CVE-2019-16097-batch

CVE-2019-16097-batch Disclaimer Solo per uso di ricerca sulla sicurezza. Non eseguire test illegali. Ogni conseguenza è a carico dell'utente!!! CVE-2019-16097-batch Script di sfruttamento batch della vulnerabilità Aggiungi gli indirizzi target in batch nel file url.txt http://1.1.1.1 http://2.2.2...

klar

Klar Integrazione di Clair e Docker Registry supporta sia Clair API v1 che v3 Klar è un semplice strumento per analizzare le immagini archiviate in un registro Docker privato o pubblico per vulnerabilità di sicurezza utilizzando Clair https://github.com/coreos/clair. Klar è progettato per essere...

ictf-framework

Il Framework iCTF 3.0 Questo è il framework che Shellphish utilizza per ospitare l'iCTF. Il Framework iCTF è descritto in un articolo presentato al workshop Usenix 3GSE nel 2014. Abbiamo rilasciato questo framework nella speranza che permetta a educatori e formatori di ospitare i propri CTF A/D...

CVE-2019-16097

CVE-2019-16097-batch Haftungsausschluss Nur für Sicherheitsforschung verwenden. Keine illegalen Tests durchführen. Die Konsequenzen trägt der Benutzer selbst!!! CVE-2019-16097-batch Massen-Exploit-Skript Fügen Sie in der Datei url.txt massenhaft Zieladressen hinzu http://1.1.1.1 http://2.2.2.2...

CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning

CVE-2026-21005 – Docker Registry V2 Schema 1 Avvelenamento delle Immagini Codice del Programma Python Flask + Shell root@kitploit: dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers':...

jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17

Plugin API Docker Commons per Jenkins Plugin API che fornisce le funzionalità comuni condivise per vari plugin relativi a Docker. Riepilogo API per la gestione delle impronte digitali fingerprints di immagini e container Docker Credenziali e posizione del Registry Docker Credenziali e posizione d...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

klar

Klar Integration of Clair and Docker Registry supports both Clair API v1 and v3 Klar is a simple tool to analyze images stored in a private or public Docker registry for security vulnerabilities using Clair https://github.com/coreos/clair. Klar is designed to be used as an integration tool so it...

go-pillage-registries

go-pillage-registries Dieses Projekt nimmt eine Docker-Registry und plündert das Manifest und die Konfiguration für jedes Image in ihrem Katalog. Es verwendet das Paket des crane-Befehls von Google, das den Keychain-Semantiken von Docker folgen sollte. Wenn Sie dies überschreiben möchten, ändern...

CVE-2026-49349 regclient may leak authentication credentials to external blob stores

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

PYSEC-2026-2391 BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...

BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...

Astra Linux – Vulnerability in Docker-Registry

A flaw was discovered in the /v2/catalog endpoint located in the distribution/distribution directory. This endpoint accepts a parameter that controls the maximum number of records to be returned query string: n. This vulnerability allows a malicious user to submit an excessively large value for n...

PT-2026-39313

🔴 Docker Registry Auth Substring Match Forwards Credentials to a Different Registry CVE-2025-27119, High https://t.co/gO08whMpWZ...

Exploit for CVE-2026-7482

CVE-2026-7482: Ollama Heap Out-of-Bounds Read 1-Day PoC Thi...

org.keycloak/keycloak-services: Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

GHSA-FJF4-6F34-W64Q Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

CVE-2026-2733 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

CVE-2026-2733 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

malcontent OCI image pull credential exfiltration via malicious registry token realm

Malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. Malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a WWW-Authenticate header...