Cr3dOv3r

Cr3dOv3r Your best friend in credential reuse attacks. You give Cr3dOv3r an email then it does two simple useful jobs with it: Search for public leaks for the email and returns the result with the most useful details about the leak Using haveibeenpwned API and tries to get the plain text password...

pentest_teamcity

使用 Metasploit 对 TeamCity 进行渗透测试 TL;DR: 从JetBrains IDE（例如 IntelliJ 或 PyCharm）获取密码，然后在 TeamCity 持续集成服务器 中使用这些凭据，以利用 metasploit 在服务器和构建代理上获取 meterpreter 会话——作者 Kacper Szurek。 JetBrains 评论 以下是来自供应商（JetBrains TeamCity 团队）的评论，由 Yegor Yarko 提供： 本文的大部分内容描述了恶意用户如何在获得合理权限的情况下滥用 TeamCity。...

credmap

credmap: 凭证映射器 Credmap 是一款开源工具，旨在唤起人们对凭证重用危险的意识。它能够将提供的用户凭证在多个已知网站上测试，以检查密码是否在这些网站中被重用。官方介绍文章可点击此处查看。 帮助菜单 root@kitploit: Usage: credmap.py --email EMAIL | --user USER | --load LIST options Options: -h/--help show this help message and exit -v/--verbose display extra output information...

credmap

credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...

CVE-2025-14269

CVE-2025-14269 A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with...

EUVD-2026-83049

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable acro...

CVE-2026-54547 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

htb-labs-nexus

🏴‍☠️ HTB Labs - Nexus English 🇺🇸 | Español 🇪🇸 English | Español 📋 Overview Nexus is an Easy-difficulty Linux machine from Hack The Box that demonstrates a multi-stage attack chain involving virtual host enumeration, exposed credentials, vulnerable web application functionality, remote code...

CVE-2026-50199

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/updateexchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...

libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials

A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...

EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-2962)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one,...

Security Bulletin: consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...

CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...

CVE-2026-16498

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...

CVE-2026-16498

The terraform-mcp-server package is affected up to version 1.0.x; in the streamable-HTTP stateless transport mode, a cross-tenant credential reuse vulnerability allows one user’s Terraform token to be used to execute tool calls for subsequent users. Root cause: improper isolation between tenants ...

EUVD-2026-49941

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...

CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...

Multiple vulnerabilities impacting HashiCorp Terraform MCP Server

Summary The terraform-mcp-server before version 1.1.0 is vulnerable to three related issues in its streamable-HTTP transport: a server-side request forgery issue that may allow an unauthenticated client to redirect the server’s bearer token to an attacker-controlled endpoint CVE-2026-14869, an...

PT-2026-65551

Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A cross-tenant credential reuse issue exists in the streamable-HTTP stateless transport mode. This flaw may allow a Terraform token belonging to one user to be reused to execute tool cal...

CVE-2026-64391 ksmbd: use opener credentials for ADS I/O

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...