVE-2023-46455] GL.iNet <= 4.3.7 - Arbitrary File Write (@Zierax) [high]
  • [CVE-2023-37599] Issabel PBX 4.0.0-6 - Directory Listing (@ritikchaddha) [high]
  • [CVE-2023-6697] WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting (@iamnoooob, @ritikchaddha) [medium]
  • [CVE-2023-3990] Mingsoft MCMS < 5.3.1 - Cross-Site Scripting (@ritikchaddha) [medium]
  • [CVE-2023-1119] WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting (@ritikchaddha) [medium]
  • [CVE-2022-4375] Mingsoft MCMS - SQL Injection (@ritikchaddha) [critical]
  • [CVE-2022-2552] Duplicator < 1.4.7.1 - Information Disclosure (@iamnoooob, @ritikchaddha) [medium]
  • [CVE-2020-15906] Tiki Wiki CMS GroupWare - Authentication Bypass (@JeonSungHyun[nukunga], @gy741, @oIfloraIo, @nechyo, @harksu) [critical] 🔥
  • [CVE-2020-13935] Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service (@sttlr) [high] 🔥
  • [CVE-2019-9912] WP Google Maps < 7.10.43 - Cross-Site Scripting (@ritikchaddha) [medium]
  • [CVE-2017-1000353] Jenkins CLI - Java Deserialization (@hnd3884) [critical] 🔥
  • [ack-cluster-api-public] Public Access to ACK Cluster's API Server - Enabled (@ritikchaddha) [high]
  • [ack-cluster-auditing-disable] Cluster Auditing with Simple Log Service - Disabled (@ritikchaddha) [low]
  • [ack-cluster-cloud-monitor-disable] Cloud Monitor for ACK Clusters - Disable (@ritikchaddha) [medium]
  • [ack-cluster-health-disable] ACK Clusters Check - Disable (@ritikchaddha) [medium]
  • [ack-cluster-network-policies-disable] Enforced Cluster Support for Network Policies - Disabled (@ritikchaddha) [medium]
  • [ack-cluster-network-policies-missing] Cluster Support for Network Policies - Missing (@ritikchaddha) [medium]
  • [kubernetes-dashboard-enabled] Kubernetes Dashboard for ACK Clusters - Enabled (@ritikchaddha) [medium]
  • [multi-region-logging-disabled] Global Service (Multi-Region) Logging - Disabled (@dhiyaneshdk) [high]
  • [public-actiontrail-bucket] ActionTrail Log Buckets - Publicly Exposed (@ritikchaddha) [high]
  • [alibaba-cloud-code-env] Alibaba Cloud Environment Validation (@dhiyaneshdk) [info]
  • [os-patches-outdated] OS Patches - Outdated (@dhiyaneshdk) [medium]
  • [unattached-disk-encryption-disabled] Encryption for Unattached Disks - Disabled (@dhiyaneshdk) [high]
  • [unattached-vminstance-encryption-disabled] Encryption for VM Instance Disks - Disabled (@dhiyaneshdk) [high]
  • [unrestricted-rdp-access] Unrestricted - RDP Access (@dhiyaneshdk) [high]
  • [unrestricted-ssh-access] Unrestricted - SSH Access (@dhiyaneshdk) [high]
  • [access-logoss-disabled] Access Logging for OSS Buckets - Disabled (@dhiyaneshdk) [medium]
  • [improper-bucket-sse] Improper Bucket Server-Side Encryption (@ritikchaddha) [medium]
  • [limit-networkaccess-disabled] Limit Network Access to Selected Networks - Disabled (@dhiyaneshdk) [medium]
  • [oos-bucket-public-access] OSS Bucket Public Accessible (@dhiyaneshdk) [high]
  • [secure-transfeross-disabled] Secure Transfer for OSS Buckets - Disabled (@dhiyaneshdk) [medium]
  • [sse-cmk-disabled] Server-Side Encryption with Customer Managed Key - Disabled (@ritikchaddha) [high]
  • [sse-smk-disabled] Server-Side Encryption with Service Managed Key - Disabled (@ritikchaddha) [high]
  • [custom-ram-policy-admin-priv] Custom RAM Policies With Full Administrative Privileges (@dhiyaneshdk) [high]
  • [max-password-retry-disabled] Maximum Password Retry Constraint Policy - Disabled (@dhiyaneshdk) [medium]
  • [mfa-console-password-disabled] MFA For RAM Users With Console Password - Disabled (@dhiyaneshdk) [medium]
  • [password-policy-expiration-unconfigured] RAM Password Policy Expiration - Unconfigured (@dhiyaneshdk) [medium]
  • [password-policy-length-unconfigured] RAM Password Policy requires Minimum Length 14 or Greater (@dhiyaneshdk) [medium]
  • [password-policy-lowercase-unconfigured] RAM Password Policy requires atleast One Lowercase - Unconfigured (@dhiyaneshdk) [medium]
  • [password-policy-num-unconfigured] RAM Password Policy requires atleast One Number - Unconfigured (@dhiyaneshdk) [medium]
  • [password-policy-reuse-enabled] RAM Password Policy Reuse - Enabled (@dhiyaneshdk) [medium]
  • [password-policy-symbol-unconfigured] RAM Password Policy requires atleast One Symbol - Unconfigured (@dhiyaneshdk) [medium]
  • [password-policy-uppercase-unconfigured] RAM Password Policy requires atleast One Uppercase - Unconfigured (@dhiyaneshdk) [medium]
  • [encryption-intransit-disabled] RDS Encryption in Transit - Disabled (@dhiyaneshdk) [high]
  • [log-connections-disabled] PostgreSQL "log_connections" Parameter - Disabled (@dhiyaneshdk) [medium]
  • [log-disconnections-disabled] PostgreSQL "log_disconnections" Parameter - Disabled (@dhiyaneshdk) [medium]
  • [log-duration-disabled] PostgreSQL "log_duration" Parameter - Disabled (@dhiyaneshdk) [medium]
  • [mssql-audit-disabled] Microsoft SQLServer Database Instances - SQL Auditing Disabled (@dhiyaneshdk) [high]
  • [mysql-audit-disabled] MySQL Database Instances - SQL Auditing Disabled (@dhiyaneshdk) [high]
  • [postgresql-audit-disabled] PostgreSQL Database Instances - SQL Auditing Disabled (@dhiyaneshdk) [high]
  • [rds-audit-disabled] RDS Database Instances - SQL Auditing Disabled (@dhiyaneshdk) [high]
  • [transparent-encryption-disabled] Transparent Data Encryption - Disabled (@dhiyaneshdk) [medium]
  • [scheduled-vulnscan-disabled] Scheduled Vulnerability Scan - Disabled (@dhiyaneshdk) [medium]
  • [security-notificati...
Read more

