barrido

barrido Console utility to find web application paths. Still in alpha version. Examples Multiple URLs bruteforcing: root@kitploit: $ cat urls.txt https://target.a.com https://target.b.com https://target.c.com $ barrido urls.txt wordlists/quickhits.txt -se | tee curiouspaths.txt...

attack_monitor

Attack Monitor Attack Monitor 是一个用 Python 编写的应用程序，旨在增强 Windows 7/2008（及所有更新版本）工作站/服务器的安全监控能力，并自动化恶意软件的动态分析。 当前模式（互斥）： 端点检测 ED 恶意软件分析（在专用虚拟机上） 基于以下来源的事件： Windows 事件日志 Sysmon Watchdog（文件系统监控 Python 库） TShark（仅恶意软件分析模式） 当前版本 0.9.0 Alpha 联系方式 [email protected] 演示 支持的操作系统 Windows 7、8、10（x86 或 x64...

fuxi

Fuxi 2.1 - 开发中 Fuxi 是跨平台兼容的，适用于任何 Python 3.x 环境，包括 Linux、macOS 和 Windows。 开始使用 Docker root@kitploit: docker pull jeffzh3ng/fuxi docker run -itd --name fuxidocker -p 5000:50020 jeffzh3ng/fuxi:latest 等待约 15 秒服务启动后，访问：http://127.0.0.1:5000 默认用户名：fuxi 默认密码：whoami 应用重启：docker restart fuxidocker 如何持久化数...

reternal-quickstart

RE:TERNAL Hinweis: Noch in Entwicklung, nur zu Testzwecken verwenden und keine Schnittstellen freigeben! Das aktuelle Compose funktioniert noch nicht, nur versuchen, wenn Sie wissen, was Sie tun RE:TERNAL ist ein zentralisierter Purple-Team-Orchestrierungsdienst zur Verwaltung von C2-Frameworks...

CVE-2026-21862

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy...

CVE-2026-24762 RustFS Logs Sensitive Credentials in Plaintext

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material access key, secret key, session token to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be...

CVE-2026-21862 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy...

CVE-2026-21862

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy...

EUVD-2026-5219

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy...

CVE-2025-57396

Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or administrative. Consequently, any user can escala...

CVE-2025-57396

Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or administrative. Consequently, any user can escala...

CVE-2025-57396

CVE-2025-57396 affects Tandoor Recipes 2.0.0-alpha-1. The vulnerability arises from the User Profile API Endpoint, which contains two boolean values indicating whether a user is staff or administrative. This misconfiguration allows any user to escalate privileges to the highest level. The issue i...

Apache Hive 代码注入漏洞

Apache Hive is a set of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. A code...

CVE-2024-28867

Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies un-sanitized string values into metric names or labels, an attacker could make use of this and send a ?lang query parameter containing newlines, or similar...

CVE-2023-36123

Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive information...

MindSpore 缓冲区错误漏洞

MindSpore is a new open source deep learning training/inference framework open-sourced by MindSpore. It can be used in mobile, edge and cloud scenarios. A buffer error vulnerability exists in MindSpore version 2.0.0-alpha, 2.0.0-rc1. An attacker exploited the vulnerability to cause memory...

Virtuozzo Hybrid Server 9 Alpha

The purpose of Virtuozzo Hybrid Server 9 alpha is to demonstrate the work in progress. The alpha version offers a few new features and supports creating virtual machines and containers with a limited number of guest operating systems...

CVE-2021-40532

Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension...

CVE-2021-36081

Tesseract OCR 5.0.0-alpha-20201231 has a oneellconflict use-after-free during a strpbrk call...

UBUNTU-CVE-2021-3421

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This...