vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

CVE-2022-29464-mass

WSO2 Carbon Server CVE-2022-29464 사전 인증 RCE 버그 CVE-2022-29464. 작성자: Chocapikk trhacknon이 약간 수정함 사용법 python exploit.py -u 또는: python exploit.py -f Zoomeye Dork CLI: zoomeye search 'title:"WSO2 Management Console"' -num 10 -filter=ip,port WEB: title:"WSO2 Management Console" Google dorks...

carbon-identity-framework

carbon-identity-framework ブランチ| ビルドステータス ---|--- master| このリポジトリには、WSO2 Identity Server 製品に必要なコアコンポーネントと機能が含まれています。 ソースからのビルド ソースコードから carbon-identity-framework をビルドする場合: 1. Java 21 をインストールします。 2. Apache Maven 3.x.x をインストールします https://maven.apache.org/download.cgi 3. このリポジトリ...

autoresponder

AutoResponder Carbon Black Response IR tool for hunting threats in an environment What is it? AutoResponder is a tool aimed to help people to carry out their Incident Response tasks WITH the help of Carbon Black Response's awesome capabilities and WITHOUT much bothering IT/System/Network Teams Wh...

autoresponder

AutoResponder Carbon Black Response 환경에서 위협을 사냥하기 위한 IR 도구 무엇인가? AutoResponder는 Carbon Black Response의 놀라운 기능을 활용하여 IT/시스템/네트워크 팀을 크게 귀찮게 하지 않으면서 Incident Response 작업을 수행하는 데 도움을 주기 위한 도구입니다. 무엇을 할 수 있나요? 모듈| ✔️ / ❌ ---|--- 파일 삭제| ✔️ 레지스트리 값 삭제| ✔️ Win32 서비스 항목 삭제| ✔️ 예약된 작업 항목 삭제| ✔️ 상세 센서 목록...

jaeles-signatures

This project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine This repo only contain Default Signatures for Jaeles project. Pull requests or any ideas are welcome. Please read the Official Documentation here for writing your own signature. Installation jaeles config...

Mass-exploit-CVE-2022-29464

야옹 야옹 야옹! WSO2 Carbon Server용 Python PoC 기반 대량 익스플로잇입니다. CVE-2022-29464 사전 인증 RCE 버그 CVE-2022-29464. 야옹 야옹 야옹? 요구 사항? Python3 Shodan Zoomeye 두뇌 이 도구는 무엇인가요? 이것은 제3자가 Python으로 작성한 PoC를 기반으로 한 CVE-2022-29464의 대량 자동 스캔 익스플로잇입니다. Py 파일은 제공되며 읽을 수 있고, 인코딩된 문자열이 없는 bash 스크립트도 참조하세요. Massexploit은 셸과 리버스...

WSO2-CVE-2022-29464

WSO2 Carbon Server CVE-2022-29464 事前認証RCEバグ CVE-2022-29464。完全な技術的分析は私のブログ記事で公開予定です： https://mr-r3bot.github.io 使い方 python exploit.py -u...

WSO2-2020-0731

WSO2-2020-0731: WSO2 Carbon における XXE および XSS の脆弱性 複数の WSO2 製品において、潜在的な XXE および XSS が確認されました。 ベンダー開示情報: この脆弱性に関するベンダーの開示情報と修正は、こちら で確認できます。 CVE が無い理由? 私もベンダーも、これらの脆弱性に対する CVE を申請しませんでした。 要件: この脆弱性を悪用するには、以下が必要です： 正規の WSO2 ユーザーを説得して、悪意のあるリポジトリを追加させること または 有効なユーザー資格情報 概念実証: 詳細と悪用プロセスは、この PDF で確認できます...

MAL-005

MAL-005: WSO2 ESB の Carbon Applications 追加機能における Zip Slip WSO2 ESB の「Carbon Applications」追加機能において、ZIP ファイルに基づくディレクトリトラバーサル（Zip Slip）の脆弱性が特定されました。特定のファイルを書き込み/上書きすることで、リモートコード実行が可能になる可能性があります。 なぜ CVE がないのか？ ベンダーは、この脆弱性は「WUM で修正済み」と回答し、公開開示は行われませんでした。 要件: この脆弱性には以下が必要です： 有効なユーザー認証情報 概念実証:...

Security Bulletin: Resolved XSS vulnerability in DOMPurify (CVE-2026-75838)

Summary Carbon Charts has updated its DOMPurify dependency from ^3.4.12 to ^3.4.14, resolving CVE-2026-75838 Medium, CVSS 5.4 — an XSS vulnerability caused by improper INPLACE sanitization in DOMPurify versions prior to 3.4.13. The vulnerability affects the sanitize API used internally by Carbon...

macsurf v2.3

The modern web, on a 25-year-old Mac. A native browser for the Carbon era, Mac OS 8.6 through Mac OS X 10.6: real CSS, modern JavaScript, and HTTPS on the Mac itself. No proxy, no second machine. MacSurf 2.0.5 on a Power Mac G3 iMac, renderinghackaday.com at full desktop width over native HTTPS. ...

CVE-2025-12737

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2025-12737

CVE-2025-12737 affects WSO2 products via the Carbon Console . Administrative operations within the console do not adequately validate specific user-supplied input, allowing a threat actor with administrative privileges to inject and execute arbitrary code remotely , leading to complete compromise...

CVE-2025-12737 Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

EUVD-2025-210842

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2025-12737 Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2025-12737: Improper Neutralization of Special Elements used in an OS Command

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

PT-2026-85022

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)

Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...