CVE-2025-54422

Sandboxie (versions ≤ 1.16.1) exposes passwords during encrypted sandbox creation due to a password handling flaw: old/new passwords are transmitted as plaintext to the Imbox process and can be read from command-line arguments by any process in the user session. This leads to credential disclosur...

CVE-2025-54422 Sandboxie exposes encrypted sandbox key during password change

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory,...

CVE-2025-54422: Cleartext Storage of Sensitive Information

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory,...

CVE-2025-54538

In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command...

CVE-2025-54538

In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command...

CVE-2025-54538

In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command...

CVE-2025-54538

CVE-2025-54538 affects JetBrains TeamCity prior to 2025.07. The issue enables password exposure via the command line in the hg pull operation, exposing sensitive credentials under local access. The vulnerability is tied to password handling during the pull process and is documented across multipl...

CVE-2025-4056 Glib: glib crash after long command line

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines...

PT-2025-31128 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.07 Description: A security issue was identified in JetBrains TeamCity where password exposure was possible via the command line during the "hg pull" command. Recommendations: Update JetBrains TeamCity...

JetBrains TeamCity security vulnerabilities

JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from an information disclosure vulnerability that stems from an hg pull command line parameter resulting in an exposed...

SharpKatz

This is a port of the mimikatz tool, specifically the sekurlsa::logonpasswords, sekurlsa::ekeys, and lsadump::dcsync commands, to C and .NET. The tool is called SharpKatz. The tool is designed to extract sensitive information from a Windows system, including: Logon passwords Kerberos encryption...

Active-Directory-Exploitation-Cheat-Sheet

Based on the provided context and code cues, here is a summary of the analysis: Classification: This is an offensive tool for Windows Active Directory exploitation. Primary CVE ID: Not specified. Target Product/Service: Windows Active Directory. Vulnerability Class/Vector: Not specified. Probable...

isf

This is a Python-based exploitation framework called ISF Industrial Exploitation Framework that is similar to Metasploit. It is designed for industrial control system ICS exploitation and is used for testing and demonstrating vulnerabilities in ICS devices. The framework is based on the open-sour...

pathbrute

This is an exploit module/toolkit targeting web servers, specifically designed to brute force directories and files names. The tool, named "pathbrute," uses wordlists from Exploit databases and Metasploit to identify interesting content on servers, including potentially vulnerable websites. It ca...

jexboss

This is a Python script for a tool called JexBoss, which is designed to exploit vulnerabilities in JBoss Application Server and other Java platforms. The script is written in Python 2.7 and uses the urllib3 library for HTTP requests. The script has several modules, including exploits.py,...

CVE-2025-54072

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...

Infinera G42 Unauthorized Access

The vulnerability of the command-line interface of the microprogramming software for digital optical network systems Infinera G42 is related to insufficient validation of input data. Exploiting this vulnerability may allow a remote attacker to gain unauthorized access to protected information...

Juniper Networks’ Junos OS Privilege Escalation

The vulnerability of the command-line interface CLI of Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability can allow attackers to enhance their privileges...

Exploit for CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RC...

Windows Shortcut (LNK) Padding

This module generates Windows LNK shortcut file that can execute arbitrary commands. The LNK file uses environment variables and execute its arguments from COMMANDLINEARGUMENTS with extra juicy whitespace character padding bytes and concatenates the actual payload. Module Options msf use...