{"uuid": "17f6433d-f20a-47da-bd0f-4b8223716b52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1388", "type": "seen", "source": "https://t.me/bhhub/856", "content": "#BugBountyTips of the Day\nThis is the cutest video I've received from my #bugbounty friends. Thank you all for your wishes. Much love everyone. This community is AWESOME. \u2764\ufe0f  https://t.co/07aQXlgBw7\n---\nJust Tool for checking and exploit BIG-IP iControl REST vulnerability CVE-2022-1388 (RCE) mode: - single - mass  Link:  https://t.co/epzOzfkwnS LAB:  https://t.co/snsnEgMKpa  #CVE #CVE20221388 #F5 #bugbounty #bugbountytips #infosec #zeroday #0day  https://t.co/RlqQJs75Sy\n---\nHere is my first valid \"Exceptional\" report on @intigriti \ud83d\udd25  Found a public Jenkins instance with enabled /script (developer console). This means it runs directly RCE on the application.  shodan dork: ssl:target 200  http.title:\"Dashboard [Jenkins]\" #bugbounty #bugbountytips  https://t.co/2dvH1gRi64\n---\nUnauthorized  {\u201cid\u201d:111}\u27f6 401 Unauthorized {\u201cid\u201d:{\u201cid\u201d:111}} \u27f6 200 OK POST /api/get_profile Content-Type: application/json {\u201cuser_id\u201d:<attacker_id>,\u201duser_id\u201d:<victim\u2019s_id>} GET /api_v1/messages?user_id=VICTIM_ID \u27f6 401  #bugbounty #bugbountytips  1/n", "creation_timestamp": "2022-05-14T13:37:04.000000Z"}