Confidential Audit Report Generated by RidgeBot™

Website_Pentest_DVWA
Feb 20, 2024 at 14:54
Agreement
CONFIDENTIALITY
This document contains proprietary and confidential information of a highly sensitive nature.
Reproduction or distribution without the express written permission of Ridge Security Technology
Corp. or the Client named above is strictly prohibited. This document should be marked
“CONFIDENTIAL” and therefore we suggest that this document be disseminated on a 'need to know'
basis.

DISCLAIMERS
The information presented in this document is provided as is and without warranty. Vulnerability
assessments are a 'point in time' analysis and as such it is possible that something in the
environment could have changed since the tests reflected in this report were run. Also, it is possible
that new vulnerabilities may have been discovered since the tests were run. For this reason, this
report should be considered a guide, not a 100% representation of the risk threatening your systems,
networks and applications. This report cannot and does not protect against personal or business loss
as the result of use of the applications or systems described. By using this information, you agree
that Ridge Security shall be held harmless in any event.
5 Critical Successful Exploits

Report Generated by RidgeBot™

Website_Pentest_DVWA
QUICKLINKS

Executive Summary Configuration at a Asset Details Website

Glance Fingerprints

Host Open Ports Exploit Details Vulnerability Details

Executive Summary
System Version: V4.2.8-20240208 Plugin Library Version: V4.50.2

TASK NAME START TIME END TIME TOTAL TIME STATUS

Website_Pentest_DVWA Feb 20, 2024 at 14:54 Feb 20, 2024 at 15:26 0 hours and 31 minutes Success

Total Health Score Policy: Minimum Score 60

Risk Weighted Assessment

Severe Risk 60 Low Risk

Critical Business Vulnerabilities
Risk
85 Critical

In this task, we have tested 1 IPs and 1 web servers, the

4
Total Health Score of the target system is 85, this score is High
Successful
based on 100 scale. It is a comprehensive evaluation 0
based on multiple factors such as percentage of 5 Medium
0
vulnerability, attack surface, encrypted traffic etc.This Exploits Low
test system is considered as in a "good"(Risky<60; 3
Info
60<=normal<85; good>=85) condition with the score of 4
85. The vulnerability found on each asset can be found
in "Asset Detail".

The platform successfully performed 5 exploits. These 5 Total number of targets： 1

exploited risks are critical and require immediate
Number of active assets： 1
attention. It means a real hacker can easily achieve the
Number of active Domains： 0
same result. In the "Exploit Details", we provided
Number of attack surface(s)： 8
information on how it attacked - path, techniques and
actions etc for security team to replicate and fix the
issue.

Among 5 exploits, 20.0% credential disclosure. 80.0%

sensitive information.
 Understanding the health
Exploit Results by Type and risk charts
In addition, the platform found 4
critical vulnerabilities, 0 high
vulnerabilities, 0 medium and 3
low vulnerabilities. These
vulnerabilities are possible risks,
it might be exploitable, however
it may take bigger risk or larger
efforts for a hacker. It shall be
attended to achieve a
comprehensive defense system.
Please refer to the "Vulnerability
Details" for more information
and remediation suggestion.

Penetration Test Action Distribution

The Penetration Test

Action Distribution chart
Breakdown of total jobs spent
within each of the three core
functions for the total count of
jobs.

Business Risk Summary

INDEX RISK TYPE RELATED VULNERABILITY TARGET DETAILS

Sensitive Sensitive Credential Information http://10.0.2.11/robots.txt

1
Information Leakage
Sensitive README Page Information Disclosure http://10.0.2.11/README.
2
Information md
Credential Sensitive Credential Information http://10.0.2.11/robots.txt
3
Disclosure Leakage
Sensitive Ini Files Information Disclosure http://10.0.2.11/php.ini
4
Information
Sensitive GIT Information Disclosure http://10.0.2.11/.git/config
5
Information

Configuration at a Glance
CUSTOMIZED PLUGINS SCRAPING STEALTH
SYSTEM TEMPLATE SCAN TYPE
TEMPLATE SELECTED MODE LEVEL

Website N/A 4330 Web applicationCrawling Normal

Penetration
 OS TYPE SEVERITY RISK

HIGH (1259) IMP ACTF UL (484)

WINDO WS (760)
MEDIUM (1166) L O W IMP ACT (3846)
O THER (4168)
L O W (1772)
L INUX (4102)
INF O (133)

Asset Details
TARGET HOSTNAME OS TYPE EXPLOITED CRITICAL HIGH MEDIUM LOW

10.0.2.11 Null Ubuntu 0 0 0 0 0

SITE IP/DOMAIN EXPLOITED CRITICAL HIGH MEDIUM LOW

http://10.0.2.11/ 10.0.2.11 5 4 0 0 3

Website Fingerprints
INDEX SITE CMS LANGUAGE FRAMEWORK WAF/CDN TYPE

1 http://10.0.2.11/ Apache 2.4.41 PHP - -

Exploit Details

5 Critical Business Risks

1 Sensitive Information exfiltrated via Sensitive Credential Critical

Information Leakage vul

Type Rank CVSS Score

Sensitive Information Critical 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database

Solution:
Enhance server configuration

Reference:
https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html

Detail(Total 1):
#1/1 Vulnerability Target: http://10.0.2.11/robots.txt
ALL File Count: 0
Code File Count: 0
File Count: 0
Kill Chain Analysis

</>

Attack Sequence 1

Found the attack surface of the site

Site Title: Login :: Damn Vulnerable
Web Application (DVWA) v1.10
*Development*
Site Address: http://10.0.2.11/ Attack Sequence 2

Crawl URL: http://10.0.2.11

Attack Sequence 3

Crawl URL: http://10.0.2.11/

Attack Sequence 4

Found Sensitive Credential

Information Leakage
Attack Sequence 5 Targets: http://10.0.2.11/robots.txt

Using Sensitive Credential Information

Leakage vulnerability successfully
obtained Git Information Disclosure
Exploit
Targets: http://10.0.2.11/robots.txt
All File Count: 0
File Count: 0
Text Count: 0

