Security Bulletin:jackson-databind Deserialization Eager DNS Resolution Vulnerability

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

disclo

disclo ドメインの連絡先ファインダー。ドメインを入力すると、関連するすべてのメール、ハンドル、リードを、12のパッシブソースから並行して取得します。 $ python disclo.py gitlab.com disclo - gitlab.com ---------------------------------------------------------------------- hackerone https://hackerone.com/gitlab url 例： python disclo.py example.com python disclo.py tawk.t...

CVE-2026-107269

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

EUVD-2026-94404

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

EUVD-2026-94398

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-107269 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-107269

Versions of Gophish through 0.12.1 are vulnerable to a timing discrepancy in the AdminServer.Login function. This flaw allows unauthenticated attackers to perform username enumeration by measuring response times during a POST /login request. Specifically, the application exhibits different delays...

CVE-2026-107269 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

ResetSpy

ResetSpy 探测 Microsoft 的自助密码重置（SSPR）端点，以枚举已注册的验证方式，并标记出任何缺少强第二因素的方式。提供用户枚举以及跨 Entra 账户的 MFA 态势近似评估。 !NOTE 截至 2026 年 8 月，Microsoft 已从 SSPR 流程中移除旧版 CAPTCHA，并以后端限流和基于行为的滥用检测取而代之（参见 MC1400824）。Microsoft 的立场是，后端控制足以检测并阻止自动化滥用。 目录 安装 pipx pip 用法 示例 选项 速率限制 准确性与局限性 TL;DR 为什么 SSPR 结果是合理的 MFA 代理指标 已知缺陷 能力总...

CVE-2024-44762-webmin-userenum

此存储库没有 README。...

GitLab GraphQL API User Enumeration

An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, names, and email addresses. id: CVE-2021-4191 info: name: GitLab GraphQL API User Enumeration author: zsusac severity: medium description: An unauthenticated remote attacker can leverage thi...

Pulse

嗨，这是一个脚本，用于检查来自 Shodan 的、存在 Pulse Secure 漏洞 CVE-2019-11510 的 IP 地址 感谢 Rakesh Parchuri 帮助编写此脚本 从输出中获取 IP 地址后，使用 metasploit 模块进行进一步利用 https://www.exploit-db.com/exploits/47297...

CVE-2024-55374

CVE-2024-55374 Redcap 14.3.13 は、ユーザーが存在するかどうかによって異なるエラーメッセージを返すため、ユーザー列挙の脆弱性があります。これにより、攻撃者は複数の HTTP 認証リクエストを送信してブルートフォース攻撃を実行できます。このベクターを軽減するための保護メカニズムが存在しますが、そのメカニズム自体が、攻撃者がアプリケーション内の有効なユーザーの存在を推測することを可能にします。...

PT-2026-107566

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-98169

A flaw was found in the Linux kernel's Server Message Block SMB client. This issue leads to information disclosure caused by an out-of-bounds memory read during snapshot enumeration. A malicious SMB server can provide an unexpectedly short response, causing the kernel client to read beyond the...

CVE-2016-6210-OpenSSH-User-Enumeration

此存储库没有 README。...

CVE-2025-29927-scanner

nocomp作 Next.js バージョン脆弱性スキャナー 概要 このPythonスクリプトは、複数のサブドメインをスキャンして Next.js のバージョンを検出し、潜在的な CVE-2025-29927 の脆弱性を特定するための包括的なツールです。異なるサブドメイン上で Next.js で構築された Web アプリケーションの詳細な分析を提供します。 CVE に関する詳細情報: https://nextjs.org/blog/cve-2025-29927 機能 🔍 複数の手法を使用したサブドメイン列挙 🕵️ Next.js バージョン検出 🚨 特定の Next.js...

CVE-2017-5487

PoC - CVE-2017-5487 - WordPressユーザー列挙（REST経由） セットアップ git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 使用方法 .\Enumerate-WordPressOrgMembersREST.ps1 代替ルート1（WAFバイパス用）...