LWHP

LWHP Точки усиления безопасности Linux и Windows Руководства по усилению безопасности никогда не могут быть полными, поскольку каждая система требует различной конфигурации. Учитывайте это при использовании этих документов и воспринимайте пункты, описанные в этом репозитории, как рекомендации...

otseca

Outil open source d'audit de sécurité pour rechercher et extraire la configuration système. Introduction | Description | Prérequis | Sortie | Paramètres | Rapports | Fonctionnement | Autres Introduction Objectif principal L'hypothèse principale de la création de cet outil était une livraison plus...

otseca

Open source security auditing tool to search and dump system configuration. Introduction | Description | Requirements | Output | Parameters | Reports | How it works | Other Introduction The main goal The main assumption of creating this tool was easier and faster delivery of commands sets to be...

Dify v1.9.1 - Broken Access Control

Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data. id: CVE-2025-63387 info: name: Dify v1.9.1 - Broken Access Control author:...

mallory

mallory HTTP/HTTPS proxy over SSH. Installation Local machine: go install github.com/justmao945/mallory/cmd/mallory@latest Remote server: need our old friend sshd Configuration Config file Default path is $HOME/.config/mallory.json, can be set when start program mallory -config path/to/config.jso...

CVE-2026-18185

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

PT-2026-97352

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A missing authentication requirement for a critical function allows a remote attacker to access sensitive information and modify system...

CVE-2026-18185: Missing Authentication for Critical Function

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

UBUNTU-CVE-2026-84990

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-89175

The Smart Video Intercom System developed by Kingdom Communication Associated contains a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values. The CVSS 3.1 score is 5.3 (MEDIUM)...

SAP NetWeaver AS ABAP Missing Authorization Check (3772838)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3772838: - Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker...

CVE-2026-85400 TYPO3 CMS - Missing Authorization in lowlevel commands

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...

EUVD-2026-72583

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2026-76963 Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2026-76963: Missing Authorization

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

PT-2026-86958

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2026-73726: Missing Authentication for Critical Function

A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjacent actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access,...

CVE-2026-73737: Improper Limitation of a Pathname to a Restricted Directory

An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations,...

CVE-2026-79744

MCPHub is a unified hub for centrally managing and orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29 , the PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check — it is protected only by...

CVE-2026-76846: Insufficiently Protected Credentials

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...