2 Sensitive Information exfiltrated via README Page Critical

Information Disclosure vul

Type Rank CVSS Score

Sensitive Information Critical 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database
Solution:
Enhance server configuration

Reference:
https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html

Detail(Total 1):
#1/1 Vulnerability Target: http://10.0.2.11/README.md
ALL File Count: 0
Code File Count: 0
File Count: 0
Kill Chain Analysis

</>

Attack Sequence 1

Found the attack surface of the site

Site Title: Login :: Damn Vulnerable
Web Application (DVWA) v1.10
*Development*
Site Address: http://10.0.2.11/ Attack Sequence 2

Crawl URL: http://10.0.2.11

Attack Sequence 3

Crawl URL: http://10.0.2.11/

Attack Sequence 4

Found README Page Information

Disclosure
Attack Sequence 5 Targets: http://10.0.2.11/README.md

Using README Page Information

Disclosure vulnerability successfully
obtained Git Information Disclosure
Exploit
Targets: http://10.0.2.11/README.md
All File Count: 0
File Count: 0
Text Count: 0

3 credentials obtained via Sensitive Credential Information Critical

Leakage vul

Type Rank CVSS Score

Credential Disclosure Critical 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database

Solution:
Enhance server configuration

Reference:
https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html

Detail(Total 1):
#1/1 Vulnerability Target: http://10.0.2.11/robots.txt
Current User: dvwa-robotuser
Service:
Port:
Username: dvwa-robotuser
Password: ******
Kill Chain Analysis

</>

Attack Sequence 1

Found the attack surface of the site

Site Title: Login :: Damn Vulnerable
Web Application (DVWA) v1.10
*Development*
Site Address: http://10.0.2.11/ Attack Sequence 2

Crawl URL: http://10.0.2.11

Attack Sequence 3

Crawl URL: http://10.0.2.11/

Attack Sequence 4

Found Sensitive Credential

Information Leakage
Attack Sequence 5 Targets: http://10.0.2.11/robots.txt

Using Sensitive Credential Information

Leakage vulnerability successfully
obtained Information Disclosure(GIT,
readme page, Inc files ...)
Targets: http://10.0.2.11/robots.txt
Service:
Username: dvwa-robotuser
Password: ******

4 Sensitive Information exfiltrated via Ini Files Information Critical

Disclosure vul

Type Rank CVSS Score

Sensitive Information Critical 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database

Solution:
Enhance server configuration

Reference:
https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html

Detail(Total 1):
#1/1 Vulnerability Target: http://10.0.2.11/php.ini
ALL File Count: 0
Code File Count: 0
File Count: 0
Kill Chain Analysis

</>

Attack Sequence 1

Found the attack surface of the site

Site Title: Login :: Damn Vulnerable
Web Application (DVWA) v1.10
*Development*
Site Address: http://10.0.2.11/ Attack Sequence 2

Crawl URL: http://10.0.2.11

Attack Sequence 3

Crawl URL: http://10.0.2.11/

Attack Sequence 4

Found Ini Files Information Disclosure

Targets: http://10.0.2.11/php.ini
Attack Sequence 5

Using Ini Files Information Disclosure

vulnerability successfully obtained Git
Information Disclosure Exploit
Targets: http://10.0.2.11/php.ini
All File Count: 0
File Count: 0
Text Count: 0

5 Sensitive Information exfiltrated via GIT Information Critical

Disclosure vul

Type Rank CVSS Score

 Sensitive Information Critical 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database

Solution:
Enhance server configuration

Reference:
https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html

Detail(Total 1):
#1/1 Vulnerability Target: http://10.0.2.11/.git/config
ALL File Count: 0
Code File Count: 0
File Count: 0
Kill Chain Analysis

</>

Attack Sequence 1

Found the attack surface of the site

Site Title: Login :: Damn Vulnerable
Web Application (DVWA) v1.10
*Development*
Site Address: http://10.0.2.11/ Attack Sequence 2

Crawl URL: http://10.0.2.11

Attack Sequence 3

Crawl URL: http://10.0.2.11/

Attack Sequence 4

Found GIT Information Disclosure

Targets: http://10.0.2.11/.git/config
Attack Sequence 5

Using GIT Information Disclosure

vulnerability successfully obtained Git
Information Disclosure Exploit
Targets: http://10.0.2.11/.git/config
All File Count: 0
File Count: 0
Text Count: 0
Vulnerability Details

4 Critical Vulnerabilities

1 Ini Files Information Disclosure

Type Rank CVSS Score

Information Disclosure CRITICAL 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database

Affected Nodes:

Target http://10.0.2.11/php.ini

Vulnerability details Target http://10.0.2.11/php.ini has Ini Files Information Disclosure

vulnerability
1/1
Parameter names url

Payload php.ini

References

REFERENCES

https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html

Vulnerability Solution:
Enhance server configuration

Public Poc:
Not Available

2 README Page Information Disclosure

Type Rank CVSS Score

Information Disclosure CRITICAL 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database

Affected Nodes:

Target http://10.0.2.11/README.md

Vulnerability details Target http://10.0.2.11/README.md has README Page Information

Disclosure vulnerability
1/1

Parameter names url

Payload README.md

References

REFERENCES

https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html

Vulnerability Solution:
Enhance server configuration

Public Poc:
Not Available

3 Sensitive Credential Information Leakage

Type Rank CVSS Score

Information Disclosure CRITICAL 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database

Affected Nodes:

Target http://10.0.2.11/robots.txt

Vulnerability details Target http://10.0.2.11/robots.txt has Sensitive Credential

Information Leakage vulnerability
1/1

Parameter names url

Payload http://10.0.2.11/robots.txt

References

REFERENCES

https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html
Vulnerability Solution:
Enhance server configuration

Public Poc:
Not Available

4 GIT Information Disclosure

Type Rank CVSS Score

Information Disclosure CRITICAL 5.3

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description:
Information disclosure refers to a website or a file which reveals sensitive information unintentionally
to its users. Sensitive information includes password, key, session ID, license, personal data such as
text messages, authorization credentials, personal identifiable information(name, address, telephone
number and etc), program files, configuration files, log files, backup files and database

