143 matches found
CVE-2019-16097-batch
CVE-2019-16097-batch 免责声明 只做安全研究使用，不得做非法测试，后果自行承担！！！ CVE-2019-16097-batch 批量漏洞利用脚本 在 url.txt文件 批量添加目标地址 http://1.1.1.1 http://2.2.2.2 使用python 运行 此脚本 在 result.txt 可以看到最终的验证结果 漏洞背景...
ictf-framework
iCTF 框架 3.0 这是 Shellphish 用于举办 iCTF 的框架。 iCTF 框架在 2014 年 Usenix 3GSE 研讨会上发表的一篇论文中进行了描述。 我们发布此框架，希望它能帮助教育者和培训人员举办自己的 A/D CTF。 本框架可免费用于商业用途，但我们能提供的支持有限。 我们计划未来发布更多关于各组件的技术文档；目前，你可以在此找到关于如何创建一场比赛的说明。 如有疑问，请发送邮件至 [email protected]。 免责声明 ：本框架仍在开发中，此版本应视为 BETA 版本。欢迎提交新的 pull request 和 issue : TODO...
github-dorks
Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...
CVE-2019-16097
CVE-2019-16097-batch Descargo de responsabilidad Solo para uso en investigación de seguridad. No lo utilice para pruebas ilegales. ¡¡¡Las consecuencias son bajo su propia responsabilidad!!! CVE-2019-16097-batch Script de explotación de vulnerabilidad en lote Agregue direcciones objetivo en lote e...
klar
Klar Clair与Docker Registry的集成（同时支持Clair API v1和v3） Klar是一款简单工具，用于分析存储在私有或公共Docker Registry中的镜像是否存在安全漏洞，它利用Clair https://github.com/coreos/clair 进行检测。Klar设计为集成工具，因此依赖环境变量进行配置。它是一个独立的二进制文件，无需额外依赖。 Klar充当客户端，协调Docker Registry与Clair之间的镜像检查。 二进制安装 最简单的方式是从 https://github.com/optiopay/klar/releases/...
klar
Klar Integration of Clair and Docker Registry supports both Clair API v1 and v3 Klar is a simple tool to analyze images stored in a private or public Docker registry for security vulnerabilities using Clair https://github.com/coreos/clair. Klar is designed to be used as an integration tool so it...
[SECURITY] Fedora 43 Update: docker-distribution-3.1.2-1.fc43
The toolkit to pack, ship, store, and deliver container content. This package provides Docker Registry - a service for storing and distributing OCI and Docker container images...
[SECURITY] Fedora 44 Update: docker-distribution-3.1.2-1.fc44
The toolkit to pack, ship, store, and deliver container content. This package provides Docker Registry - a service for storing and distributing OCI and Docker container images...
[SECURITY] Fedora 45 Update: docker-distribution-3.1.2-1.fc45
The toolkit to pack, ship, store, and deliver container content. This package provides Docker Registry - a service for storing and distributing OCI and Docker container images...
CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning
CVE-2026-21005 – Envenenamiento de imágenes en Docker Registry V2 Schema 1 Código del programa Python Flask + Shell dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers': 'sha256:abc',...
go-pillage-registries
go-pillage-registries 该项目会获取一个 Docker 注册表，并对其目录中每个镜像的 manifest 和 configuration 进行掠夺。 它使用 Google 的 crane 命令包，该包应遵循 Docker 的 keychain 语义。 如果你想覆盖此行为，只需按照 https://github.com/google/go-containerregistry/tree/master/pkg/authn/k8schain 中的描述更改 authn.DefaultKeychain 即可。 安装： git clone...
jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17
Jenkins 的 Docker Commons API 插件 API 插件，为各种与 Docker 相关的插件提供通用共享功能。 概要 用于管理 Docker 镜像和容器指纹的 API Docker Registry 的凭据和位置 Docker Daemon（即 Docker Remote API）的凭据和位置 用于 Docker CLI 客户端的 ToolInstallation DockerImageExtractor 扩展点，用于从任务中获取 Docker 镜像关系 在 Docker 构建中引用相关镜像指纹的简单 UI 等等。 使用场景 凭据和位置...
Astra Linux – Vulnerability in Docker-Registry
A flaw was discovered in the /v2/catalog endpoint located in the distribution/distribution directory. This endpoint accepts a parameter that controls the maximum number of records to be returned query string: n. This vulnerability allows a malicious user to submit an excessively large value for n...
Open Redirect
Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the Docker registry pagination handling, which follows the URL given in an HTTP Link header while still attaching the registry credentials, without confining the follow to the original...
JetBrains TeamCity < 2021.1 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2021.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible. CVE-2021-43196 - In JetBrains TeamCity...
CVE-2026-49349 regclient may leak authentication credentials to external blob stores
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...
CVE-2026-49349 regclient may leak authentication credentials to external blob stores
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...
PYSEC-2026-2391 BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...
