CFADVISORY-CL-application-security-waf-waf-release-2025-01-06

Exploit Intelligence

• Complete CosmicSting (CVE-2024-34102) exploit suite for Magento/Adobe Commerce XXE vulnerability (github-poc-repo)
• Complete CosmicSting (CVE-2024-34102) exploit suite for Magento/Adobe Commerce XXE vulnerability (github-poc)
• Apache ShardingSphere ElasticJob-UI Privilege Escalation & RCE Exploit (github-poc-repo)
• Vulnerable docker container for Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 – 9.1.1.1 – Authentication Bypass CVE-2023-50164 (github-poc-repo)
• Rahul-Thakur7/CVE-2023-21554 (github-poc-repo)
• Documentation and PoC for CVE-2023-21554 MSMQ Vulnerability (github-poc-repo)
• CVE-2023-21554 PoC (github-poc-repo)
• This repository contains a Proof of Concept (PoC) exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and older versions. The exploit targets an improper authentication flaw due Privilege Misconfiguration issues. (github-poc-repo)
• Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass (github-poc-repo)
• cy3erdr4g0n/CVE-2024-10924 (github-poc-repo)

…and 139 more exploits

Timeline

• Jan 6, 2025 CVE Published

References

• WAF - WAF Release - 2025-01-06 advisory