IAM Proxy Component Compromise Information Disclosure

The vulnerability of the IAM Proxy component of the Identity & Access Management tool in Platform V IAM is related to synchronization errors when using a common resource. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

Blitz Identity Provider (Authentication server)

...

WhoCord

WhoCord An interactive OSINT canvas that grows with every discovery. Start with a seed — a Discord user, username, email, domain, phone, image, or URL — and watch the map build itself in real time. Screenshots Gallery: 1 · 2 · 3 | ---|--- | 1. Start page| 2. Canvas with details panel | 3. Multipl...

osint-pattern-analyzer

OSINT Pattern Analyzer Tool for automating OSINT investigations across multiple identity vectors phone numbers, usernames and future email support, designed to extract structured data and enable pattern detection and correlation analysis. Features Phone OSINT Search phone numbers across multiple...

slsa

SLSA "salsa" is Supply-chain Levels for Software Artifacts SLSA pronounced "salsa" is a security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. It’s how you get from safe enough to bein...

nexus-os

Nexus OS The Governed Agentic AI Operating System 66 Crates | 675 Commands | 86 Pages | 5,229 Tests | 10/10 OWASP | Zero Stubs Local-first. Air-gappable. Post-quantum ready. Built in Rust. Architecture | Quick Start | Features | Audit Status | Docs Nexus OS is an AI agent operating system where...

browser-identity-attacks-matrix

Browser & Identity Attacks Matrix This repository is a collection of browser and identity attack techniques covering SaaS apps, browser-based attacks, identity providers, and phishing. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about...

CVE-2026-100252

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...

GitFive

🐍 Now Python 3.13 compatible ! Description GitFive is an OSINT tool to investigate GitHub profiles. Main features : Usernames / names history Usernames / names variations Email address to GitHub account Find GitHub's accounts from a list of email addresses Lists identities used by the target Clon...

conjur

Conjur Maintainability Test Coverage Conjur provides secrets management and application identity for modern infrastructure: Machine Authorization Markup Language "MAML" , a role-based access policy language to define system components & their roles, privileges and metadata A REST web service to:...

The Hitchhikers Guide to Online Anonymity

The comprehensive guide for online anonymity and OpSec. Welcome. The purpose: providing an introduction to various online tracking techniques, online ID verification techniques, and detailed guidance to creating and maintaining truly anonymous online identities. It is written with hope for...

ziti

OpenZiti OpenZiti is an open-source zero-trust networking platform that makes network services invisible to unauthorized users. Every connection, whether from a user, a service, a device, or a workload, is authenticated with cryptographic identity, authorized by policy, and encrypted end-to-end...

agent-bom

AI supply-chain BOM: every agent, MCP server and AI package, and what each one can reach. For AppSec teams and developers who run Claude Code, Cursor, Codex or any MCP client: see which agents, MCP servers, tools and packages are installed, which are vulnerable, and what each one can reach. Local...

TokenTacticsV2

/ / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku. Azure JSON Web...

CVE-2025-11229

WSO2 Identity Server is vulnerable to a privilege escalation flaw when the authorize_all_scopes configuration is enabled. The system fails to properly enforce scope authorization, allowing applications using the client credentials grant type to obtain all API scopes—including sensitive internal a...

PurpleCloud

Documentation Terraform code generator to create different Azure security labs. For full documentation visit: https://www.purplecloud.network Changelog 10/18/24: Updated Azure Sentinel Generator Updated AADDiagnostic Setting log categories On sentinel.py: Added more categories for logging and...

EntraGoat

EntraGoat - A Deliberately Vulnerable Entra ID Environment EntraGoat is a deliberately vulnerable Microsoft Entra ID infrastructure for security professionals. Deploy real-world identity misconfigurations and privilege escalation paths in your own tenant, then practice exploiting them in a safe,...

agent-governance-toolkit

🌍 English | Español | 日本語 | 简体中文 | 한국어 | 繁體中文 Agent Governance Toolkit Ship agents to production without losing sleep 🚀Quick Start · 📋 Specifications · 📦 PyPI · 📝 Changelog -brightgreen !IMPORTANT Public Preview -- production-quality public preview releases...

FortiOS - Insecure LDAP Configuration Detection

The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions. id: CVE-2019-5591 info: name: FortiOS -...

VMware Workspace ONE Access - Authentication Bypass

VMware Workspace ONE Access has two authentication bypass vulnerabilities CVE-2022-22955 & CVE-2022-22956 in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework. id: CVE-2022-22956...