Affected Nodes:

Target http://10.0.2.11/.git/config

Vulnerability details Target http://10.0.2.11/.git/config has GIT Information Disclosure

vulnerability
1/1

Parameter names url

Payload .git/config

References

REFERENCES

https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html

Vulnerability Solution:
Enhance server configuration

Public Poc:
Not Available

0 High Vulnerabilities

0 Medium Vulnerabilities

3 Low Vulnerabilities
1 Clickjacking due to X-Frame-Options Not Being Set in Response
Header

Type Rank CVSS Score

Information Disclosure LOW 3.1

CVSS Vector:
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Description:
Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or
opaque layers to trick a user into clicking on a button or link on another page when they were
intending to click on the top level page. Thus, the attacker is “hijacking” clicks meant for their page
and routing them to another page, most likely owned by another application, domain, or both.

Affected Nodes:

Target http://10.0.2.11/

Vulnerability details Target http://10.0.2.11/ has Clickjacking due to X-Frame-Options Not

Being Set in Response Header vulnerability
1/1
Parameter names X-Frame-Options

Payload

References

REFERENCES

https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#Defending_
with_Content_Security_Policy_frame-ancestors_directive
https://owasp.org/www-community/attacks/Clickjacking

Vulnerability Solution:
1. Restrict iframe busting via javascript.

2. Restrict iframe loading via setting in a response header X-Frame-Options. DENY: browser denies
any frame loading pages; SAMEORIGEN: only allow the frame page from the same domain; ALLOW-
FROM: customized permission, specify IP address that allows frame pages from.

3. In addition, some browser uses extension to combat clickjacking，such as Firefox extension

'Content-Security-Policy' and 'No-script'

Public Poc:
Not Available

2 Cookie without HttpOnly Flag Set

Type Rank CVSS Score

Information Disclosure LOW 3.1

CVSS Vector:
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Description:
If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side
JavaScript. This measure makes certain client-side attacks, such as cross-site scripting, harder to
exploit by preventing them from trivially capturing the cookie's value via an injected script.

Affected Nodes:

Target http://10.0.2.11/

Vulnerability details Target http://10.0.2.11/ has Cookie without HttpOnly Flag Set
vulnerability
1/1
Parameter names set-Cookie

Payload HttpOnly

References

REFERENCES

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

Vulnerability Solution:
Set the HttpOnly flag on all cookies

Public Poc:
Not Available

3 Login Page Public

Type Rank CVSS Score

Information Disclosure LOW 3.1

CVSS Vector:
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Description:
The login page is open to the public, please check whether the password complexity meets the
requirements.

Affected Nodes:

Target http://10.0.2.11/

Vulnerability details Target http://10.0.2.11/ has Login Page Public vulnerability

1/1
Parameter names url

Payload

References

REFERENCES

Vulnerability Solution:
please check whether the password complexity meets the requirements

Public Poc:
Not Available

4 Info Vulnerabilities

1 User Credentials in Plain Text

Type Rank CVSS Score

Information Disclosure INFO 0.0

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:N

Description:
User credentials are transmitted over an unencrypted channel. This information should always be
transferred via an encrypted channel (HTTPS) to avoid being intercepted by malicious users.

Affected Nodes:

Target http://10.0.2.11/login.php

Vulnerability details Target http://10.0.2.11/login.php has User Credentials in Plain Text

vulnerability
1/1
Parameter names url

Payload

References

REFERENCES

https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure

Vulnerability Solution:
Because user credentials are considered sensitive information, should always be transferred to the
server over an encrypted connection (HTTPS).

Public Poc:
Not Available

2 Cookie Without Secure Flag Set

Type Rank CVSS Score

Configuration INFO 0.0

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:N

Description:
This cookie does not have the Secure flag set. When a cookie is set with the Secure flag, it instructs
the browser that the cookie can only be accessed over secure SSL channels. This is an important
security protection for session cookies.

Affected Nodes:

Target http://10.0.2.11/

Vulnerability details Target http://10.0.2.11/ has Cookie Without Secure Flag Set
vulnerability
1/1

Parameter names url

Payload

References

REFERENCES

https://owasp.org/www-community/controls/SecureCookieAttribute

Vulnerability Solution:
Set the Secure flag for this cookie

Public Poc:
Not Available

3 Insecure Cookie SameSite Attribute

Type Rank CVSS Score

Configuration INFO 0.0

CVSS Vector:
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Description:
When cookies lack the SameSite attribute, Web browsers may apply different and sometimes
unexpected defaults. It is therefore recommended to add a SameSite attribute with an appropriate
value of either "Strict", "Lax", or "None".When set to "None", cookies are sent regardless of whether
they cross site or not

Affected Nodes:

Target http://10.0.2.11/

Vulnerability details Target http://10.0.2.11/ has Insecure Cookie SameSite Attribute

vulnerability
1/1

Parameter names url

Payload

References

REFERENCES

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie
Vulnerability Solution:
Set the SameSite value to "Strict" or "Lax"

Public Poc:
Not Available

4 Error Page Web Server Version Disclosure

Type Rank CVSS Score

Information Disclosure INFO 0.0

CVSS Vector:
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N

Description:
By requesting a page that doesn't exist, an error page was returned. This error page contains the
web server version number and a list of modules enabled on this server. This information can be
used to conduct further attacks.

