Research Notes

Get on a call with our team and learn how Assetnote can change the way you secure your attack surface. We'll set you up with a trial instance so you can see the impact for yourself.

Request a Demo

Address:
Level 10, 12 Creek Street, Brisbane QLD, 4000
‍
Contact:
contact@assetnote.io

Press Inquiries:
press@assetnote.io

Platform Features

Continuous Asset Discovery

Deep Asset Enrichment

Assetnote Exposure Engine

Expert Security Research

Collaborative Workflows

Customization

Use Cases

Continuous Asset Discovery and Inventory

Real-Time Exposure Monitoring

Attack Surface Reduction

Mergers & Acquisitions

Bug Bounty Readiness

Chaining Three Bugs to Access All Your ServiceNow Data

Why nested deserialization is harmful: Magento XXE (CVE-2024-34102)

Digging for SSRF in NextJS apps

Security Advisories

Advisory: Next.js SSRF (CVE-2024-34351)

Advisory: Progress WS_FTP RCE (CVE-2023-40044)

Advisory: Flarum LFI - CVE-2023-40033

Advisory: Metabase Pre-Auth RCE (CVE-2023-38646)

Advisory: ShareFile Pre-Auth RCE (CVE-2023-24489)

Advisory: Citrix Gateway Open Redirect and XSS (CVE-2023-24488)

Advisory: Oracle Opera Pre-Auth RCE (CVE-2023-21932)

Advisory: Reflected Cross-Site Scripting in cPanel (CVE-2023-29489)

Advisory: Multiple Vulnerabilities in Progress Ipswitch WhatsUp Gold

Bypass IIS Authorisation with this One Weird Trick - Three RCEs and Two Auth Bypasses in Sitecore 9.3

Advisory: Reflected Cross-Site Scripting in cPanel (CVE-2023-29489)

Exploiting an Order of Operations Bug to Achieve RCE in Oracle Opera

Advisory: Oracle Opera Pre-Auth RCE (CVE-2023-21932)

Finding XSS in a million websites (cPanel CVE-2023-29489)

Pre-Auth RCE in Aspera Faspex: Case Guide for Auditing Ruby on Rails

RCE in Avaya Aura Device Services

Exploiting Hardcoded Keys to achieve RCE in Yellowfin BI

Exploiting Static Site Generators: When Static Is Not Actually Static

Advisory: Server Side Request Forgery in Jira Server (CVE-2022-26135)

Breaking Bitbucket: Pre Auth Remote Command Execution (CVE-2022-36804)

Chaining vulnerabilities to criticality in Progress WhatsUp Gold

Ready to get started?