Online Malware & URL Analysis: MalSub

Online Malware & URL Analysis malsub is a Python 3.6.x framework that wraps several web services of online malware and URL analysis sites through their RESTful Application Programming Interfaces APIs . It supports submitting files or URLs for analysis, retrieving reports by hash values, domains,...

Simple Twitter Metadata Scraper

Simple Twitter Metadata Scraper The goal of this simple python script is to analyze a Twitter profile through its tweets by detecting: Average tweet activity, by hour and by day of the week Timezone and language set for the Twitter interface Sources used mobile application, web browser, …...

PT-2018-5063

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 50 Description A previously installed malicious Android application with specific signature-level permissions can access API keys intended for Firefox. This issue is exclusive to Firefox for Android, with...

Malicious Host Intelligence: hostintel

Malicious Host Intelligence This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. Th...

datasploit - A tool to perform various OSINT techniques

A tool to perform various OSINT techniques, aggregate all the raw data, visualise it on a dashboard, and facilitate alerting and monitoring on the data. Overview of the tool: Performs OSINT on a domain / email / username / phone and find out information from different sources. Correlates and...

New Relic: Sensitive information contained with New Relic APM iOS application

An issue was reported to us against the New Relic APM iOS app. Specifically, the issue was that the release version of the application contained some sensitive information, including internal email addresses and API keys. Versions newer then 3.20.3 released Aug 28, 2015 no longer contain this...

New Relic: CSRF - Regenerate all admin api keys

Hi The request to regenerate all admin api keys is a GET request without CSRF protection. As such, you can regenerate someone's keys using csrf. While not too big of an issue the admin can always see the keys and use them its certainly annoying and can cause business disruption. Additionally, a...

RhodeCode Information Disclosure Vulnerability

RhodeCode is a set of open source code base browsing and management tools , it is embedded push/pull server , support for LDAP/AD and permission system . A security vulnerability exists in RhodeCode 2.2.6 and earlier versions. A remote attacker can exploit this vulnerability to obtain sensitive...

CVE-2015-1613

RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the 1 updaterepo, 2 getlocks, or 3 getusergroups API method...

Design/Logic Flaw

RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the getrepo API method...

PYSEC-2015-33

RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the 1 updaterepo, 2 getlocks, or 3 getusergroups API method...

Design/Logic Flaw

RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the 1 updaterepo, 2 getlocks, or 3 getusergroups API method...

PYSEC-2015-32

RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the getrepo API method...

PYSEC-2015-33

RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the 1 updaterepo, 2 getlocks, or 3 getusergroups API method...

CVE-2015-0260

RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the getrepo API method...

PT-2015-4549

Name of the Vulnerable Software and Affected Versions RhodeCode versions prior to 2.2.7 Kallithea version 0.1 Description The issue allows remote authenticated users to obtain sensitive information, including API keys, by utilizing the "get repo" API method. Recommendations For RhodeCode versions...

PT-2015-5389

Name of the Vulnerable Software and Affected Versions RhodeCode versions prior to 2.2.7 Description The issue allows remote authenticated users to obtain sensitive information, including API keys, by exploiting certain API methods. Specifically, the "update repo", "get locks", and "get user group...

Vimeo: CRITICAL full source code/config disclosure for Cameo

Hi! The server at https://ci.cameo.tv/ has directory listing on and seems to host quiet a few debian packages containing extremely sensitive information database paswords, API keys, you name it. One example is the config package containing 16 config files, even personal ones containing local...

CVE-2014-5100

Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...

PT-2014-6277

Name of the Vulnerable Software and Affected Versions Omeka versions prior to 2.2.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests, including adding a new super user account via a request to "admin/users/add", inserting cross-site scripti...