Affected Nodes:

Target http://10.0.2.11/YDnuB4tUOT.aspx

Vulnerability details Target http://10.0.2.11/YDnuB4tUOT.aspx has Error Page Web Server

Version Disclosure vulnerability
1/1

Parameter names url

Payload

References

REFERENCES

https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure

Vulnerability Solution:
Custom exception page

Public Poc:
Not Available

Web URL Attack Surface Details Total 7

INDEX METHOD URL PARAMETERS

1 POST http://10.0.2.11/login.php Login, password, user_token, username

2 POST http://10.0.2.11/ Login, password, user_token, username
3 GET http://10.0.2.11/ N/A
4 GET http://10.0.2.11/login.php
5 GET http://10.0.2.11/
6 GET http://10.0.2.11/
7 GET http://10.0.2.11 N/A
Attack Log Details Total 289

INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:25:54 http://10 scan Start scan with http://10.0.2.11/login.php Server Side
1
.0.2.11 Request Forgery (SSRF)
02/20/2024 15:25:54 http://10 scan Start scan with http://10.0.2.11/login.php Apache Log4j2
2
.0.2.11 Remote Code Execution (CVE-2021-44228)
02/20/2024 15:25:54 http://10 scan Start scan with http://10.0.2.11/ Server Side Request Forgery
3
.0.2.11 (SSRF)
02/20/2024 15:25:54 http://10 scan Start scan with http://10.0.2.11/login.php Apache Log4j2
4
.0.2.11 Remote Code Execution (CVE-2021-44228)
02/20/2024 15:25:53 http://10 scan Start scan with http://10.0.2.11/ Apache Log4j2 Remote Code
5
.0.2.11 Execution (CVE-2021-44228)
02/20/2024 15:25:45 http://10 scan Start scan with http://10.0.2.11/ Apache Log4j2 Remote Code
6
.0.2.11 Execution (CVE-2021-44228)
02/20/2024 15:25:45 http://10 scan Start scan with http://10.0.2.11/ Apache Log4j2 Remote Code
7
.0.2.11 Execution (CVE-2021-44228)
02/20/2024 15:25:45 http://10 scan Start scan with http://10.0.2.11/ Apache Log4j2 Remote Code
8
.0.2.11 Execution (CVE-2021-44228)
02/20/2024 15:25:45 http://10 scan Start scan with http://10.0.2.11/ Apache Log4j2 Remote Code
9
.0.2.11 Execution (CVE-2021-44228)
02/20/2024 15:17:56 http://10 scan Start scan with http://10.0.2.11/ Ueditor 1.4.3.3 SSRF
10
.0.2.11
02/20/2024 15:17:22 http://10 scan Start scan with http://10.0.2.11/login.php Spring Data
11
.0.2.11 Commons Remote Code Execution (CVE-2018-1273)
02/20/2024 15:17:22 http://10 scan Start scan with http://10.0.2.11/ Spring Data Commons
12
.0.2.11 Remote Code Execution (CVE-2018-1273)
02/20/2024 15:16:47 http://10 scan Start scan with http://10.0.2.11/login.php CGI HTTPoxy Proxy
13
.0.2.11 Not Verified (CVE-2016-5385)
02/20/2024 15:16:47 http://10 scan Start scan with http://10.0.2.11/ XStream Deserialization
14
.0.2.11 Command Execution (CVE-2021-21351)
02/20/2024 15:16:28 http://10 scan Start scan with http://10.0.2.11/ Apache httpd mod_proxy
15
.0.2.11 SSRF (CVE-2021-40438)
02/20/2024 15:16:28 http://10 scan Start scan with http://10.0.2.11/login.php CGI HTTPoxy Proxy
16
.0.2.11 Not Verified (CVE-2016-5385)
02/20/2024 15:16:20 10.0.2.1 exploitTry to exploit 10.0.2.11 on Git Information Disclosure Exploit
17
1
02/20/2024 15:16:20 10.0.2.1 exploitTry to exploit 10.0.2.11 on Git Information Disclosure Exploit
18
1
02/20/2024 15:16:20 10.0.2.1 exploitTry to exploit 10.0.2.11 on Git Information Disclosure Exploit
19
1
02/20/2024 15:16:20 http://10 scan Start scan with http://10.0.2.11/ CGI HTTPoxy Proxy Not
20
.0.2.11 Verified (CVE-2016-5385)
02/20/2024 15:16:20 10.0.2.1 exploitTry to exploit 10.0.2.11 on Git Information Disclosure Exploit
21
1
02/20/2024 15:16:20 http://10 scan Start scan with http://10.0.2.11/ Spring Cloud Function SPEL
22
.0.2.11 Expression Injection (CVE-2022-22963)
02/20/2024 15:16:15 http://10 scan Start scan with http://10.0.2.11/ CGI HTTPoxy Proxy Not
23
.0.2.11 Verified (CVE-2016-5385)
02/20/2024 15:16:15 http://10 scan Start scan with http://10.0.2.11/ CGI HTTPoxy Proxy Not
24
.0.2.11 Verified (CVE-2016-5385)
02/20/2024 15:16:15 http://10 scan Start scan with http://10.0.2.11/ VMware vRealize Operations
25
.0.2.11 API Manager SSRF (CVE-2021-21975)
02/20/2024 15:16:15 http://10 scan Start scan with http://10.0.2.11/login.php XML External Entity
26
.0.2.11 (XXE) Injection
02/20/2024 15:16:15 http://10 scan Start scan with http://10.0.2.11/ CGI HTTPoxy Proxy Not
27
.0.2.11 Verified (CVE-2016-5385)
02/20/2024 15:16:15 10.0.2.1 exploitTry to exploit 10.0.2.11 on SVN Information Disclosure
28
1 Exploit
02/20/2024 15:16:15 10.0.2.1 exploitTry to exploit 10.0.2.11 on SVN Information Disclosure
29
1 Exploit
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:16:15 10.0.2.1 exploitTry to exploit 10.0.2.11 on SVN Information Disclosure