Contributors

geeknik, stealthcopter, and 29 other contributors
Loading

Windows Security Hardening and Auditing - Nuclei Templates v10.1.0 🎉

04 Dec 15:15
@princechaddha princechaddha
v10.1.0
f2a6d1c
Compare
Choose a tag to compare
Windows Security Hardening and Auditing - Nuclei Templates v10.1.0 🎉

🔥 Release Highlights 🔥

We're excited to announce the latest expansion of the Nuclei Templates with a new set of templates tailored for Windows Security Hardening and Auditing. This update introduces a comprehensive array of security checks specifically designed for Windows environments, covering crucial areas such as password policies, encryption settings, certificate validation, and remote access configurations. These templates are added to detect common misconfigurations, ensure compliance with regulatory standards, and uphold adherence to industry best practices.

The introduction of these Windows-specific templates equips security teams to conduct audits of their Windows configurations, uncovering critical vulnerabilities and misconfigurations that could lead to potential security breaches.

We encourage contributors and reviewers to provide their valuable feedback and suggestions to help further enhance and update these Windows security templates. For more details, please visit our latest blog post.

Other Highlights

What's Changed

New Templates Added: 110 | CVEs Added: 23 | First-time contributions: 5

  • [CVE-2024-51482] ZoneMinder v1.37.* <= 1.37.64 - SQL Injection (@ritikchaddha) [critical] 🔥
  • [CVE-2024-50498] WP Query Console <= 1.0 - Remote Code Execution (@s4e-io) [critical] 🔥
  • [CVE-2024-46938] Sitecore Experience Platform <= 10.4 - Arbitrary File Read (@dhiyaneshdk) [high] 🔥
  • [CVE-2024-43919] YARPP <= 5.30.10 - Missing Authorization (@s4e-io) [critical]
  • [CVE-2024-42640] Angular-Base64-Upload - Remote Code Execution (@s4e-io) [critical] 🔥
  • [CVE-2024-38653] Ivanti Avalanche SmartDeviceServer - XML External Entity (@dhiyaneshdk) [high] 🔥
  • [CVE-2024-10924] Really Simple Security < 9.1.2 - Authentication Bypass (@yaser_s) [critical] 🔥
  • [CVE-2024-9935] PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download (@s4e-io) [high]
  • [CVE-2024-9474] PAN-OS Management Web Interface - Command Injection (@watchtowr, @iamnoooob, @rootxharsh, @pdresearch) [high] 🔥
  • [CVE-2024-9186] Automation By Autonami < 3.3.0 - SQL Injection (@s4e-io) [high]
  • [CVE-2024-3848] Mlflow < 2.11.0 - Path Traversal (@gy741) [high]
  • [CVE-2024-1483] Mlflow < 2.9.2 - Path Traversal (@gy741) [high]
  • [CVE-2024-0012] PAN-OS Management Web Interface - Authentication Bypass (@johnk3r, @watchtowr) [critical] 🔥
  • [CVE-2022-48166] Wavlink WL-WN530HG4 M30HG4.V5030.201217 - Information Disclosure (@ritikchaddha) [high]
  • [CVE-2022-48164] Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure (@ritikchaddha) [high]
  • [CVE-2022-44356] WAVLINK Quantum D4G (WL-WN531G3) - Information Disclosure (@ritikchaddha) [high]
  • [CVE-2022-41800] F5 BIG-IP Appliance Mode - Command Injection (@dwisiswant0) [high] 🔥
  • [CVE-2022-24819] XWiki < 12.10.11, 13.4.4 & 13.9-rc-1 - Information Disclosure (@ritikchaddha) [medium]
  • [CVE-2022-2130] Microweber < 1.2.17 - Cross-Site Scripting (@ritikchaddha) [medium]
  • [CVE-2022-0250] Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting (@ritikchaddha) [medium]
  • [CVE-2021-34630] GTranslate < 2.8.65 - Cross-Site Scripting (@ritikchaddha) [medium]
  • [CVE-2020-24881] OsTicket < 1.14.3 - Server Side Request Forgery (@hnd3884) [critical]
  • [CVE-2016-8735] Apache Tomcat - Remote Code Execution via JMX Ports (@hnd3884) [critical] 🔥
  • [k8s-missing-network-policies] Check for Missing Network Policies in Kubernetes (@princechaddha) [medium]
  • [allow-unencrypted-ftp] Allow Unencrypted FTP (@princechaddha) [high]
  • [allow-untrusted-certificates] System Allows Untrusted Certificates (@princechaddha) [medium]
  • [anonymous-sam-enumeration-enabled] Anonymous Enumeration of SAM Accounts Enabled (@princechaddha) [high]
  • [anonymous-sid-enumeration-enabled] Anonymous SID Enumeration Enabled (@princechaddha) [medium]
  • [audit-logging-disabled] Audit Logging Disabled (@princechaddha) [high]
  • [audit-logs-not-archived] Audit Logs Not Archived When Full (@princechaddha) [high]
  • [auto-logon-enabled] AutoLogon Enabled (@princechaddha) [medium]
  • [automatic-windows-updates-disabled] Automatic Windows Updates Disabled (@princechaddha) [medium]
  • [autoplay-removable-media-enabled] AutoPlay Enabled for Removable Media (@princechaddha) [medium]
  • [autorun-scripts-startup-folder] Autorun Scripts in Startup Folder (@princechaddha) [medium]
