45
45
45
45
45
45
45
45
45
45
45
[webapps] miniOrange 5.4.3 - Unauthenticated Auth Bypass
A proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3. The flaw allows attackers to bypass authentication without credentials. No in-the-wild exploitation or CVE identifier is stated in the listing.
30
45
45
45
45
45
45
45
Scans for Proxmox Servers, (Wed, Sep 9th)
SANS observed increased scanning and brute-force attacks on port 8006 targeting unsupported Proxmox VE 7 servers after a recent vulnerability advisory.
SANS Internet Storm Center reported a bump in scans for port 8006 and additional brute-force traffic against Proxmox VE servers following a Proxmox advisory about a vulnerability in older releases. The flaw only affects Proxmox VE version 7, which has been unsupported for a couple of years. Observed activity includes POST requests to /api2/json/access/ticket with root@pam usernames and weak passwords, fingerprinting requests, and POSTs to /api2/extjs/access/ticket; failed logins return 401 status codes and non-TLS POSTs return 308 redirects.
30
45
45
45
45
45
45
45
45
45
45
45
50
45
45
45
45