FortiOS - Insecure LDAP Configuration Detection

The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions. id: CVE-2019-5591 info: name: FortiOS -...

CVE-2024-0368

CVE-2024-0368 Hustle Plugin = 7.8.3 contains hardcoded HubSpot API credentials in inc/providers/hubspot/hustle-hubspot-api.php Vulnerability Summary Field| Value ---|--- CVE ID| CVE-2024-0368 Title| Hustle = 7.8.3 - Sensitive Information Exposure via Exposed HubSpot API Keys CVSS Score| 8.6 High...

CVE-2025-24071

CVE-2025-24071 This Python script is designed to demonstrate the CVE-2025-24071 vulnerability in Windows Explorer. This vulnerability allows an attacker to capture netNTLMv2 credentials from a victim without any direct interaction from the victim. Description The CVE-2025-24071 vulnerability exis...

CVE-2023-23752

CVE-2023-23752 This is a proof-of-concept code for the CVE-2023-23752 vulnerability. It allows an attacker to extract sensitive information such as usernames, passwords, and database names from a target application. Usage To use this code, you can follow these steps: 1. Clone this repository or...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 Minio Information Disclosure Exploit Usage Write url into urls.txt, then directly run python CVE-2023-28432.py Compatible formats: http://ip:port, ip:port python CVE-2023-28432.py ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ █████╗ ██╗ ██╗██████╗...

CVE-2023-30367-mRemoteNG-password-dumper

mRemoteNG = v1.77.3.1784-NB Password Dumper CVE-2023-30367 Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an...

pentest_teamcity

Pentest TeamCity using Metasploit TL;DR: Obtain passwords fromJetBrains IDE like IntelliJ or PyCharm and use those credentials inside TeamCity Continuous Integration Server in order to get meterpreter session on server and build agents using metasploit by Kacper Szurek. JetBrains Comment This is ...

CVE-2024-51482

CVE-2024-51482 ZoneMinder v1.37. = 1.37.64 CVE-2024-51482 poc.py By default, this script enumerates the zm database, pulls from the Users table, and dumps Username+Password columns. If these 4 things exist, you will receive a username and password hash. More detailed information on the...

SecAdvisory

July 2, 2019 FN21 Man-in-the-middle Vulnerability related to vCenter CVE-2019-11242 Problem Description A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented b...

XposedOrNot

XposedOrNot XposedOrNot XoN tool is to search an aggregated repository of xposed passwords comprising of 850 million real time passwords. Usage of such compromised passwords is detrimental to individual account security. Screenshot What is Xposed Passwords? The main aim of this project is to give...

SecretSifter

OWASP SecretSifter SecretSifter is an OWASP Incubator project that finds credentials exposed in what web applications actually deliver to the browser: JavaScript bundles, configuration responses and other live content. Pre-deployment secret scanning looks at source code. Some credentials are only...

CVE-2023-28432

MinIO vulnerability exploit CVE-2023-28432 Description This python3 script is designed to exploit CVE-2023-28432, which potentially affects certain MinIO server configurations. The script makes a POST request to a specified hostname, attempting to retrieve sensitive environment variables such as...

CVE-2026-31278

CVE-2026-31278 Suprema BioStar 2: Active Directory Credential Exposure Metadata Field| Details ---|--- CVE ID| CVE-2026-31278 Vendor| Suprema Inc. Product| BioStar 2 Vulnerability Type| Sensitive Information Disclosure / Credential Exposure Attack Vector| Remote / Authenticated / Low Complexity...

HTC

Hack The CCTV DVRs Credentials Exposed | CVE-2018-9995 | The CCTV Leaked Username For Get Loggin Access How To Use? Open The https://www.zoomeye.org/ Search This Keyword '/login.rsp' Wait To Get IP and Port $ python3 thecctv.py More Information OS | Language | Contact ---|---|--- Linux Ubuntu |...

CVE-2026-29597

CVE-2026-29597: Improper access control DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive configuration files by force browsing the “/Admin/filemanager/filedetails.asp” endpoint and manipulating the “fil...

CVE-2026-116196

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token,...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 nuclei templates Dec Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD...

CVE-2026-116196

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token,...

EUVD-2026-109454

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token,...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 POC Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in...