keyFinder

KeyFinder Descubrimiento pasivo de claves API y secretos para Chrome y Firefox KeyFinder es una extensión de navegador para Chrome y Firefox que examina pasivamente cada página que visitas en busca de claves API, tokens, secretos y credenciales filtrados. Se ejecuta silenciosamente en segundo pla...

SecretFinder

acerca de SecretFinder SecretFinder es un script de Python basado en LinkFinder, escrito para descubrir datos sensibles como apikeys, accesstoken, autorizaciones, jwt, etc. en archivos JavaScript. Lo hace usando jsbeautifier para Python en combinación con una expresión regular bastante grande. La...

swaggerHole

Un script en python3 que busca secretos en swaggerhub Introducción • Requisitos • Instalación • Uso • Explicación de la salida • Agradecimientos Creado por Liodeus Introducción Esta herramienta está hecha para automatizar el proceso de recuperación de secretos en las APIs públicas en swaggerHub...

dufflebag

Dufflebag Dufflebag es una herramienta que busca secretos que puedan haber quedado accidentalmente en instantáneas públicas de Elastic Block Storage EBS. ¡Te sorprenderá la cantidad de contraseñas y secretos que simplemente están por ahí! La herramienta está organizada como una aplicación de...

jsleak

Descripción Desarrollé jsleak durante la mayor parte de mi tiempo libre por mi propia necesidad. Es una herramienta de línea de comandos fácil de usar diseñada para descubrir secretos y enlaces en archivos JavaScript o código fuente. jsleak se inspiró en Linkfinder y las expresiones regulares se...

GitMiner3

Autor: UnkL4b Sitio: bravul.com Blog: unkl4b.github.io Github: UnkL4b X: @UnkL4b ADVERTENCIA +---------------------------------------------------+ | LOS DESARROLLADORES NO ASUMEN NINGUNA | | RESPONSABILIDAD Y NO SON RESPONSABLES DE CUALQUIER | | USO INDEBIDO O DAÑO CAUSADO POR ESTE PROGRAMA |...

trufflehog v3.98.0

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

MAL-2026-11575 Malicious code in @nebula.js/sn-line-chart (npm)

npm/@nebula.js/sn-line-chart is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

PT-2026-60686

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description When operating in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server lacks a UnaryInterceptor, leaving Fetch endpoints unauthenticated...

PT-2026-60652

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

GHSA-MRRH-FWG8-R2C3 tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and...

tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and...

CVE-2025-30066

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code...

CVE-2025-30066: Embedded Malicious Code

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code...

PT-2021-24207 · Htcondor · Htcondor

Name of the Vulnerable Software and Affected Versions: HTCondor versions prior to 8.8.15 HTCondor versions 9.0.x prior to 9.0.4 HTCondor versions 9.1.x prior to 9.1.2 Description: An issue was discovered in HTCondor that allows a user with only READ access to an HTCondor SchedD or Collector daemo...

CVE-2021-45101: Undefined Security Weakness

An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-line tools, a user with only READ access to an HTCondor SchedD or Collector daemon can discover secrets that could allow them to control other users' jobs and/or read their data...

envoy: Incorrect Access Control when using SDS with Combined Validation Context

An access control bypass vulnerability was found in envoy. When the same TLS secret is used across multiple resources, the client's data, such as the subject alternative name or hash, is not validated. This flaw could lead to a possible bypass of security restrictions...

CVE-2020-8664

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret e.g. trusted CA across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even thoug...