396 matches found
shhgit
🚨 shhgit 已不再维护。如果你需要秘密扫描方面的支持或咨询，请给我发邮件 [email protected] 🚨 shhgit 通过在其代码中发现秘密，在导致安全漏洞之前，帮助有远见的开发、运营和安全团队确保安全。 意外泄露机密——用户名和密码、API 令牌或私钥——到公共代码仓库中，是开发者和安全团队最可怕的噩梦。欺诈者不断扫描公共代码仓库以寻找这些秘密，从而获得系统立足点。代码比以往任何时候都更互联，因此这些秘密常常提供对私密和敏感数据的访问——例如云基础设施、数据库服务器、支付网关和文件存储系统等。 shhgit 可以持续扫描你的代码仓库，发现并提醒你这些秘密。 安...
EvilSlackbot
EvilSlackbot Slackワークスペース内でレッドチームおよびフィッシング演習を実施するためのSlack攻撃フレームワークです。 免責事項 このツールはセキュリティ専門家のみを対象としています。明示的なテスト許可なしに、いかなるSlackワークスペースに対してもこのツールを使用しないでください。自己責任で使用してください。 背景...
Windmill < 1.603.3 - SQL Injection
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...
github-endpoints
github-endpoints 在 GitHub 上查找端点。 描述 该 Go 工具在 GitHub 上执行搜索并解析结果，以查找指定域名的端点。 安装 go install github.com/gwen001/github-endpoints@latest 或 git clone https://github.com/gwen001/github-endpoints cd github-endpoints go install 用法 $ github-endpoints -h Usage of github-endpoints: -all displays urls of all...
EUVD-2026-88567
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...
CVE-2026-102334
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...
CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...
CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...
CVE-2026-102334
Nginx Proxy Manager versions through 2.16.0 are vulnerable to brute-force attacks due to a lack of rate-limiting on authentication endpoints. Unauthenticated attackers can make unlimited password guesses via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa . Successful ...
CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...
CVE-2023-6289
CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - 認可不足による未認証の設定エクスポート 説明 WordPress用プラグインSwift Performance Liteは、バージョン2.3.6.14まで（同バージョンを含む）のすべてのバージョンにおいて、admininit関数を介してフックされた機能でケイパビリティチェックが欠如しているため、不正なデータアクセスに対して脆弱です。これにより、未認証の攻撃者がプラグインの設定（Cloudflare APIトークンを含む可能性がある）をエクスポートすることが可能になります。 Severity...
PT-2026-96153
Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260718 Description Authenticated non-administrator users can list and download system-configuration backups due to a missing administrator check in the endpoints 'scripts/lua/rest/v2/get/system/configurations/list...
CVE-2026-76672
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint...
CVE-2026-76672 Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint...
EUVD-2026-78773
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...
CVE-2026-91942: Improper Neutralization of Input During Web Page Generation
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...
CVE-2026-76672: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint...
CVE-2026-89151
A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...