132 matches found
pentest_teamcity
Pentest TeamCity usando Metasploit TL;DR: Obtener contraseñas deJetBrains IDE como IntelliJ o PyCharm y usar esas credenciales dentro de TeamCity Continuous Integration Server para obtener una sesión de meterpreter en el servidor y agentes de compilación usando metasploit por Kacper Szurek...
credmap
credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...
credmap
credmap: クレデンシャルマッパー Credmapは、認証情報の再利用の危険性について認識を高めるために作成されたオープンソースツールです。提供されたユーザー認証情報を、いくつかの既知のウェブサイトでテストし、パスワードがそれらのいずれかで再利用されていないかを確認できます。公式の紹介記事はこちらでご覧いただけます。 ヘルプメニュー root@kitploit: Usage: credmap.py --email EMAIL | --user USER | --load LIST options Options: -h/--help show this help message a...
Cr3dOv3r
Cr3dOv3r 認証情報の再利用攻撃におけるあなたの最良の友です。 Cr3dOv3r にメールアドレスを入力すると、次の2つのシンプルで便利な機能を実行します： メールアドレスに関連する公開リークを検索し、リークの最も有用な詳細情報を返します（haveibeenpwned API を使用）。また、見つけたリークから平文パスワードを取得しようとします（@GhostProjectME を使用）。...
CVE-2026-50199
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/updateexchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...
CVE-2025-14269
CVE-2025-14269 クラスター内バージョンのHeadlampにおいて、認証されていないユーザーがキャッシュされた認証情報を再利用して、Headlamp UIを通じてHelm機能にアクセスできる可能性があるセキュリティ問題が発見されました。Kubernetesクラスターは、Headlampがインストールされ、config.enableHelm: trueが設定され、かつ許可されたユーザーが以前にHelm機能にアクセスした場合にのみ影響を受けます。 PoC Headlamp バージョン v0.38.0 以下をインストールする config.enableHelm: true...
htb-labs-nexus
🏴☠️ HTB Labs - Nexus English 🇺🇸 | Español 🇪🇸 English | Español 📋 Panoramica Nexus è una macchina Linux di difficoltà Facile di Hack The Box che dimostra una catena di attacco multi-fase che coinvolge enumerazione di virtual host, credenziali esposte, funzionalità vulnerabili di applicazioni web,...
libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials
A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...
EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-2962)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one,...
Security Bulletin: consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...
CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...
CVE-2026-16498
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
CVE-2026-16498
The terraform-mcp-server package is affected up to version 1.0.x; in the streamable-HTTP stateless transport mode, a cross-tenant credential reuse vulnerability allows one user’s Terraform token to be used to execute tool calls for subsequent users. Root cause: improper isolation between tenants ...
EUVD-2026-49941
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
PT-2026-65551
Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A cross-tenant credential reuse issue exists in the streamable-HTTP stateless transport mode. This flaw may allow a Terraform token belonging to one user to be reused to execute tool cal...
CVE-2026-64391 ksmbd: use opener credentials for ADS I/O
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...
FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices
Key Takeaways FortiBleed refers to June 2026 public reporting of large-scale credential exposure and abuse targeting internet-reachable FortiGate management and SSL-VPN gateways driven by credential reuse and brute-force, not a single new zero-day. Risk is highest for internet-exposed FortiGate...
CVE-2026-9079
A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...
