172 matches found
Cr3dOv3r
Cr3dOv3r Your best friend in credential reuse attacks. You give Cr3dOv3r an email then it does two simple useful jobs with it: Search for public leaks for the email and returns the result with the most useful details about the leak Using haveibeenpwned API and tries to get the plain text password...
spark-jdbc-serde-url
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-jdbc-serde-url spark-jdbc-serde-url Class: JDBC URL injection Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation SPARK-31710 stopped scan-time extra options from overriding a stored JDBC url...
credmap
credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...
CVE-2025-14269
CVE-2025-14269 A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with...
CVE-2026-87861
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...
SUSE CVE-2026-87861
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...
credmap
credmap: El Mapeador de Credenciales Credmap es una herramienta de código abierto creada para concienciar sobre los peligros de la reutilización de credenciales. Es capaz de probar las credenciales de usuario proporcionadas en varios sitios web conocidos para comprobar si la contraseña ha sido...
pentest_teamcity
Pentest TeamCity usando Metasploit TL;DR: Obtener contraseñas deJetBrains IDE como IntelliJ o PyCharm y usar esas credenciales dentro de TeamCity Continuous Integration Server para obtener una sesión de meterpreter en el servidor y agentes de compilación usando metasploit por Kacper Szurek...
CVE-2026-103868
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username,...
CVE-2026-103868 Pulp-container: registry credentials are reused across remotes in a worker
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username,...
EUVD-2026-94170
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username,...
CVE-2026-103868 Pulp-container: registry credentials are reused across remotes in a worker
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username,...
CVE-2026-103868
A flaw in pulp-container allows for the reuse of registry credentials across different remotes within the same worker during authentication to an upstream registry. Specifically, Basic and bearer credentials from one remote are incorrectly reused for subsequent downloads. An attacker who can sync...
CVE-2026-103868
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username,...
CVE-2026-103868: Exposure of Data Element to Wrong Session
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username,...
PT-2026-107393
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username,...
CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS6:CLSA-2026:1774276586)
The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1774276586 advisory. - curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for th...
EUVD-2026-83049
CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable acro...
CVE-2026-54547 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...
