interactsh

An OOB interaction gathering server and client library Features • Usage • Interactsh Client • Interactsh Server • Interactsh Integration • Join Discord Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external...

CPSC253_CybersecurityFinalProjectReports

Introduction These papers were part of my final project for my Cybsecurity class: CPSC 253 - Cybersecurity Foundations and Principles The premise of my final project was that I was a newly hired consultant in a research center and helped optimize their security around their server room. Phase 1 W...

janusec

Janusec Application Gateway / JANUSEC应用网关 English Readme 提供快速、安全的应用交付 介绍PPT： https://www.janusec.com/download/Janusec-Application-Gateway-CN.pdf 主要功能 JANUSEC应用网关的主要功能有： 向Web应用提供统一的安全接入，包括HTTPS、身份认证、安全防御（WAF/CC）等。如Web应用是通过K8S Pods部署的，该网关也可以作为K8S Ingress Controller使用，向Pods提供跟普通Web应用同样的接入和安全特性。...

ACME mini_httpd <1.30 - Local File Inclusion

ACME minihttpd before 1.30 is vulnerable to local file inclusion. id: CVE-2018-18778 info: name: ACME minihttpd 1.30 - Local File Inclusion author: DhiyaneshDK,dogasantos severity: medium description: ACME minihttpd before 1.30 is vulnerable to local file inclusion. impact: | Successful...

test-certs-site

test-certs-site Introduction This is a purpose-built webserver for hosting the test pages required by the CA/Browser forum Baseline Requirements. They contain the following requirement: The CA SHALL host test Web pages that allow Application Software Suppliers to test their software with Subscrib...

CVE-2026-123025

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare method decodes the dnsgcloudkey model field and directly interpolates the string fields gcloudaccount and gcloudproject into a...

EUVD-2026-117385

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare method decodes the dnsgcloudkey model field and directly interpolates the string fields gcloudaccount and gcloudproject into a...

CVE-2026-123025

An OS Command Injection vulnerability exists in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin (versions through 4.17). The root cause is the DnsGcloud::prepare() method, which decodes the dns_gcloud_key model field and interpolates the gcloud_account and gcloud_proj...

CVE-2026-115363

A flaw was found in OpenBao. When External Account Binding EAB is configured with the Automatic Certificate Management Environment ACME to manage certificates, the sanitized configuration endpoint fails to redact the EAB Message Authentication Code MAC key. An authenticated user with permission t...

CVE-2026-121434

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2026-121434 Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2026-121434

Froxlor versions 2.3.0 before 2.3.15 are vulnerable to an authorization bypass within the Certificates.add and Certificates.update API commands. The flaw exists because the system fails to verify if a domain's certificate is Let's Encrypt-managed. An attacker with API access can overwrite managed...

CVE-2026-77777

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials...

EUVD-2026-115728

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials...

CVE-2026-77777 Improper access control vulnerability

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials...

CVE-2026-121434: froxlor: Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API…

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2018-18778-Scanner

CVE-2018-18778-Scanner Scan vulnerable versions of minihttpd before 1.30. ACME minihttpd before 1.30 lets remote users read arbitrary files. Usage python3 CVE-2018-18778-Scanner.py...

CLEANSTART-2023-ID91203 ACME mini_httpd before 1

Security vulnerability affects the minihttpd package. ACME minihttpd before 1...

CLEANSTART-2026-UD05927 Let's Encrypt client and ACME library written in Go (Lego)

Security vulnerability affects the traefik package. Let's Encrypt client and ACME library written in Go Lego...

CLEANSTART-2026-WY72459 attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks

Security vulnerability affects the step-cli package. An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks...