SecretFinder

Über SecretFinder SecretFinder ist ein Python-Skript, das auf LinkFinder basiert. Es wurde entwickelt, um sensible Daten wie apikeys, accesstoken, authorizations, jwt, usw. in JavaScript-Dateien zu entdecken. Dies geschieht durch die Verwendung von jsbeautifier für Python in Kombination mit einem...

swaggerHole

Uno script python3 per cercare segreti su swaggerhub Introduzione • Requisiti • Installazione • Utilizzo • Spiegazione dell'output • Ringraziamenti Creato da Liodeus Introduzione Questo strumento è stato creato per automatizzare il processo di recupero dei segreti dalle API pubbliche su swaggerHu...

dufflebag

Dufflebag Dufflebag è uno strumento che cerca tra gli snapshot pubblici di Elastic Block Storage EBS eventuali segreti accidentalmente lasciati al suo interno. Potresti sorprenderti di quante password e segreti sono sparsi in giro! Lo strumento è organizzato come un'applicazione Elastic Beanstalk...

jsleak

Descrizione Ho sviluppato jsleak durante gran parte del mio tempo libero per esigenze personali. È uno strumento da riga di comando facile da usare, progettato per scoprire segreti e collegamenti in file JavaScript o codice sorgente. jsleak è stato ispirato da Linkfinder e le regex sono state...

keyFinder

KeyFinder Rilevamento passivo di chiavi API e segreti per Chrome e Firefox KeyFinder è un'estensione per browser per Chrome e Firefox che analizza passivamente ogni pagina visitata alla ricerca di chiavi API, token, segreti e credenziali trapelati. Funziona silenziosamente in background senza...

MAL-2026-11575 Malicious code in @nebula.js/sn-line-chart (npm)

npm/@nebula.js/sn-line-chart is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

PT-2026-60686

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description When operating in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server lacks a UnaryInterceptor, leaving Fetch endpoints unauthenticated...

GHSA-MRRH-FWG8-R2C3 tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and...

tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and...

CVE-2025-30066

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code...

PT-2021-24207 · Htcondor · Htcondor

Name of the Vulnerable Software and Affected Versions: HTCondor versions prior to 8.8.15 HTCondor versions 9.0.x prior to 9.0.4 HTCondor versions 9.1.x prior to 9.1.2 Description: An issue was discovered in HTCondor that allows a user with only READ access to an HTCondor SchedD or Collector daemo...

envoy: Incorrect Access Control when using SDS with Combined Validation Context

An access control bypass vulnerability was found in envoy. When the same TLS secret is used across multiple resources, the client's data, such as the subject alternative name or hash, is not validated. This flaw could lead to a possible bypass of security restrictions...