CVE-2026-62865

Typebot (open-source chatbot builder), in self-hosted versions prior to 3.18.0 , allows arbitrary local file read through the server-side Send Email integration block. The parseAttachments helper treats any attachment value not matching the application's base URL as a filesystem path, and the Nod...

CVE-2026-65087

NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2018-9995-ModifiedByGwolfs

वक्तव्य यह टूल gwolfs द्वारा लिखे गए CVE-2018-9995 का बेहतर संस्करण है, और केवल सीखने के उपयोग के लिए है। अवैध उद्देश्यों के लिए उपयोग न करें, इससे उत्पन्न होने वाले सभी परिणाम आपके अपने हैं। मूल संस्करण ezelf द्वारा लिखा गया है और https://github.com/ezelf/CVE-2018-9995dvrcredentials पर है। ezelf...

CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79780

rclone before v1.75.0 contains a credential exposure vulnerability in its S3 redirect callback handling. The tool fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys when following redirects, allowing credentials to persist across scheme or host changes . An attacker positioned to o...

CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79779 rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to...

CVE-2026-79779

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to...

CVE-2026-79776 rclone before 1.75.0 Authentication Bypass via pprof

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

CVE-2026-79776

rclone before 1.75.0 mounts its pprof debug handler as a standalone router route, bypassing the fail-closed authentication rule applied by the main handler. An unauthenticated attacker can access the /debug/pprof/cmdline endpoint over the network to retrieve the full process argv , which includes...

EUVD-2026-65534

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

EUVD-2026-65531

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

curl: ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

cleanarg operates on char str, which is the UTF-8 copy allocated by converttchartoUTF8. It has no reference to the original wchart argv element. c / toolgetparam.c:632 / static void cleanargchar str / now that getstr has copied the contents of nextarg, wipe the next argument out so that the...

CVE-2024-4879

CVE-2024-4879 CVE-2024-4879.py é um script Python projetado para detectar vulnerabilidades específicas em instâncias ServiceNow e extrair detalhes de conexão do banco de dados se a vulnerabilidade for encontrada. Esta ferramenta é particularmente útil para pesquisadores de segurança e testadores ...

CVE-2025-51643

CVE-2025-51643: Flash SPI non protetto consente l'estrazione del firmware in Meitrack T366G-L Descrizione I dispositivi Meitrack T366G-L GPS Tracker contengono un chip di memoria flash SPI Winbond 25Q64JVSIQ accessibile senza autenticazione o protezione anti-manomissione. Un attaccante con access...

HTC

Hack The CCTV Credenziali DVR esposte | CVE-2018-9995 | Nome utente CCTV divulgato per ottenere accesso di login Come Usare? root@kitploit: Apri https://www.zoomeye.org/ Cerca questa parola chiave '/login.rsp' Attendi per ottenere IP e Porta $ python3 thecctv.py Maggiori Informazioni OS|...

CVE-2024-0368

CVE-2024-0368 Il plugin Hustle = 7.8.3 contiene credenziali dell'API HubSpot hardcoded in inc/providers/hubspot/hustle-hubspot-api.php Riepilogo della vulnerabilità...

EUVD-2026-64890

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2017-8225-EXPLOIT

CVE-2017-8225 - Vazamento do System.ini do GoAhead Esta vulnerabilidade diz respeito a dispositivos Wireless IP Camera P2P WIFICAM. Ela decorre de uma falha na validação correta de arquivos .ini, que armazenam credenciais críticas. Um atacante habilidoso pode explorar isso fornecendo valores vazi...