Crassus

Crassus Windows privilege escalation discovery tool Quick start 1. In Process Monitor, select the Enable Boot Logging option. 2. Reboot. 3. Once you have logged in and Windows has settled, run Process Monitor once again. 4. When prompted, save the boot log, e.g., to raw.PML. 5. Reset the default...

BlockGuard

🛡️ BlockGuard — Process-Based File Access Security Agent BlockGuard is a Windows Data Loss Prevention DLP agent that intercepts and controls file access at the process level. It ensures that only authorized processes — identified by executable path, cryptographic hash, Authenticode signature, and...

bofhound

THIS REPO IS NO LONGER ACTIVE ⛔🚧 This repo is no longer maintained. To submit an issue, pull request, or obtain the lastest version, reference https://github.com/coffeegist/bofhound 🚧⛔ | / / / | /| | | | / \ | | | | | \ | | | \ | | | | | | | | | | || | | | | | | | | | | | | | .--. | | | | | | | |...

CVE-2026-120310 Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic...

CVE-2026-120310 Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic...

CVE-2026-120310

The Parse Server (versions before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 ) is vulnerable to Information Disclosure via object update responses. The root cause is that the server returns stored field values in update responses without verifying read access permissions. Consequently, clients with ...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Educational Lab 🎯 Objective Reproduce and analyze the HiveNightmare vulnerability in a controlled lab environment. 📋 Table of Contents Vulnerability Description Implementation Demonstration Lab Setup & Tools Exploitation Steps Mitigation Measures Demonstration...

Hijack-service-binaries

Hijack-service-binaries A PowerShell security auditing tool that identifies Windows service binaries that can be modified by the current user—a potential privilege escalation vector. Overview This script scans all Windows services except system32 and svchost and checks if the current user has...

snowpick

snowpick is a ServiceNow exposure scanner that finds misconfigured widget ACLs, REST API access controls, and unauthenticated data exposure. ServiceNow exposes data through two common public surfaces: Service Portal widgets and the Table REST API. When access controls on either surface are...

CVE-2026-119707

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents,...

CVE-2026-119707 SonicJS through 3.0.0 Missing Authorization in Content Write API

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents,...

CVE-2026-119707

SonicJS versions through 3.0.0 are vulnerable to a missing authorization vulnerability (CWE-862) within the /api/:collection and /api/content write routes. The root cause is that these routes only perform coarse role label checks, failing to validate specific document permissions. This allows aut...

PT-2026-133641

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents,...

CVE-2026-112256

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and...

EUVD-2026-113003

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and...

CVE-2026-112256

OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 are vulnerable to a logon bypass due to the acceptance of extraneous untrusted data with trusted data (specifically, an attacker-controlled completed-methods list ). Thi...

CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list)

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and...

CVE-2026-115712

Incorrect Authorization CWE-863 in Elastic Cloud Enterprise ECE can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with read-only access to the platform can change an installation-wide accoun...

CVE-2026-115712

A security vulnerability in Elastic Cloud Enterprise (ECE) allows for Incorrect Authorization (CWE-863). An authenticated user with only read-only access can bypass intended Access Control Lists (ACLs) to modify installation-wide account settings that should be restricted to platform administrato...

CVE-2026-115712 Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings

Incorrect Authorization CWE-863 in Elastic Cloud Enterprise ECE can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with read-only access to the platform can change an installation-wide accoun...