Research Notes

Recent Research

Security Research

New!

Ready to get started?

Get on a call with our team and learn how Assetnote can change the way you secure your attack surface. We'll set you up with a trial instance so you can see the impact for yourself.

Request a Demo

Address:
Level 10, 12 Creek Street, Brisbane QLD, 4000
‍
Contact:
contact@assetnote.io

Press Inquiries:
press@assetnote.io

Platform Features

Continuous Asset Discovery

Deep Asset Enrichment

Assetnote Exposure Engine

Expert Security Research

Collaborative Workflows

Customization

Use Cases

Continuous Asset Discovery and Inventory

Real-Time Exposure Monitoring

Attack Surface Reduction

Mergers & Acquisitions

Bug Bounty Readiness

Nginx/Apache Path Confusion to Auth Bypass in PAN-OS (CVE-2025-0108)

How an obscure PHP footgun led to RCE in Craft CMS

Citrix Denial of Service: Analysis of CVE-2024-8534

Security Advisories

Advisory: Next.js SSRF (CVE-2024-34351)

Advisory: Progress WS_FTP RCE (CVE-2023-40044)

Advisory: Flarum LFI - CVE-2023-40033

Advisory: Metabase Pre-Auth RCE (CVE-2023-38646)

Advisory: ShareFile Pre-Auth RCE (CVE-2023-24489)

Advisory: Citrix Gateway Open Redirect and XSS (CVE-2023-24488)

Advisory: Oracle Opera Pre-Auth RCE (CVE-2023-21932)

Advisory: Reflected Cross-Site Scripting in cPanel (CVE-2023-29489)

Advisory: Multiple Vulnerabilities in Progress Ipswitch WhatsUp Gold

How an obscure PHP footgun led to RCE in Craft CMS

Citrix Denial of Service: Analysis of CVE-2024-8534

Nginx/Apache Path Confusion to Auth Bypass in PAN-OS (CVE-2025-0108)

Leveraging An Order of Operations Bug to Achieve RCE in Sitecore 8.x - 10.x

Insecurity through Censorship: Vulnerabilities Caused by The Great Firewall

Chaining Three Bugs to Access All Your ServiceNow Data

Why nested deserialization is harmful: Magento XXE (CVE-2024-34102)

Advisory: Next.js SSRF (CVE-2024-34351)

Digging for SSRF in NextJS apps

Two Bytes is Plenty: FortiGate RCE with CVE-2024-21762

Continuing the Citrix Saga: CVE-2023-5914 & CVE-2023-6184

Ivanti's Pulse Connect Secure Auth Bypass Round Two

Ready to get started?