130 matches found
CVE-2025-26199
🛡️ CVE-2025-26199 — CloudClassroom-PHP-Project v1.0 通过明文不安全地传输密码 📄 描述 CloudClassroom-PHP-Project v1.0 存在用户凭证不安全传输的漏洞。在身份验证过程中，密码通过未加密的 HTTP 而非 HTTPS 提交。这会将敏感信息（即用户名和密码）暴露给网络攻击者，攻击者可通过数据包嗅探或中间人（MitM）攻击进行拦截。 如果攻击者捕获了有效的管理员凭证，他们可能会登录系统，并可能利用应用程序的其他功能（例如文件上传或远程 shell 注入）实现远程代码执行，具体取决于部署环境和系统配置。 📦 受影响产...
Hawk
Hawk 实时静默拦截 SSH 和 SU 凭据 Hawk 监控 sshd 和 su 进程，通过 ptrace 从内存中提取密码，不修改目标进程。零写入。纯只读凭据收集。 演示 工作原理 Hawk 利用 Linux 的 /proc 文件系统发现 SSH 和 SU 进程，然后使用 ptrace 附加并拦截系统调用。当密码认证发生时，它在 write 系统调用期间直接从进程内存读取密码——对目标进程完全透明。凭据通过 webhook 外泄或打印到 stdout。 深入探讨： 博客文章 构建 root@kitploit: GOOS=linux GOARCH=amd64 CGOENABLED=0 ...
CVE-2026-51954
产品： Webasyst Framework 受影响版本： ≤ 4.0.3 严重性： 高（CVSS 3.1：8.0） 描述 Webasyst Framework 至 4.0.3 版本存在一个 OAuth 2.0 实现缺陷，允许远程未认证攻击者截获 OAuth 流程期间签发的授权凭据，而受害者除正常授权批准外无需执行任何操作。由于验证不当，攻击者可获取永久 API 访问令牌，并获得对受害者整个 Webasyst 账户的完全、无限制 API 访问权限。 致谢 Saleh Alghamdi Abdulrahman Aldossary...
ldap-swak
LDAP 瑞士军刀 多功能 LDAP 服务器工具。 可快速搭建用于测试目的的 LDAP 服务器、用于拦截明文或转发 NTLM 凭据的 MitM 代理，或利用各种 Java JNDI/LDAP 客户端漏洞。 作者：Moritz Bechler（[email protected]） 项目仓库：https://github.com/SySS-Research/ldap-swak 构建 需要 Maven。 mvn package verify - target/ldap-swak-0.0.5-SNAPSHOT-all.jar 运行 直接使用相应的子命令和选项运行 JAR 文件：...
CVE-2025-63820
CVE-2025-63820 提交者：Nicola Giuffrida 信息 厂商： TOTOLINK 厂商网站： TOTOLINK 型号： A720R 固件版本： V4.1.5cu.630B20250509 固件下载地址： TOTOLINK 漏洞详情 登录控制面板时，用户名和密码以明文形式发送： root@kitploit: POST /cgi-bin/cstecgi.cgi HTTP/1.1 Host: 192.168.0.1 Content-Length: 73 X-Requested-With: XMLHttpRequest Accept-Language:...
CVE-2025-70342
CVE-2025-70342：通过 erase-install 中的命名管道截获凭据 概述 早于 v40.4（提交 2c31239）的 erase-install 会将 swiftDialog 的凭据输出写入硬编码路径 /var/tmp/dialog.json。在 Apple Silicon Mac 上，重新安装/擦除操作期间输入的管理员凭据会写入这个可预测且全局可写的位置。本地非特权攻击者可以在此路径创建命名管道（FIFO），实时截获管理员凭据。 受影响版本 存在漏洞： erase-install /dev/null "$dialogoutput" 在 Apple Silicon Ma...
teamcity-idea-cve-2020-35667-poc
TeamCity IntelliJ IDEA 插件凭据截获（CVE-2020-35667） 快速链接 概念验证报告 | 工作流分析 | 服务器脚本 描述 这是通过构建一个伪造的 XML-RPC TeamCity 端点 来复现 CVE-2020-35667 的演示。 CVE-2020-35667 是 JetBrains TeamCity IntelliJ 插件中的一个 SSRF 漏洞 。 旧版 TeamCity IntelliJ 插件会向服务器请求一个公钥，使用该公钥对密码进行加密，然后将其发送回去。 由于服务器是由攻击者控制的，因此攻击者可以解密并记录明文凭据。 该漏洞由 Jonatha...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...
CVE-2026-13327
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
CVE-2026-13327
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
CVE-2026-13327
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
EUVD-2026-79189
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
PT-2026-92412
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
CVE-2026-13327: Improper Certificate Validation
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...
CVE-2026-87872
A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an http...
CVE-2026-33389
An improper certificate/host key validation vulnerability exists in the Smart Polling functionality of Nozomi Networks Guardian/CMC (before 26.3.0 ) and Nozomi Networks Arc (before v2.7.0 ). Encrypted connections to polled devices were established without validating the remote host's identity, an...
EUVD-2026-72787
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...
PT-2026-87077
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...