  • [credential-guard-disabled] Credential Guard Not Enabled (@princechaddha) [high]
  • [device-guard-not-configured] Device Guard Not Configured (@princechaddha) [high]
  • [display-last-username-enabled] Do Not Display Last User Name Disabled (@princechaddha) [medium]
  • [download-unsigned-activex-allowed] Download of Unsigned ActiveX Controls Allowed (@princechaddha) [high]
  • [ftp-service-running] FTP Service Running (@princechaddha) [high]
  • [guest-account-enabled] Guest Account Enabled (@princechaddha) [high]
  • [hyperv-enhanced-session-mode-enabled] Hyper-V Enhanced Session Mode Enabled (@princechaddha) [medium]
  • [insecure-cipher-suites-enabled] Insecure Cipher Suites Enabled (@princechaddha) [high]
  • [llmnr-disabled] LLMNR Disabled (@princechaddha) [medium]
  • [lm-hash-storage-enabled] LM Hash Storage Enabled (@princechaddha) [high]
  • [lm-ntlmv1-authentication-enabled] LM and NTLMv1 Authentication Enabled (@princechaddha) [high]
  • [max-password-age-too-high] Maximum Password Age Set Too High or Unlimited (@princechaddha) [medium]
  • [minimum-password-age-zero] Minimum Password Age Set to Zero (@princechaddha) [medium]
  • [netbios-disabled] NetBIOS Disabled (@princechaddha) [medium]
  • [network-discovery-public-disabled] Network Discovery Disabled on Public Networks (@princechaddha) [medium]
  • [null-session-allowed] Null Session Allowed (@princechaddha) [high]
  • [password-complexity-disabled] Password Complexity Requirements Disabled (@princechaddha) [high]
  • [password-history-size-low] Password History Size Too Low (@princechaddha) [medium]
  • [password-reset-lock-screen-enabled] Password Reset from Lock Screen Enabled (@princechaddha) [medium]
  • [plaintext-passwords-in-memory] Plaintext Passwords Stored in Memory (@princechaddha) [high]
  • [rdp-connections-without-password-allowed] Remote Desktop Connections Allowed Without Password (@princechaddha) [high]
  • [rdp-drive-redirection-allowed] Remote Desktop Users Can Redirect Drives (@princechaddha) [medium]
  • [rdp-nla-disabled] Network Level Authentication for RDP Disabled (@princechaddha) [high]
  • [remote-assistance-enabled] Check Remote Assistance Misconfiguration (@princechaddha) [medium]
  • [remote-desktop-enabled-non-server] Remote Desktop Enabled on Non-Server OS (@princechaddha) [high]
  • [restrict-anonymous-access-disabled] Restrict Anonymous Access Disabled (@princechaddha) [high]
  • [reversible-encryption-passwords-enabled] Store Passwords Using Reversible Encryption Enabled (@princechaddha) [critical]
  • [safe-dll-search-mode-disabled] Safe DLL Search Mode Disabled (@princechaddha) [high]
  • [secure-boot-disabled] Secure Boot Not Enabled (@princechaddha) [high]
  • [shutdown-without-logon-allowed] System Allows Shutdown Without Logging On (@princechaddha) [medium]
  • [smb-allow-unencrypted-passwords] Unencrypted Passwords to SMB Servers Allowed (@princechaddha) [high]
  • [smb-signing-not-required] SMB Signing Not Required (@princechaddha) [high]
  • [smb-v1-enabled] SMB v1 Protocol Enabled (@princechaddha) [critical]
  • [sticky-keys-enabled-login] Sticky Keys Enabled at Login Screen (@princechaddha) [high]
  • [telnet-service-misconfiguration] Check for Misconfigured Telnet Service (@princechaddha) [high]
  • [uac-elevate-without-prompt] UAC Elevate Without Prompting Enabled (@princechaddha) [high]
  • [unencrypted-file-sharing-enabled] Unencrypted File Sharing Enabled (@princechaddha) [medium]
  • [unsigned-kernel-mode-drivers-allowed] Installation of Unsigned Kernel-Mode Drivers Allowed (@princechaddha) [high]
  • [usb-storage-not-restricted] USB Storage Devices Not Restricted (@princechaddha) [medium]
  • [weak-ssl-tls-protocols-enabled] Weak SSL/TLS Protocols Enabled (@princechaddha) [critical]
  • [windows-active-desktop-enabled] Active Desktop Enabled (@princechaddha) [medium]
  • [windows-administrative-shares-enabled] Administrative Shares Enabled (@princechaddha) [high]
  • [windows-administrator-blank-password] Built-in Administrator Account Has Blank Password (@princechaddha) [high]
  • [windows-anonymous-sid-enumeration-allowed] Windows Allows Anonymous SID Enumeration (@princechaddha) [medium]
  • [windows-autorun-enabled] AutoRun Enabled (@princechaddha) [medium]
  • [windows-credential-manager-plaintext-passwords-allowed] Credential Manager Allows Storing of Plain Text Passwords (@princechaddha) [high]
  • [windows-defender-realtime-protection-disabled] Windows Defender Real-Time Protection Disabled (@princechaddha) [high]
  • [windows-dep-disabled] Dat...
Read more

