cred_scanner

credscanner A simple command line tool for finding AWS credentials in files. Optimized for use with Jenkins and other CI systems. I suspect there are other, better tools out there such as git-secrets, but I couldn't find anything to run a quick and dirty scan that also integrates well with Jenkin...

checkov

...

festin

FestIN - शक्तिशाली S3 बकेट खोजक और सामग्री खोज FestIn क्या है Festin क्यों स्थापना Python का उपयोग करके Docker का उपयोग करके पूर्ण विकल्प उपयोग खोज डोमेन कॉन्फ़िगर करें समवर्तीता HTTP क्रॉलिंग कॉन्फ़िगरेशन परिणाम प्रबंधित करें प्रॉक्सी उपयोग DNS विकल्प पूर्ण पाठ समर्थन सेवा या वॉचिंग मोड के रूप...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

CVE-2026-44578

CVE-2026-44578 — Next.js वेबसॉकेट अपग्रेड SSRF Next.js स्व-होस्टेड डिप्लॉयमेंट में प्री-ऑथेंटिकेशन सर्वर-साइड रिक्वेस्ट फॉरजरी। एक एकल क्राफ्टेड HTTP अनुरोध AWS क्रेडेंशियल्स, रहस्यों और आंतरिक सेवा डेटा को localhost:80 से निकालता है।...

slurp-1

slurp Blackbox/whitebox S3 bucket enumerator Overview Credit to all the vendor packages that made this tool possible. This is a security tool; it's meant for pen-testers and security professionals to perform audits of s3 buckets. Features Scan via domains; you can target a single domain or a list...

cred_scanner

credscanner أداة سطر أوامر بسيطة للعثور على بيانات اعتماد AWS في الملفات. مُحسَّنة للاستخدام مع Jenkins وأنظمة CI الأخرى. أعتقد أن هناك أدوات أخرى أفضل متاحة مثل git-secrets، لكنني لم أجد أداة تقوم بفحص سريع وغير دقيق وتتكامل جيدًا مع Jenkins أيضًا. الاستخدام: للتثبيت، ما عليك سوى نسخه إلى المكان...

autovpn

!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...

cve-2013-4660_PoC

Docker build Build as a vulnerable environment in Docker. docker build -f cve-2013-4660 -t cve-2013-4660 . To demonstrate how sensitive information inside the server is leaked upon a successful attack, run the container by injecting a virtual database, virtual database password, and AWS key. sudo...

CVE-2026-54356

CVE-2026-54356 — Budibase: authenticated arbitrary S3 signed upload URL issuance A low-privilege BASIC role authenticated user of a published Budibase workspace can call POST /api/attachments/:datasourceId/url and obtain an S3 pre-signed upload URL signed with the workspace datasource's server-si...

GHSA-76G3-C3X4-CRVX Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Problem Scrapy’s S3DownloadHandler sends signed S3 requests over plaintext HTTP by default. A normal request like s3://bucket/key is converted into http://bucket.s3.amazonaws.com/key unless request.meta"issecure" is explicitly set. The generated request is then signed with configured AWS...

CVE-2026-84366

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta"issecure" is...

PT-2026-84504

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.17.0 Description The S3DownloadHandler in scrapy/core/downloader/handlers/s3.py converts S3-scheme bucket and key requests into plaintext HTTP requests unless the is secure variable in request.meta is explicitly...

ANT-2026-W77T9B29 · supabase/postgres · other

other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-W77T9B29: CI downloads unverified binary then assumes production AWS role The qemu-image-build GitHub Actions...

Malicious code in @servicetitan/measure-sheet-data (npm)

npm/@servicetitan/measure-sheet-data is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized an...

MAL-2026-11720 Malicious code in @or-sdk/pgsql (npm)

npm/@or-sdk/pgsql is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

CVE-2026-58139

Affected software: DuckDB AWS extension for DuckDB. Vulnerability: security policy bypass that lets any database user with SQL execution retrieve plaintext AWS credentials by calling load_aws_credentials with redact_secret=false, bypassing the database-wide allow_unredacted_secrets=false policy. ...

Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...

CVE-2026-46412

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

Malicious code in @across-toolkit/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7f4d3a8ae39148bf9964aef6bfe64bc57393c27a28d8e953b30c92442c4b33 @across-toolkit/[email protected] runs a postinstall.js script on npm install that harvests installer-side secrets and posts them to a hardcoded...