CVE-2025-63353

FiberHome Wi-Fi パスワード予測ツール CVE-2025-63353 FiberHome HG6145F1 RP4423 ルーターに見られる、決定論的なパスワード生成の欠陥を利用したセキュリティ監査および概念実証デモンストレーションのための Python ユーティリティ。 📋 概要 このスクリプトは CVE-2025-63353 を悪用します。これは、工場出荷時の WPA/WPA2 プリシェアードキーがブロードキャストされる SSID から数学的に導出されるという重大な脆弱性です。攻撃者はネットワーク名 SSID...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

DEBIAN-CVE-2026-92821

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

EUVD-2026-92806

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2026-105785

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-92821

A vulnerability exists in SSSD where improper configuration allows an access control bypass in LDAP environments. If the system is configured to evaluate password expiration warnings before restrictive access rules, an expired-password warning causes the rule evaluation to terminate early, treati...

EUVD-2026-92894

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

CVE-2026-92821 Sssd: sssd: access control bypass via premature ldap access rule evaluation

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

CVE-2026-92821

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

PT-2026-106766

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 Description The software uses a lower-than-recommended PBKDF2 work factor for password hashing. PBKDF2 Password-Based Key Derivation Function 2 is a...

PT-2026-106292

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

PT-2026-106779

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 Description A user capable of querying a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, such as...

PT-2026-106788

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload versions prior to 4.0.0-canary.34 Description The server fails to correctly enforce a field-level access.update restriction on the password field within an authentication collection. This allows the...

Linux Distros Unpatched Vulnerability : CVE-2026-92821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol...

CVE-2025-28355

CVE-2025-28355 https://github.com/Volmarg/personal-management-system アプリケーションが CSRF 攻撃に対して脆弱であることが特定されました。 攻撃者が実行できる多くのアクションの 1 つは、正当なユーザーを欺いてクロスサイトリクエストを実行させ、パスワードを変更させることです。 これにより、攻撃者はアプリケーションにアクセスできるようになります。この脆弱性には、“SameSite” Cookie 属性のデフォルト値が none である Firefox などのブラウザが必要です。 ベクター文字列 :...

Filament: Multi-factor authentication (app) management actions do not require password reauthentication

App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regeneratin...

GHSA-7M6H-RG42-M449 Filament: Multi-factor authentication (app) management actions do not require password reauthentication

App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regeneratin...

CVE-2024-23733

CVE-2024-23733 Software AG webMethods API Integration Server 10.15.0 부적절한 접근 제어 설명 Integration Server의 /WmAdmin/,/invoke/vm.server/login 로그인 페이지Software AG webMethods 10.15.0, CoreFix7 이전 버전에서 원격 공격자가 임의의 사용자 이름과 빈 비밀번호를 /WmAdmin//login/ URI로 전송하여 관리 패널에 접근하고 호스트 이름 및 버전 정보를 확인할 수 있습니다. 취약점 유형 부적...

CVE-2026-105785 Joplin Server password reset accepts tokens issued for unrelated purposes

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

CVE-2026-105785

Prior to Joplin Server 3.7.2 , a vulnerability exists in the TokenModel.ts and UserModel.ts components. The system stores CSRF, account-confirmation, email-change, and password-reset tokens without distinguishing their specific purposes. This allows an attacker to use a leaked CSRF or confirmatio...