157 matches found
phishlulz
PhishLulz PhishLulz is a Ruby toolset aimed at automating Phishing activities. When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are: PhishingFrenzy...
SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Service Management Data Center
This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...
PYSEC-2026-2924 PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
Summary passthrough and apassthrough in praisonai accept a caller-controlled apibase parameter that is concatenated with endpoint and passed directly to httpx.Client.request when the litellm primary path raises AttributeError. No URL scheme validation, private IP filtering, or domain allowlist is...
GHSA-HCHG-QM84-CJ9P Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint
A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...
Aider 代码问题漏洞
Aider is an open-source terminal AI pair programming tool developed by Aider AI. Version 0.86.3 of Aider contains a code vulnerability. This vulnerability stems from the requests.get operation in the apidocs.py file of the AWS EC2 Metadata Endpoint, which leads to server-side request forgeing...
CVE-2022-23511
A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM...
CVE-2025-62375 go-witness Improper Verification of AWS EC2 Identity Documents
go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is...
EUVD-2017-9233
Malware in sbrugna...
EUVD-2017-8039
Malware in sbrugna...
EUVD-2022-5202
Malicious code in bioql PyPI...
EUVD-2022-5524
Malicious code in bioql PyPI...
EUVD-2022-4923
Malicious code in bioql PyPI...
EUVD-2022-3396
Malicious code in bioql PyPI...
EUVD-2021-7539
Malicious code in bioql PyPI...
EUVD-2022-3533
Malicious code in bioql PyPI...
EUVD-2022-5512
Malicious code in bioql PyPI...
EUVD-2022-4268
Malicious code in bioql PyPI...
CVE-2021-20077
Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token...