SCOMDecrypt

SCOMDecrypt - SCOM 資格情報復号化ツール NCC Group Plc によりオープンソースとして公開 - http://www.nccgroup.trust/ 開発者: Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/SCOMDecrypt AGPL のもとで公開されています。詳細については LICENSE を参照してください。 はじめに このツールは、Microsoft System Center Operations Manager SCO...

SharpDecryptPwd

SharpDecryptPwd このプロジェクトは更新を停止しました。リファクタリング版のソースコードプロジェクトは以下の通りです https://github.com/RowTeam/SharpDecryptPwd 概要 Windows システム上にパスワードを保存している一部のプログラムを解析します。対象：Navicat、TeamViewer、FileZilla、WinSCP、Xmangager シリーズ製品（Xshell、Xftp）。 使用方法 cmd.exe root@kitploit: SharpDecryptPwd.exe Author: Uknow Github:...

DecryptTeamViewer

DecryptTeamViewer CVE-2019-18988을 사용하여 Windows 레지스트리에서 TeamViewer 자격 증명을 열거하고 복호화합니다. 취약점 연구는 Nic Losby가 수행했습니다. 취약점에 대한 블로그 게시물: https://whynotsecurity.com/blog/teamviewer/ 사용법 .\DecryptTeamViewer.exe...

CVE-2024-22734

CVE-2024-22734 CVE-2024-22734 のエクスプロイト PoC このリポジトリには、Redline Cyber Security の Bryan Smith 氏によって発見された脆弱性 CVE-2024-22734 のエクスプロイトソース Proof of Concept PoC が含まれています。脆弱性の詳細については、弊社のブログ記事をご参照ください: CVE-2024-22734: エクスプロイト PoC 解説。 脆弱性の概要 CVE-2024-22734 は、AMCS Trux Software...

CVE-2024-53522

CVE-2024-53522 CVE-2024-53522 のエクスプロイト PoC このリポジトリには、Safecloud Co., Ltd. によって発見された脆弱性 CVE-2024-53522 の概念実証（PoC）が含まれています。脆弱性の詳細については、弊社のブログ記事をご参照ください: CVE-2024-53522: HOSxP ソフトウェア 0day の発見と悪用 脆弱性の概要 CVE-2024-53522 は、HOSxP XE https://hosxp.net/...

NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...

CVE-2026-86993

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

CVE-2026-86993

n8n is an open-source workflow automation platform. Prior to 1.123.76 , 2.37.7 , and 2.38.2 , a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check . A user with a custom global role carrying Log Streami...

CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

Malicious code in core-tailwindcss-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83 Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin which fetches JSON from the hardcoded bare-IP...

CVE-2026-66763

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...

CVE-2026-8470

IBM Langflow OSS versions 1.0.0–1.10.3 generate Fernet encryption keys from user secrets using Python’s non-cryptographic random module. The deterministic Mersenne Twister PRNG yields identical keys for identical seeds, enabling an attacker to reproduce encryption keys and decrypt stored API keys...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MAL-2026-10502 Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MAL-2026-10453 Malicious code in router-processor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d15d816c739a85908172d716580a6e4cb0655fe7b2fe35293b218db80f9b2625 [email protected] exposes a getPlugin function that assembles the URL https://svganchordev.net/icons/107 from split constants protocol, separato...

CVE-2026-55411 ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in th...

CVE-2026-55411

ToolJet prior to 3.20.1780-lts exposes a cross-tenant confidentiality flaw: authenticated users can decrypt any organization’s data-source secret via POST /api/data-sources/decrypt by supplying a credential_id, because the handler bypasses ValidateDataSourceGuard and ignores organization scoping ...