132 matches found
Cr3dOv3r
Cr3dOv3r Your best friend in credential reuse attacks. You give Cr3dOv3r an email then it does two simple useful jobs with it: Search for public leaks for the email and returns the result with the most useful details about the leak Using haveibeenpwned API and tries to get the plain text password...
credmap
credmap: El Mapeador de Credenciales Credmap es una herramienta de código abierto creada para concienciar sobre los peligros de la reutilización de credenciales. Es capaz de probar las credenciales de usuario proporcionadas en varios sitios web conocidos para comprobar si la contraseña ha sido...
credmap
credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...
pentest_teamcity
Pentest TeamCity usando Metasploit TL;DR: Obtener contraseñas deJetBrains IDE como IntelliJ o PyCharm y usar esas credenciales dentro de TeamCity Continuous Integration Server para obtener una sesión de meterpreter en el servidor y agentes de compilación usando metasploit por Kacper Szurek...
CVE-2025-14269
CVE-2025-14269 A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with...
htb-labs-nexus
🏴☠️ HTB Labs - Nexus English 🇺🇸 | Español 🇪🇸 English | Español 📋 Overview Nexus is an Easy-difficulty Linux machine from Hack The Box that demonstrates a multi-stage attack chain involving virtual host enumeration, exposed credentials, vulnerable web application functionality, remote code...
CVE-2026-50199
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/updateexchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...
libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials
A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...
EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-2962)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one,...
Security Bulletin: consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...
CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...
CVE-2026-16498
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
CVE-2026-16498
The terraform-mcp-server package is affected up to version 1.0.x; in the streamable-HTTP stateless transport mode, a cross-tenant credential reuse vulnerability allows one user’s Terraform token to be used to execute tool calls for subsequent users. Root cause: improper isolation between tenants ...
EUVD-2026-49941
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
PT-2026-65551
Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A cross-tenant credential reuse issue exists in the streamable-HTTP stateless transport mode. This flaw may allow a Terraform token belonging to one user to be reused to execute tool cal...
CVE-2026-64391 ksmbd: use opener credentials for ADS I/O
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...
FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices
Key Takeaways FortiBleed refers to June 2026 public reporting of large-scale credential exposure and abuse targeting internet-reachable FortiGate management and SSL-VPN gateways driven by credential reuse and brute-force, not a single new zero-day. Risk is highest for internet-exposed FortiGate...
CVE-2026-9079
A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...
