CVE-2026-54121-Certighost

🛡 Módulo de Herramienta de Seguridad IA CVE-2026-54121: Suplantación de Active Directory Certificate Services Certighost Módulo Oficial de Auditoría de Seguridad para el Ecosistema de Herramientas de Seguridad IA 🌐 Demostración Web • 📚 Sitio Web del Proyecto • 💬 Chat de la Comunidad Navegación de...

asf__cxf_CVE-2019-17573_3-2-11

¡Bienvenido a Apache CXF! Apache CXF es un marco de trabajo de servicios de código abierto. CXF te ayuda a construir y desarrollar servicios mediante API de programación frontend, como JAX-WS y JAX-RS. Estos servicios pueden hablar una variedad de protocolos como SOAP, XML/HTTP, RESTful HTTP o...

asf__cxf_CVE-2016-6812_3-0-11

¡Bienvenido a Apache CXF! Apache CXF es un framework de servicios de código abierto. CXF te ayuda a construir y desarrollar servicios utilizando APIs de programación frontend, como JAX-WS y JAX-RS. Estos servicios pueden hablar una variedad de protocolos como SOAP, XML/HTTP, HTTP RESTful o CORBA ...

CVE-2022-26923_AD-Certificate-Services

CVE-2022-26923 AD Certificate Services Fecha de publicación : 10/05/2022 Complejidad del ataque: Baja Privilegios requeridos: Bajo Puntuación CVSS : 8.1 La vulnerabilidad permitía a un usuario con pocos privilegios escalar privilegios a administrador de dominio en un entorno predeterminado de...

CVE-2026-44715 OpenMRS has Broken Access Control in HL7 Configuration

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

CVE-2026-44715

OpenMRS , an open-source electronic medical record platform, is affected by a Broken Access Control vulnerability in its HL7 configuration. Prior to versions 1.23.0 and 2.10.0 , the administrative DWR method startHl7ArchiveMigration, which should be restricted to admin-level accounts, is accessib...

sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF & Timing Attack PoC Este script de Python es una prueba de concepto PoC para ejecutar SSRF Server-Side Request Forgery y Timing Attacks contra SAP BusinessObjects Launchpad. Está diseñado para ayudar a investigadores y profesionales de seguridad a identificar...

CVE-2026-89298

A flaw in Keycloak 's Dynamic Client Registration service allows a user with the view-clients role to retrieve a client's confidential secret in cleartext via the client registration GET endpoint. The root cause is a failure to mask sensitive information when returning client details. A read-only...

CVE-2026-89242 WWBN AVideo Unauthenticated SSRF via login.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

CVE-2026-89242

WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain a server-side request forgery (SSRF) in the _json_decode function, which fetches remote URLs and local file paths without validation. An unauthenticated attacker can POST file paths or HTTP URLs to login.json.php...

malware-ioc

Lucid La plataforma Lucid de Phishing-como-Servicio PhAAS, desarrollada por el grupo XinXin, facilita campañas de phishing a gran escala dirigidas a organizaciones globales, incluidos servicios postales y de mensajería. Utilizando tecnologías avanzadas como RCS e iMessage, el grupo emplea...

smbtakeover

smbtakeover Una técnica para desvincular y volver a vincular 445/tcp en Windows sin cargar un controlador, cargar un módulo en LSASS, ni reiniciar la máquina objetivo. Implementada para aliviar la carga de los relays NTLM basados en SMB mientras se opera a través de C2. El análisis técnico de la...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

portSpider

██████╗ ██████╗ ██████╗ ████████╗███████╗██████╗ ██╗██████╗ ███████╗██████╗ ██╔══██╗██╔═══██╗██╔══██╗╚══██╔══╝██╔════╝██╔══██╗██║██╔══██╗██╔════╝██╔══██╗ ██████╔╝██║ ██║██████╔╝ ██║ ███████╗██████╔╝██║██║ ██║█████╗ ██████╔╝ ██╔═══╝ ██║ ██║██╔══██╗ ██║ ╚════██║██╔═══╝ ██║██║ ██║██╔══╝ ██╔══██╗ ██║...

security_monkey

NOTE: Security Monkey is in maintenance mode and will be end-of-life in 2020. For AWS users, please make use of AWS Config. For GCP users, please make use of Cloud Asset Inventory. Security Monkey Security Monkey monitors your AWS and GCP accounts for policy changes and alerts on insecure...

Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

envizon

envizon - by evait security EOL https://github.com/evait-security/envizon/issues/130 We evait security moved to https://gitlab.com/invuls/pentest-projects/pcf for internal project documentation. network visualization & pentest reporting Version 5.0 This tool is designed, developed and supported b...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

ioccheck

ioccheck A tool for simplifying the process of researching file hashes, IP addresses, and other indicators of compromise IOCs. Features Look up hashes across multiple threat intelligence services, from a single command or a few lines of Python. Currenty supports the following services: VirusTotal...

[SECURITY] Fedora 44 Update: rest-0.10.2-9.fc44

This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...