30
1 Exploit
02/20/2024 15:16:15 10.0.2.1 exploitTry to exploit 10.0.2.11 on SVN Information Disclosure
31
1 Exploit
02/20/2024 15:16:15 http://10 scan Start scan with http://10.0.2.11/login.php Cross Site Request
32
.0.2.11 Forgery (CSRF)
02/20/2024 15:16:09 http://10 scan Start scan with http://10.0.2.11/ XStream Remote Code
33
.0.2.11 Execution (CVE-2021-29505)
02/20/2024 15:15:56 http://10 scan Start scan with http://10.0.2.11/login.php Relative Path
34
.0.2.11 Traversal
02/20/2024 15:15:56 http://10 scan Start scan with http://10.0.2.11/ WebPageTest jpeginfo.php
35
.0.2.11 ssrf
02/20/2024 15:15:56 http://10 scan Start scan with http://10.0.2.11/login.php Command
36
.0.2.11 Execution
02/20/2024 15:15:56 http://10 scan Start scan with http://10.0.2.11/login.php Session Fixation
37
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php File Inclusion
38
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php PHP Code
39
.0.2.11 Execution
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php JWT weak HMAC
40
.0.2.11 secret
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Server-Side
41
.0.2.11 Includes (SSI) Injection
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/ Command Execution
42
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php XML External Entity
43
.0.2.11 (XXE) Injection
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Expression
44
.0.2.11 Language Injection
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Cross Site Request
45
.0.2.11 Forgery (CSRF)
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Apache Shiro 1.2.4
46
.0.2.11 Deserialization (CVE-2016-4437)
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/ PHP 'Xdebug' Remote Debug
47
.0.2.11 RCE
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php User Credentials in
48
.0.2.11 Plain Text
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php XSS via Remote File
49
.0.2.11 Inclusion
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php XPath Injection
50
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php HQL Injection
51
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Directory Traversal
52
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/ SaltStack Salt API Shell
53
.0.2.11 Injection (CVE-2020-16846)
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Navigate CMS 2.8
54
.0.2.11 Bypass File Upload (CVE-2018-17553)
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php CRLF Injection
55
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php URL Redirection
56
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php PHP Code Injection
57
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Accept User
58
.0.2.11 Controllable Script Source in JavaScript
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php ASP Code Injection
59
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Server-Side
60
.0.2.11 Template Injection
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/ LDAP Injection
61
.0.2.11
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php Navigate CMS 2.8
62
.0.2.11 Bypass File Upload (CVE-2018-17553)
02/20/2024 15:15:54 http://10 scan Start scan with http://10.0.2.11/login.php HTTP Parameter
63
.0.2.11 Pollution
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ HQL Injection
64
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ JWT weak HMAC secret
65
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ ASP Code Injection
66
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/login.php Apache Shiro 1.2.4
67
.0.2.11 Deserialization (CVE-2016-4437)
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ File Inclusion
68
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ Accept User Controllable
69
.0.2.11 Script Source in JavaScript
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ HTTP Parameter Pollution
70
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/login.php Session Fixation
71
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ Session Fixation
72
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ Spring Boot Unauthorized
73
.0.2.11 Access
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ XML External Entity (XXE)
74
.0.2.11 Injection
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/login.php JWT weak HMAC
75
.0.2.11 secret
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/login.php PHP preg_replace()
76
.0.2.11 Used on User Input cause Code Execution
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ Apache Shiro 1.2.4
77
.0.2.11 Deserialization (CVE-2016-4437)
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ Server-Side Includes (SSI)
78
.0.2.11 Injection
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ PHP Code Execution
79
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/login.php LDAP Injection
80
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ JWT weak HMAC secret
81
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ Swagger arbitrary code
82
.0.2.11 execution (CVE-2017-1000207 and CVE-2017-1000208)
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ XPath Injection
83
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ URL Redirection
84
.0.2.11
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ Apache Shiro 1.2.4
85
.0.2.11 Deserialization (CVE-2016-4437)
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ XML External Entity (XXE)
86
.0.2.11 Injection
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/login.php Cross Domain Data
87
.0.2.11 Hijacking
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ XSS via Remote File
88
.0.2.11 Inclusion
02/20/2024 15:15:50 http://10 scan Start scan with http://10.0.2.11/ JWT weak HMAC secret
89
.0.2.11
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Apache Shiro 1.2.4
90
.0.2.11 Deserialization (CVE-2016-4437)
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ XML External Entity (XXE)
91
.0.2.11 Injection
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Session Fixation
92
.0.2.11
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ PHP 'webadmin' Page
93
.0.2.11 Information Disclosure
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Alibaba Druid Weak
94
.0.2.11 Password
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ APC Sensitive Information
95
.0.2.11 Disclosure
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ HTTP Verb Temporary File
96
.0.2.11 Disclosure
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Session Fixation
97
.0.2.11
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Cookie Without Secure Flag
98
.0.2.11 Set
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Spring Boot Actuator v2
99
.0.2.11 Information Disclosure
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Alibaba Druid Unauthorized
100
.0.2.11 Access
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ KindEditor unauthentication
101
.0.2.11 file upload (CVE-2017-1002024)
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ PHP 'phpinfo' Page
102
.0.2.11 Information Disclosure
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Insecure Cookie SameSite
103
.0.2.11 Attribute
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Bazaar Backup Information
104
.0.2.11 Disclosure
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Ueditor Reflected XSS
105
.0.2.11
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Grails Database Console
106
.0.2.11 Disclosure
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ Session Fixation
107
.0.2.11
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ UEditor 1.4.3.3 .net Arbitrary
108
.0.2.11 File Upload
02/20/2024 15:15:45 http://10 scan Start scan with http://10.0.2.11/ JWT weak HMAC secret
109
.0.2.11
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ TensorBoard Unauthorized
110
.0.2.11 Access
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ Cyberfolio 'view.php'
111
.0.2.11 Remote File Inclusion
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ Ignite Realtime Openfire
112
.0.2.11 Management Terminal Cross-Site Scripting (CVE-2008-6510)
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ OSA Operations
113
.0.2.11 Management System Foreground '/index.php' Getshell
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ Minerva 2.0.21 Build 238a
114
.0.2.11 (phpbb_root_path) Remote File Inclusion (CVE-2006-5077)
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ XAMPP 1.7.3 File Disclosure
115
.0.2.11
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ Ceph Unauthorized Access
116
.0.2.11 (CVE-2018-1128)
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ Jira Server and Data Center
117
.0.2.11 Server-Side Template Injection (CVE-2019-11581)
02/20/2024 15:15:43 http://10 scan Start scan with http://10.0.2.11/ KindEditor <4.1.5 PHP File
118
.0.2.11 Upload
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Nagios XI Remote Command
119
.0.2.11 Execution (CVE-2019-20197)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Caucho Resin "viewfile"
