gitjacker

gitjacker Gitjackerは、誤って.gitディレクトリがアップロードされたサイトからGitリポジトリをダウンロードし、その内容を抽出します。ディレクトリリスティングが無効になっている場合でも、リポジトリのかなりの部分を復元できます。 教育目的／ペネトレーションテスト専用に使用してください。 詳細情報: https://liam-galvin.co.uk/security/2020/09/26/leaking-git-repos-from-misconfigured-sites.html インストール curl -s...

CVE-2021-41773

CVE-2021-41773 Apache HTTP Server 2.4.49-2.4.50におけるパス正規化の変更に脆弱性が見つかりました。攻撃者はパストラバーサル攻撃を使用して、期待されるドキュメントルート外のファイルにURLをマッピングする可能性があります。ドキュメントルート外のファイルが「require all denied」によって保護されていない場合、これらのリクエストは成功する可能性があります。さらに、この脆弱性により、CGIスクリプトのようなインタプリタ処理されるファイルのソースが漏洩する可能性があります。...

React2P4IM0Nshell

React2P4IM0Nshell 💥Next.jsおよびReact Server Components（RSC）環境向けの高度なRCE/ソースリーク/Dos（CVE-2025-55182/83/84）監査・エクスプロイト用拡張ツール。ブラウザから直接使用可能で、拡張機能自体に組み込まれたLinux端末で任意のリバースシェルを受信できます❌ ⚡ CMDCENTER: 核 👁️ パッシブ偵察 DOMとHTTPヘッダーを静かに分析します。window.nextfやtext/x-componentといったシグネチャを検出し、WAFに警報を発することなくNext.js App...

eos

Enemigos de Symfony EOS EOS saquea información de un objetivo Symfony en modo depuración: Sección| Descripción ---|--- General| Obtener información general sobre el objetivo. Phpinfo| Extraer las variables de entorno de Symfony del phpinfo expuesto. Routes| Obtener la lista de rutas registradas...

CVE-2026-61782

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

Information Exposure

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure via the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints. An attacker can access sensitive source code and potentially embedded secrets by making...

EUVD-2026-36421

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent incomplete fix for GHSA-6m52-m754-pw2g...

CVE-2026-49993

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack /...

CVE-2026-49993

Nuxt (Vue.js) users using the @nuxt/rspack-builder and @nuxt/webpack-builder are affected. The CVE concerns an incomplete fix for GHSA-6m52-m754-pw2g in versions 3.15.4–3.21.6 and 4.0.0–4.4.6, where the dev server could leak source code if bound to a non-loopback address and a malicious site is o...

PT-2026-48868

Name of the Vulnerable Software and Affected Versions @nuxt/rspack-builder versions 3.15.4 through 3.21.6 @nuxt/rspack-builder versions 4.0.0 through 4.4.6 @nuxt/webpack-builder versions 3.15.4 through 3.21.6 @nuxt/webpack-builder versions 4.0.0 through 4.4.6 Description An incomplete fix in the...

CVE-2026-48242: Use of Hard-coded Credentials

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials host, username, password, database name in importmdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values...

Exposed Dangerous Method or Function

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Exposed Dangerous Method or Function in Server.js, when handling non-HTTPS responses. An attacker can...

Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms

Anthropic on Tuesday confirmed that internal code for its popular artificial intelligence AI coding assistant, Claude Code, had been inadvertently released due to a human error. "No sensitive customer data or credentials were involved or exposed," an Anthropic spokesperson said in a statement...

Security Bug in StealC Malware Panel Let Researchers Spy on Threat Actor Operations

Cybersecurity researchers have disclosed a cross-site scripting XSS vulnerability in the web-based control panel used by operators of the StealC information stealer, allowing them to gather crucial insights on one of the threat actors using the malware in their operations. "By exploiting it, we...

CVE-2025-55183

A flaw was found in React Server Components RSC. This vulnerability allows an information leak, where a specifically crafted HTTP Hypertext Transfer Protocol request to a vulnerable Server Function can unsafely return its source code. Exploitation requires a Server Function that explicitly or...

EUVD-2019-8562

Malware in sbrugna...

EUVD-2023-39050

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2023-3413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions...

ERMAC V3.0 Banking Trojan Source Code Leak Exposes Full Malware Infrastructure

Cybersecurity researchers have detailed the inner workings of an Android banking trojan called ERMAC 3.0, uncovering serious shortcomings in the operators' infrastructure. "The newly uncovered version 3.0 reveals a significant evolution of the malware, expanding its form injection and data theft...