1855 matches found
MSF_PassSpray_Wordlist_Generator
Password Spray Wordlist Generator A handy tool that helps you to create your own wordlist for Metasploit framework, in order to carry out a password spray attack against various network protocols in your victims' domain, such as SMB : Description Metasploit has multiple modules that can be utiliz...
buffalo
Buffalo نص برمجي بلغة Python 3 لتنفيذ هجمات القاموس/قوائم الكلمات على خادم SSH مستهدف باستخدام ملفين نصيين كمدخلات. كُتب لأغراض التقييم التقني الخاص بي في Intel. التثبيت يعتمد هذا النص البرمجي على Paramiko وColorama. قم بتثبيت التبعيات عبر pip install -r requirements.txt أو pip3 install -r...
CVE-2019-17240
CVE-2019-17240 استغلال الإصدارات حتى 3.9.2 وما قبلها من Bludit CMS معرّضة لتجاوز آلية مكافحة القوة الغاشمة المخصصة لحظر المستخدمين الذين حاولوا تسجيل الدخول بشكل غير صحيح 10 مرات أو أكثر. تم اكتشاف الثغرة بواسطة Rastating. عند إرسال طلب تسجيل دخول بقيمة ترويسة X-Forwarded-For عبارة عن سلسلة متغير...
EUVD-2026-93512
Payload: Unauthenticated account-lockout denial of service...
Payload: Unauthenticated account-lockout denial of service
Impact An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: Using an affected Payload version with an auth-enabled collection that uses local authentication and...
GHSA-V5GF-VPJC-PC7W Payload: Unauthenticated account-lockout denial of service
Impact An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: Using an affected Payload version with an auth-enabled collection that uses local authentication and...
NPM: Payload: Unauthenticated account-lockout denial of service
NPM: Payload: Unauthenticated account-lockout denial of service vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...
CVE-2021-3156-Mitigation-ShellScript-Build
CVE-2021-3156-Mitigation-ShellScript-Build بالنظر إلى الثغرة الأمنية التي تم التركيز عليها في SUDO عام 2021 والمتمثلة في CVE-2021-3156 هذه محاولة لإنشاء سكربت للتحقق من العمليات، وإذا وُجدت العملية المحددة فإنه يستدعي المصادقة ويقفل النظام...
2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424
تجاوز المصادقة الثنائية باستخدام هجوم القوة العمياء نظرة عامة تطبيق Nagios Fusion الإصدار 2024R1.2 و2024R2 معرض لهجوم القوة العمياء على آلية المصادقة الثنائية 2FA. وتحديدًا، لا يفرض تطبيق 2FA بشكل كافٍ آليات تحديد المعدل أو إغلاق الحساب، مما يسمح للمهاجم بتجاوز 2FA عن طريق تخمين كلمة المرور لمرة...
CVE-2026-105866
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to...
CVE-2026-105866 Payload: Unauthenticated account-lockout denial of service
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to...
CVE-2026-105866
The headless content management system Payload is vulnerable in versions prior to 3.90.0 and canary versions before 4.0.0-canary.34 . An unauthenticated attacker who possesses an account email address or username can exploit the account lockout mechanism within a local-authentication collection ....
CVE-2026-105866 Payload: Unauthenticated account-lockout denial of service
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to...
CVE-2026-105866 Payload: Unauthenticated account-lockout denial of service
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to...
onedrive_user_enum
onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...
PT-2026-106799
Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description An unauthenticated attacker who knows a user's email address or username can abuse the account lockout mechanism of a local-authentication collection...
EUVD-2026-91055
Filament: Multi-factor authentication app management actions do not require password reauthentication...
grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...
grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...
CVE-2026-105687
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...