120
.0.2.11 Arbitrary File Reading (CVE-2006-2438)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Apache Solr Remote Code
121
.0.2.11 Execution (CVE-2020-13957)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Fortinet FortiOS Path
122
.0.2.11 Traversal (CVE-2018-13379)
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ OpenSSL SSLv2 DROWN
123
.0.2.11 Attack (CVE-2016-0800)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ ResourceSpace SQL
124
.0.2.11 Injection (CVE-2021-41765)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ mcNews 1.x 'Install.PHP'
125
.0.2.11 Remote File Inclusion (CVE-2005-0800)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Fortinet FortiOS Cross-Site
126
.0.2.11 Scripting (CVE-2018-13380)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Laravel 5 Debug Mode
127
.0.2.11 Information Disclosure
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Improper Configuration of
128
.0.2.11 "crossdomain.xml"
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Apache Kylin Remote
129
.0.2.11 Command Execution (CVE-2020-13925)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ Caucho Resin Directory
130
.0.2.11 Traversal (CVE-2012-2968)
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ HTTP 'Content-Security-
131
.0.2.11 Policy' Header Not Set
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ MongoDB httpinterface
132
.0.2.11 Information Disclosure
02/20/2024 15:15:41 http://10 scan Start scan with http://10.0.2.11/ UsualToolCMS 8.0 Time-
133
.0.2.11 Based Blind SQL Injection
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ Eclipse Jetty Privilege Bypass
134
.0.2.11 (CVE-2021-34429)
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ VMware Workspace ONE
135
.0.2.11 Access SSTI Remote Command Execution (CVE-2022-22954)
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ Rocket Chat MongoDB
136
.0.2.11 Injection (CVE-2021-22911)
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ Appweb Authentication
137
.0.2.11 Bypass (CVE-2018-8715)
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ 'npmaker' Arbitrary File
138
.0.2.11 Upload
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ Apache Solr SSRF (CVE-2021-
139
.0.2.11 27905)
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ TOPApp-LB System Login
140
.0.2.11 Bypass For Load Balancing
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ Dream Gallery 1.0 SQL
141
.0.2.11 Injection
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ PHP imap Remote Command
142
.0.2.11 Execution (CVE-2018-19518)
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ DeDeCMS v5.8.1 Beta
143
.0.2.11 Remote Command Execution
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ Adobe ColdFusion Directory
144
.0.2.11 Traversal (CVE-2010-2861)
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ KindEditor Multiple
145
.0.2.11 Arbitrary File Upload
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ Apache Solr Remote Code
146
.0.2.11 Injection(CVE-2019-17558)
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ Improper Configuration of
147
.0.2.11 Webpack
02/20/2024 15:15:40 http://10 scan Start scan with http://10.0.2.11/ FotoWeb 6.0 'login.fwx' XSS
148
.0.2.11 (CVE-2009-0573)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ XAMPP 1.7.3
149
.0.2.11 '/xampp/showcode.php' Arbitrary File Download
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ NSFOCUS UTS
150 .0.2.11 Comprehensive Threat Probe Susceptible to Unauthorized
Administrator Access
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Node-RED ui_base Directory
151
.0.2.11 Listing (CVE-2021-3223)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Elasticsearch Kibana
152
.0.2.11 Remote Code Execution(CVE-2019-7609)
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ SaltStack Arbitrary File
153
.0.2.11 Writes (CVE-2021-25281)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ DNS Misconfiguration
154
.0.2.11
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ jQuery v2.2.2 XSS (CVE-2018-
155
.0.2.11 18405)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Dahua Privilege Bypass
156
.0.2.11 (CVE-2021-33044)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Metabase Custom GeoJSON
157
.0.2.11 Map Local File Inclusion (CVE-2021-41277)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ OMIGOD-Microsoft Azure
158
.0.2.11 OMI Remote Code Execution (CVE-2021-38647)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Improper Configuration of
159
.0.2.11 "ClientAccessPolicy.xml"
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Apache Solr Directory
160
.0.2.11 Traversal (CVE-2021-29262)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ HTTP 'Strict-Transport-
161
.0.2.11 Security' Header Not Set
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ node-postgres Code
162
.0.2.11 Execution (CVE-2017-16082)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Apache HTTP Server
163
.0.2.11 Directory Traversal (CVE-2021-41773/CVE-2021-42013)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Intellian Satellian Aptus
164
.0.2.11 Web Remote Command Execution (CVE-2020-7980)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Kubernetes API Server
165
.0.2.11 Unauthorized Access
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Kindeditor<4.1.5 jsp File
166
.0.2.11 Upload
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Apache Commons Text
167
.0.2.11 Text4shell Command Injection (CVE-2022-42889)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Cookie without HttpOnly
168
.0.2.11 Flag Set
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ ThinkCMF Framework
169
.0.2.11 Arbitrary File Inclusion/Upload
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Unprotected phpMyAdmin
170
.0.2.11 Interface
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Allegro RomPager
171
.0.2.11 "Misfortune Cookie" (CVE-2014-9222)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Spring Cloud Function SpEL
172
.0.2.11 RCE
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Nacos Authentication
173
.0.2.11 Bypass (CVE-2021-29441)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Apache server-status Info
174
.0.2.11 Leak
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ WF2419 Remote Code
175
.0.2.11 Execution (CVE-2019-19356)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ H2 Database Unauthorized
176
.0.2.11 Access
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Jenkins Forced Migration of
177
.0.2.11 User Records (CVE-2018-1000863)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Cloud Foundry etcd
178
.0.2.11 Unauthorized Access (CVE-2019-3779)
02/20/2024 15:15:38 http://10 scan Start scan with http://10.0.2.11/ Qizhi Operation And
179
.0.2.11 Maintenance Bastion Server Command Execution
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ vBulletin 5.x Pre-auth
180
.0.2.11 Remote Code Execution (CVE-2019-16759)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ MOVEit Transfer SQLi
181
.0.2.11 Vulnerability(CVE-2023-34362)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ PHPUnit 'eval-stdin.php'
182
.0.2.11 Remote Code Execution (CVE-2017-9841)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ SANGFOR EDR Remote
183
.0.2.11 Command Execution (CNVD-2020-46552)
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Error Page Web Server
184
.0.2.11 Version Disclosure
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ HFS prior to 2.3.c has
185
.0.2.11 ParserLib.pas RCE (CVE-2014-6287)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Mongo-Express Remote
186
.0.2.11 Code Execution (CVE-2019-10758)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Centos Web Panel 7
187
.0.2.11 Unauthenticated RCE (CVE-2022-44877)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ eWebEditor Weak Password
188
.0.2.11
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ PHP-FPM Remote Command
189
.0.2.11 Execution (CVE-2019-11043)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Nagios Network Analyzer
190
.0.2.11 SQL Injection (CVE-2021-28925)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Zoho ManageEngine
191 .0.2.11 ADSelfService Plus REST API Authentication Bypass (RCE)
(CVE-2021-40539)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Apache APISIX Remote
192
.0.2.11 Command Execution (CVE-2022-24112)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Apache Cocoon XML
193
.0.2.11 Injection (CVE-2020-11991)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Apache Spark Unauthorized
194
.0.2.11 Access
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Access Control Allow Origin
195
.0.2.11
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Apache HttpOnly Cookie
196
.0.2.11 Disclosure (CVE-2012-0053)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Igniterealtime Openfire
197