Contributors

ricardomaia, righettod, and 19 other contributors
Loading

v10.0.4

18 Nov 06:26
@princechaddha princechaddha
v10.0.4
e10543a
Compare
Choose a tag to compare
v10.0.4

What's Changed

🔥 Release Highlights 🔥

Bug Fixes

False Negatives

No updates

False Positives

Enhancements

Template Updates

New Templates Added: 74 | CVEs Added: 26 | First-time contributions: 7

New Contributors

Full Changelog: v10.0.3...v10.0.4

Contributors

aayush, righettod, and 23 other contributors
Loading

v10.0.3

01 Nov 13:55
@princechaddha princechaddha
v10.0.3
28cf30d
Compare
Choose a tag to compare
v10.0.3

What's Changed

🔥 Release Highlights 🔥

Bug Fixes

  • Resolved issue with time-based SQL injection flow (Issue #11029).
  • Corrected detection for CVE-2016-9299 (Issue #11121).
  • Fixed false positive for appspec-yml-disclosure.yaml template (Issue #11112).
  • Refactored "Django Admin Panel" template (Issue #11044).
  • Improved prototype pollution checks to prevent insecure sanitization bypass (Issue #10589).

False Negatives

False Positives

  • Reduced false positives in weaver-checkserver-sqli template (Issue #11123).

Enhancements

  • Added templates for AWS services: EFS, Inspector2, GuardDuty, Firehose, DMS, EBS, ElastiCache, Route53, and RDS.
  • Introduced time-based tags for improved classification (Issue #11006).

Template Updates

New Templates Added: 116 | CVEs Added: 52 | First-time contributions: 7

Read more

Contributors

gumgum, kim, and 25 other contributors
Loading