10997 matches found
jackit
JackIt ¿Te gusta JackIt pero no quieres llevar un portátil? Échale un vistazo aesto. Qué Esta es una implementación parcial del exploit MouseJack de Bastille. Consulta mousejack.com para más detalles. El crédito completo corresponde al equipo de Bastille por descubrir este problema y escribir las...
nopowershell
NoPowerShell NoPowerShell è uno strumento implementato in C che supporta l'esecuzione di comandi simili a quelli di PowerShell rimanendo invisibile a qualsiasi meccanismo di logging di PowerShell. Questo binario compatibile con .NET Framework 2 può essere caricato in Cobalt Strike per eseguire...
sshhipot
La versión 2 está en desarrollo. Cambie a la rama v2, compile y ejecute con -h. SSHHiPot Honeypot SSH de alta interacción vale, en realidad es un proxy SSH de registro. Todavía más o menos un trabajo en progreso. Siéntase libre de go install este repositorio si quiere probarlo. Ejecútelo con -h...
CLEANSTART-2026-EN61439 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...
CLEANSTART-2026-RX13164 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
CLEANSTART-2026-GI35870 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...
CLEANSTART-2026-IV56904 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing
Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...
CLEANSTART-2026-FI20100 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request
Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...
CVE-2026-108857: Insertion of Sensitive Information into Log File
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured apikey because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer tok...
CVE-2026-108754: Insertion of Sensitive Information into Log File
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys...
PT-2026-120248
Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...
PT-2026-120252
Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS INITIAL WINDOW SIZE values...
PT-2026-110156
Name of the Vulnerable Software and Affected Versions GPT-Load versions prior to 1.4.12 Description A cleartext logging issue exists where client proxy keys are exposed. This occurs because the Gin Logger middleware records the raw query string before the extractAuthKey function strips the key...
PT-2026-120250
Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...
PT-2026-120251
Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...
PT-2026-120249
Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...
GO-2026-6605 vulnerabilities
Vulnerabilities for packages: kube-state-metrics, rekor, rancher, step-issuer, step, aws-nuke, actions-runner-controller, rclone, lvm-driver, conftest, kyverno-notation-aws, kubernetes-csi-node-driver-registrar, filebrowser, malcontent, mongodb-kubernetes-operator, prometheus-adapter, terragrunt,...
sysmon-modular
sysmon-modular | A Sysmon configuration repository for everybody to customise Sysmon Modular is a configuration repository for Microsoft Sysinternals Sysmon. Small XML modules make it easier to select, review and maintain the telemetry that is useful to your organisation. The sysmon-modular Go to...
CVE-2026-92990
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...
EUVD-2026-95502
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...