.0.2.11 Management Terminal Directory Traversal (CVE-2008-6508)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Clickjacking due to 'X-Frame-
198
.0.2.11 Options' Not Being Set in Response Header
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Elastix 2.5
199
.0.2.11 'iridium_threed.php' SQL Injection (CVE-2015-1875)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Docker Registry 2.0
200
.0.2.11 Unauthorized Access
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Apache Superset Auth
201
.0.2.11 Bypass (CVE-2023-27524)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Alibaba Nacos Improper
202
.0.2.11 Authentication
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Elasticsearch Directory
203
.0.2.11 Traversal (CVE-2015-5531)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Apache Tapestry
204 .0.2.11 AppModule Unauthorized Access (CVE-2021-27850/CVE-
2019-0195)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Johnson Controls
205 .0.2.11 'exacqVision' Enterprise Manager And Web Service Data
Forgery (CVE-2020-9047)
02/20/2024 15:15:36 http://10 scan Start scan with http://10.0.2.11/ Apache CouchDB Admin
206
.0.2.11 Privilege Escalation (CVE-2017-12635)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ Spring Framework Reflected
207
.0.2.11 File Download Protection Bypassed (CVE-2020-5398)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ Apache Kylin Unauthorized
208
.0.2.11 Configuration Disclosure (CVE-2020-13937)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ phpStudy Remote Code
209
.0.2.11 Execution (RCE)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ VMware Authentication
210
.0.2.11 Bypass (CVE-2022-22972)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ Elasticsearch Kibana Local
211
.0.2.11 File Inclusion (CVE-2018-17246)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ Zeppelin Notebook Weak
212
.0.2.11 Password
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ Yeastar NeoGate TG400
213
.0.2.11 91.3.0.3 Directory Listing (CVE-2021-27328)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ HPE Integrated Lights-Out 4
214
.0.2.11 Remote Code Execution (CVE-2017-12542)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ Cute Editor Local File
215
.0.2.11 Contains
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ EMC Cloud Tiering
216 .0.2.11 Appliance (CTA) XML External Entity Injection (CVE-2014-
0644)
02/20/2024 15:15:32 http://10 scan Start scan with http://10.0.2.11/ SANGFOR EDR 3.2.21
217
.0.2.11 Arbitrary Code Execution
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ H3C ER3100 Enterprise VPN
218
.0.2.11 Router Unauthorized Access
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ PHP Scripts Mall Basic B2B
219
.0.2.11 Script SQL Injection (CVE-2017-17600)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Pulse Secure SSL VPN
220
.0.2.11 Arbitrary File Read/Write (CVE-2019-11510)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Apache SkyWalking SQL
221
.0.2.11 Injection (CVE-2020-13921)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ PHP 8.1.0-dev zerodium
222
.0.2.11 Backdoor
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Jellyfin Directory Traversal
223
.0.2.11 (CVE-2021-21402)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Nacos JWT Improper
224
.0.2.11 Authentication
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ NETGEAR JNR1010 XSS,
225
.0.2.11 CSRF, CRLF injection
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Basic Authentication Burst
226
.0.2.11
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Nacos Backend Weak
227
.0.2.11 Password
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Webmin Remote Command
228
.0.2.11 Execution (CVE-2019-15107)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Microsoft FrontPage
229
.0.2.11 Information Disclosure (CVE-2013-3137)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Ifw8 Router ROM Password
230
.0.2.11 Hash Disclosure (CVE-2019-16313)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Apache Axis Info Leak
231
.0.2.11
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ MessageSolution EEA Email
232
.0.2.11 Archiving System Information Disclosure
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Jupyter Notebook
233
.0.2.11 Unauthorized Access
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Spring Framework Reflected
234
.0.2.11 File Download（CVE-2020-5398）
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ IMFirewall Management
235
.0.2.11 Platform Weak Password
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ HTTP HOST Header Attack
236
.0.2.11
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Kong Unauthorized Access
237
.0.2.11 (CVE-2020-11710)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Apache HTTPD Newline
238
.0.2.11 Parsing (CVE-2017-15715)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ FlashChat <= 4.5.7
239
.0.2.11 'aedating4CMS.php' Remote File Inclusion (CVE-2006-4583)
02/20/2024 15:15:24 http://10 scan Start scan with http://10.0.2.11/ Microsoft Exchange Server
240
.0.2.11 Server Side Request Forgery (CVE-2021-26855)
02/20/2024 15:15:21 http://10 scan Start scan with http://10.0.2.11/ Swagger-UI XSS
241
.0.2.11
02/20/2024 15:15:09 http://10 scan Start scan with http://10.0.2.11/ Apache ShenYu Admin
242
.0.2.11 Authentication Bypass Vulnerability (CVE-2021-37580)
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:15:09 http://10 scan Start scan with http://10.0.2.11/ "TRACE" Method Enabled
243
.0.2.11
02/20/2024 15:15:09 http://10 scan Start scan with http://10.0.2.11/ Spring Cloud Gateway
244
.0.2.11 Remote Code Execution (CVE-2022-22947)
02/20/2024 15:15:09 http://10 scan Start scan with http://10.0.2.11/ Apache Kylin Command
245
.0.2.11 Injection (CVE-2022-43396)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ TLS 1.1 Enabled
246
.0.2.11
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ PHP-CGI Remote Code
247
.0.2.11 Execution (RCE) (CVE-2012-1823)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Apache Ofbiz Solr Plugin
248
.0.2.11 Directory Traversal (CVE-2022-47501)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Cisco Small Business RV320
249
.0.2.11 and RV 325 Sensitive Information Retrieval (CVE-2019-1653)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ SANGFOR EDR Login Bypass
250
.0.2.11
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ HAProxy Control
251
.0.2.11 Management Platform Unauthorized Access
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ VMware vSphere
252
.0.2.11 Client(HTML5) Remote Code Execution (CVE-2021-21972)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Apache 'mod_negotiation'
253
.0.2.11 Filename Brute-force
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Apache FreeMarker
254 .0.2.11 Template FusionAuth Remote Code Execution (CVE-2020-
7799)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ JumpServer Log File Reading
255
.0.2.11 and RCE
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ uWSGI Directory Traversal
256
.0.2.11 (CVE-2018-7490)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Apache SkyWalking SQL
257
.0.2.11 Injection (CVE-2020-9483)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Gerapy Remote Command
258
.0.2.11 Execution (CVE-2021-32849)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Cacti Weatherermap Plugin
259
.0.2.11 Arbitrary File Read (CVE-2013-3739)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Apache Solr
260 .0.2.11 'DatalmportHandler' Remote Code Execution (CVE-2019-
0193)
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Spring Boot Actuator H2
261
.0.2.11 Remote Command Execution
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ FastMeeting Video
262
.0.2.11 Conference System Arbitrary File Download
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ OIDC Interface information
263
.0.2.11 exposure
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Weaver Mobile Platform
264
.0.2.11 Expression Injection
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ E-Sic SQL Injection
265
.0.2.11
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Dangerous HTTP Methods
266
.0.2.11
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Hadoop YARN
267
.0.2.11 ResourceManager Unauthorized
02/20/2024 15:15:08 http://10 scan Start scan with http://10.0.2.11/ Possible Server Path
268
.0.2.11 Disclosure
02/20/2024 15:03:08 http://10 scan Start scan with http://10.0.2.11/login.php Information
269
.0.2.11 Disclosure(GIT, readme page, Inc files ...)
02/20/2024 15:02:56 http://10 scan Start scan with http://10.0.2.11/login.php Backend Weak
270
.0.2.11 Password
02/20/2024 15:02:45 http://10 scan Start scan with http://10.0.2.11/login.php Cross-Site
271
.0.2.11 Scripting
02/20/2024 15:02:37 http://10 scan Start scan with http://10.0.2.11/login.php Information
272
.0.2.11 Disclosure(GIT, readme page, Inc files ...)
 INDEX TIME TARGET TYPE CONTENT

