CVE-2024-56428

CVE-2024-56428 iLabClient のローカルデータベース内の平文資格情報 設定（パスワードを含む）を読み出す iLabClient は、ラボサーバーから結果をダウンロードするために使用されます。設定データは、Apache Derby インスタンス iLabClient にローカルに保存されます。パスワードは平文で保存されます。これを読み取るには、まずローカルデータベースへの接続を確立する必要があります。例えば、CVE-2024-56429 に記載されている方法を使用します。 パスワードを読み出します: root@kitploit: select EINSTELLUNGE...

Python-MikrotikLoginExploit

Mikrotik ログインエクスプロイト Mikrotik の脆弱性 CVE-2018-14847（特に winbox）の PoC（Proof of Concept）で、RouterOS のデフォルトポート 8291 からパスワードを直接読み取ります。 原著者: https://github.com/BigNerd95/ 要件 Python 3+ Linux へのインストール root@kitploit: apt install python3 使用例 WinBox TCP/IP root@kitploit: python3 WinboxExploit.py PORT 例:...

xpl-ModernWMS-CVE-2024-57698

Divulgación del hash MD5 de la contraseña de administrador - ModernWMS v1.0 - CVE-2024-57698 Un problema en modernwms v.1.0 permite a un atacante ver el hash MD5 de la contraseña del administrador y otros atributos sin autenticación, incluso después de la configuración inicial y el cambio de...

CVE-2023-46501

CVE-2023-46501 - BoltWire v6.03 - 부적절한 접근 제어 설명 BoltWire CMS 버전 6.03 에서는 index.php?p=member.admin&action=data 매개변수를 통해 "부적절한 접근 제어" 취약점을 악용할 수 있으며, 공격자가 관리자를 포함한 모든 구성원의 비밀번호를 볼 수 있습니다. 따라서 정보 도용, 데이터의 임의 변경 또는 악의적인 목적을 위한 애플리케이션 조작이 가능해집니다. 해결 방법 BoltWire CMS 최신 버전으로 업데이트하세요. 재현 단계: 1 새 구성원을...

WordPress Download Manager - File Password Exposure

The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint. id: CVE-2023-6421 info: name: WordPress Download Manager - File Password Exposure...

CVE-2023-39144

CVE-2023-39144 배경 이 취약점은 2023년 5월에 발견되었습니다. Element55는 법률 사무소가 시간을 추적할 수 있는 소프트웨어를 생산합니다. 이 소프트웨어는 Exchange, SQL, Shoretel과 같은 다양한 위치에서 정보를 가져옵니다. 타임라인 2023년 5월 24일 - Element 55에 취약점 보고 2023년 5월 25일 - Element55가 취약점을 확인하고 버전 22의 일부로 수정하겠다고 밝혔습니다. 그들은 전문적이었고 함께 일하기 좋았습니다 2023년 7월 24일 - Element 55와...

CVE-2026-89444

A flaw was found in the Linux kernel. The dell-wmi-sysman driver, responsible for managing Dell WMI Windows Management Instrumentation system attributes, incorrectly logs sensitive information. Specifically, when setting a BIOS attribute, the driver populates a security buffer with the current...

CVE-2026-89444 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-38058

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

CVE-2025-63579

CVE-2025-63579 京セラ Command Center RX プリンターのアドレス帳機能に入力されたすべてのユーザー名とパスワードへの不正アクセス。 説明 京セラプリンターの不正使用により、京セラのアドレス帳に保存されているすべての情報をエクスポートできます。この脆弱性により、受信データを暗号化するセキュリティ対策を回避でき、暗号化されたデータを復号化できます。パスワードやその他の機密情報を取得できます。 影響を受けるバージョン TASKalfa 2552ci TASKalfa 3252ci TASKalfa 2553ci TASKalfa 3253ci TASKalfa...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

Summary IBM Db2 is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about multiple security vulnerabilities affecting IBM Db2 has been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

keysweeper

KEYSWEEPER // SIGINT // SAMY.PL // REL TO ALL // APPLIED HACKING KeySweeper KeySweeper は、動作するUSB壁充電器に偽装されたステルス性の高いArduinoベースのデバイスで、周辺のMicrosoftワイヤレスキーボードからすべてのキーストロークをワイヤレスかつパッシブに傍受、復号、記録し、GSM経由で報告します。...

CVE-2025-1738

CVE-2025-1738 - Trivision Camera NC227WF PoC 📋 概要 責任ある開示に従い、公式のCVEが2件割り当てられました。 CVE| CVSS v3.1| スコア| CWE| タイプ ---|---|---|---|--- CVE-2025-1738| AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N| 6.2| CWE-598| 平文パスワードの露出 🔍 CVE-2025-1738 — 平文パスワードの露出 CWE-598 説明 認証を必要とせず、ローカルの任意のユーザーが管理者パスワードを平文で取得できます。 攻撃ベクトル:...

CVE-2019-6693

CVE-2019-6693 你是否更改过 FortiGate 的默认加密密钥？运行此脚本即可知道！你可以提供整个配置文件转储，也可以提供单个加密值。如果解密后的值并非完全无意义的乱码，或能组成一个单词，那么加密密钥很可能仍为默认值。 安装 root@kitploit: git clone https://github.com/Real4XoR/cve-2019-6693.git cd cve-2019-6693 pip3 install -r requirements.txt 用法 提供整个 .conf 配置文件： root@kitploit: python3...

CVE-2021-38489

CVE-2021-38489 affects the HddPasswordPei driver in Insyde InsydeH2O 5.x firmware, as shipped in Siemens SIMATIC products. The root cause is that the HDD password is stored in plaintext within a UEFI variable, exposing it to attackers with local, high-privilege access. The vulnerability carries a...

CVE-2021-43613

A vulnerability in the SysPasswordDxe driver of Insyde InsydeH2O 5.x exposes user and administrator password hashes in runtime UEFI variables, enabling privilege escalation . The affected firmware is also used in Siemens SIMATIC industrial products. The CVSS 3.1 score is 6.5 (Medium) with a local...

EUVD-2026-69866

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

CVE-2026-55857 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

CVE-2026-55857 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

CVE-2026-55854

MariaDB Connector/Node.js can disclose an account password in cleartext when PAM dialog authentication is negotiated over an insecure transport. The root cause is in lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, where SendPamAuthPacketFactory lacked the secu...