iCULeak.py

iCULeak.py Cisco CUCMCall Manager으로 관리되는 환경에서 전화 구성 파일로부터 자격 증명을 찾고 추출하는 도구입니다. Cisco CUCMCall Manager을 사용할 때 전화 구성 파일은 TFTP 서버에 저장됩니다. 이러한 VoIP 전화 구성 파일에는 전화 SSH/관리자 자격 증명을 포함한 민감한 데이터가 자주 포함됩니다. 또한 일부 브라우저가 SSH 사용자 이름 및 비밀번호 필드를 CUCM 자격 증명일반적으로 AD 자격 증명으로 자동 채우는 문제가 있습니다. 관리자가 브라우저에 자격 증명을 저장한 ...

CVE-H3C-Report

H3C GRシリーズルーターのシステム管理に未認証アクセスの脆弱性 製品 : GRシリーズルーター バージョン : 全て 評価 : 高リスク ウェブサイト : http://www.h3c.com/ 危険性 : 攻撃者はこの脆弱性を悪用し、特別なリクエストパケットを構築して身元確認をバイパスすることで、ルーターから機密情報を取得する可能性があります。 原理 : ルーターがディレクトリアクセスおよび関連ファイルの認証を行っていないため。 exp : 注: POC内のファイル名の拡張子を変更する必要があります（例: GR8300.cfg）。 root@kitploit: GET...

claudleak

claudleak 扫描公共GitHub仓库中AI编码工具配置文件（.claude/、.cursor/、.continue/、.codex/、CLAUDE.md、AGENTS.md等）中的泄露凭证。 使用TruffleHog进行秘密检测。 示例.claude/目录： root@kitploit: "permissions": "allow": "Bashgo build:", "BashRAPID7ENCRYPTEDCREDS='eP3g488hQ23QiU4kJahhwPKs3PyE' go test ./pkg/agents/ -run TestRules -v -count=1...

XWiki Platform - Information Disclosure

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. id: CVE-2025-55747 info: name: XWiki Platform - Information Disclosure author: Redmomn...

CVE-2026-84202

A flaw was found in ModelScope. This vulnerability arises from the use of PyYAML's unsafe yaml.Loader when parsing model configuration files. A remote attacker can exploit this by crafting malicious model repositories containing poisoned configuration files. When these files are loaded by a user,...

GHSA-Q6HH-GP44-4HCM Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Summary Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process. Impact All wings users who have an egg with a non-file parser configuration file setting...

MAL-2026-11127 Malicious code in app-sima-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a34ad4e52b9e8255bcfa74cbb6aa18811b0c8d80819a75c6bbfc36d79757b66 The package's postinstall script performs three coordinated attacks against the installer at install time. First, on Linux it fetches an SSH public k...

JLSEC-2026-782

A flaw was found in libssh. A remote attacker, by controlling client configuration files or knownhosts files, could craft specific hostnames that when processed by the matchpattern function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion,...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

Malicious code in app-data-ist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...

MAL-2026-10742 Malicious code in node-as-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 616f74a5722026c25913e644651f1edc57ccb3ca2a6145c1543ff802b3b883b9 On npm install, package.json's postinstall hook runs node test.js, which loads index.js and immediately invokes two harvest routines. The first...

MAL-2026-10594 Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

MAL-2026-10592 Malicious code in stripedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b1bd48eb1fe3b563d9950f59df7fcfe699d0f1b51820c47b721f59ee74af34 package.json declares postinstall: node.init.js, which runs automatically on npm install. The script enumerates 60 credential and CI-token environmen...

Malicious code in polymarket-mcp-v2 (npm)

polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on npm install. It steals Solana keypairs, .env secrets and other credential files, and installs an attacker-controlled SSH key into /.ssh/authorizedkeys, then opens port 22 for persistent access. Any...

CVE-2026-49145

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include...

AgentScope path traversal vulnerability in save-workflow

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of...

Malicious code in hunsterx-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32f2430d6e0da9484283d0012a16df0c593ccb5fa2a56ea727bd19ba435f964f preinstall.js executes a chain of evalBuffer.from'','base64'.toString payloads at npm install time. The decoded payloads collect host identity...

PT-2026-51640

Name of the Vulnerable Software and Affected Versions mise versions prior to 2026.6.4 Description A flaw in the trust mechanism allows arbitrary command execution when a directory contains task-include directories such as mise-tasks/, .mise/tasks/, etc. but lacks a configuration file. In this...

[SECURITY] Fedora 44 Update: perl-Config-IniFiles-3.001000-1.fc44

Config::IniFiles provides a way to have readable configuration files outside your Perl script. Configurations can be imported inherited, stacked,..., sections can be grouped, and settings can be accessed from a tied hash...

EUVD-2026-36644

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...