SCOMDecrypt

SCOMDecrypt - SCOM 凭据解密工具 作为开源软件由 NCC Group Plc 发布 - http://www.nccgroup.trust/ 由 Richard Warren 开发，richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/SCOMDecrypt 根据 AGPL 发布，更多信息请参阅 LICENSE 简介 该工具用于检索并解密存储在 Microsoft System Center Operations Manager SCOM 数据库中的 RunAs 凭据。...

DecryptTeamViewer

DecryptTeamViewer CVE-2019-18988を使用して、WindowsレジストリからTeamViewerの資格情報を列挙・復号します。脆弱性研究はNic Losbyによって行われました。 脆弱性の詳細を解説したブログ記事: https://whynotsecurity.com/blog/teamviewer/ 使用方法 .\DecryptTeamViewer.exe...

CVE-2024-22734

CVE-2024-22734 CVE-2024-22734 のエクスプロイト PoC このリポジトリには、Redline Cyber Security の Bryan Smith 氏によって発見された脆弱性 CVE-2024-22734 のエクスプロイトソース Proof of Concept PoC が含まれています。脆弱性の詳細については、弊社のブログ記事をご参照ください: CVE-2024-22734: エクスプロイト PoC 解説。 脆弱性の概要 CVE-2024-22734 は、AMCS Trux Software...

SharpDecryptPwd

SharpDecryptPwd 此项目不在更新，重构源码项目如下 https://github.com/RowTeam/SharpDecryptPwd 简介 对密码已保存在 Windwos 系统上的部分程序进行解析,包括：Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品（Xshell,Xftp。 使用方法 cmd.exe root@kitploit: SharpDecryptPwd.exe Author: Uknow Github: https://github.com/uknowsec/SharpDecryptPwd Reference...

NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...

CVE-2024-53522

CVE-2024-53522 CVE-2024-53522 漏洞利用 PoC 本仓库包含 CVE-2024-53522 的概念验证（PoC），该漏洞由 Safecloud Co., Ltd. 发现。有关该漏洞的详细信息，请参阅我们的博客文章：CVE-2024-53522: HOSxP 软件 0day 发现与利用 漏洞概述 CVE-2024-53522 是一个影响 HOSxP XE https://hosxp.net/ 的严重安全问题。该漏洞允许本地攻击者解密特权数据库凭据，原因是应用程序中使用了静态硬编码的私钥-IV 。 免责声明 本 PoC 仅用于教育和研究目的 。严禁将此 PoC...

CVE-2026-86993

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

CVE-2026-86993

n8n is an open-source workflow automation platform. Prior to 1.123.76 , 2.37.7 , and 2.38.2 , a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check . A user with a custom global role carrying Log Streami...

CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

Malicious code in core-tailwindcss-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83 Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin which fetches JSON from the hardcoded bare-IP...

CVE-2026-66763

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...

CVE-2026-8470

IBM Langflow OSS versions 1.0.0–1.10.3 generate Fernet encryption keys from user secrets using Python’s non-cryptographic random module. The deterministic Mersenne Twister PRNG yields identical keys for identical seeds, enabling an attacker to reproduce encryption keys and decrypt stored API keys...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MAL-2026-10502 Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MAL-2026-10453 Malicious code in router-processor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d15d816c739a85908172d716580a6e4cb0655fe7b2fe35293b218db80f9b2625 [email protected] exposes a getPlugin function that assembles the URL https://svganchordev.net/icons/107 from split constants protocol, separato...

CVE-2026-55411 ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in th...

CVE-2026-55411

ToolJet prior to 3.20.1780-lts exposes a cross-tenant confidentiality flaw: authenticated users can decrypt any organization’s data-source secret via POST /api/data-sources/decrypt by supplying a credential_id, because the handler bypasses ValidateDataSourceGuard and ignores organization scoping ...