3579 matches found
driftwood
Driftwood ⚠️ The Driftwood CLI tool is no longer supported. Please use TruffleHog instead! ⚠️ Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user. Driftwood performs lookups with the computed public key, so the...
mallory
mallory HTTP/HTTPS proxy over SSH. Installation Local machine: go install github.com/justmao945/mallory/cmd/mallory@latest Remote server: need our old friend sshd Configuration Config file Default path is $HOME/.config/mallory.json, can be set when start program root@kitploit: mallory -config...
roca
ROCA detection tool This tool is related to ACM CCS 2017 conference paper 124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. It enables you to test public RSA keys for a presence of the described vulnerability. Update 4.11.2017 : Python 2.7, 3.4+ supported...
certsync
certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...
CVE-2026-50192 Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect
Kerberos Agent is an open source video surveillance management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the operator-configured Hub URL config.HubURI. The...
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...
GHSA-2MC4-J865-9Q4R netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...
EUVD-2026-62950
In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...
CVE-2026-76385
In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...
CVE-2026-76261
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...
CVE-2026-76385 Information Disclosure through Action Parameters in Venafi app for Splunk SOAR
In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...
CVE-2026-76261
Non-admin/low-privilege users on Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Secure Gateway (below 3.10.9, 3.9.23, 3.8.70) can read Spacebridge asymmetric private keys via the App Key Value Store REST API. The root cause is incomplete private-key migration during upgrade, leaving...
CVE-2026-15065
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file...
EUVD-2026-62424
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file...
CVE-2026-53456
In Blueprint Studio versions before 2.5.2, the SSH terminal authentication component in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file under the Home Assistant configuration directory, applied restrictive permissions afterward, and relied o...
CVE-2026-71322
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...
CVE-2026-71322 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...
EUVD-2026-61158
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...
CVE-2026-71322
Lemur (Netflix's TLS certificate management platform) prior to 1.9.3 contains an authorization bypass in the CertificateExport handler (lemur/certificates/views.py). The CertificatePermission ownership check is structurally nested inside an if plugin.requires_key: branch, so any export plugin dec...