02/20/2024 15:02:16 http://10 scan Start scan with http://10.0.2.11/ Information Disclosure(GIT,
273
.0.2.11 readme page, Inc files ...)
02/20/2024 15:01:51 http://10 scan Start scan with http://10.0.2.11/ Cross-Site Scripting
274
.0.2.11
02/20/2024 15:01:35 http://10 scan Start scan with http://10.0.2.11/ Information Disclosure(GIT,
275
.0.2.11 readme page, Inc files ...)
02/20/2024 15:01:10 http://10 scan Start scan with http://10.0.2.11/ Information Disclosure(GIT,
276
.0.2.11 readme page, Inc files ...)
02/20/2024 15:00:25 http://10 scan Start scan with http://10.0.2.11/ Information Disclosure(GIT,
277
.0.2.11 readme page, Inc files ...)
02/20/2024 14:59:43 http://10 scan Start scan with http://10.0.2.11/ pfSense Authenticated
278
.0.2.11 'graph' Status RCE
02/20/2024 14:59:21 http://10 scan Start scan with http://10.0.2.11/ Login Page Public
279
.0.2.11
02/20/2024 14:59:17 http://10 scan Start scan with http://10.0.2.11/ Zoho ManageEngine
280 .0.2.11 ServiceDesk Plus Pre-auth Remote Code Execution (CVE-
2021-44077)
02/20/2024 14:59:00 http://10 scan Start scan with http://10.0.2.11/ Navigate CMS
281
.0.2.11 Unauthenticated Remote Code Execution
02/20/2024 14:58:09 http://10 scan Start scan with http://10.0.2.11/ Apache Ofbiz RCE (CVE-
282
.0.2.11 2020-9496)
02/20/2024 14:57:59 http://10 scan Start scan with http://10.0.2.11/ Apache Dubbo
283
.0.2.11 Deserialization (CVE-2019-17564)
02/20/2024 14:57:07 http://10 scan Start scan with http://10.0.2.11/login.php SQL Injection
284
.0.2.11
02/20/2024 14:56:18 http://10 scan Start scan with http://10.0.2.11/ SQL Injection
285
.0.2.11
02/20/2024 14:55:57 http://10 Discov Start asset detection for N targets including http://10.0.2.11/
286
.0.2.11 er
02/20/2024 14:55:49 http://10 scan Start scan with http://10.0.2.11/ Information Disclosure(GIT,
287
.0.2.11 readme page, Inc files ...)
02/20/2024 14:55:31 http://10 Discov Start asset detection for N targets including http://10.0.2.11/
288
.0.2.11 er
02/20/2024 14:55:03 http://10 Discov Start asset detection for N targets including http://10.0.2.11
289
.0.2.11 er