Self-Replicating Worm Hits 180+ npm Packages to Steal Credentials in Latest Supply Chain Attack

Cybersecurity researchers have flagged a fresh software supply chain attack targeting the npm registry that has affected more than 40 packages that belong to multiple maintainers. "The compromised versions include a function NpmModule.updatePackage that downloads a package tarball, modifies...

CVE-2025-54388 vulnerabilities

Vulnerabilities for packages: apko-fips, buildkitd-fips, agentbeat-fips, docker-cli-buildx-fips, splunk-otel-collector, beats-fips, apko, nerdctl-fips, buildkitd, opentelemetry-collector, docker-compose, openfga-fips, grype-fips, trufflehog, elastic-agent, falcoctl, zot, spire-server,...

GHSA-X4RX-4GW3-53P4 vulnerabilities

Vulnerabilities for packages: apko-fips, buildkitd-fips, agentbeat-fips, docker-cli-buildx-fips, splunk-otel-collector, beats-fips, apko, nerdctl-fips, buildkitd, opentelemetry-collector, docker-compose, openfga-fips, grype-fips, trufflehog, elastic-agent, falcoctl, zot, spire-server,...

CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

TruffleHog Explorer - A User-Friendly Web-Based Tool To Visualize And Analyze Data Extracted Using TruffleHog

Welcome to TruffleHog Explorer , a user-friendly web-based tool to visualize and analyze data extracted using TruffleHog. TruffleHog is one of the most powerful secrets discovery, classification, validation, and analysis open source tool. In this context, a secret refers to a credential a machine...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: tkn, docker, rekor, crossplane, pulumi, minio-operator, gitsign, flyte, trufflehog, actions-runner-controller, grafana-alloy, aactl, octo-sts, amazon-cloudwatch-agent-operator, distribution, azcopy, kubescape, flux, gitea, falcosidekick, opentelemetry-collector,...

GO-2024-3076 Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog

Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog...

Server-Side Request Forgery (SSRF)

TruffleHog is vulnerable to unauthorized request execution. The vulnerability is due to insufficient validation of the data being scanned by TruffleHog's detectors, which allows maliciously crafted data to trigger unauthorized requests to attacker-chosen endpoints...

SUSE CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

Trufflehog vulnerable to Blind SSRF in some Detectors

Impact What kind of vulnerability is it? Who is impacted? This vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective,...

GHSA-3R74-V83P-F4F4 Trufflehog vulnerable to Blind SSRF in some Detectors

Impact What kind of vulnerability is it? Who is impacted? This vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective,...

CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-43379

CVE-2024-43379 concerns TruffleHog, a secrets-scanning tool. According to the connected documents, the issue is a Blind SSRF vulnerability in some detectors prior to version 3.81.9 . The attack requires an attacker-crafted input that, when scanned, could cause an unauthenticated GET endpoint that...

CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

TruffleHog 安全漏洞

TruffleHog is an open source tool from Truffle Security. A security vulnerability exists in versions of TruffleHog prior to v3.81.9. An attacker uses the vulnerability to somehow produce data that, when scanned by a specific detector, sends an unauthorized request to an endpoint of the attacker's...

PT-2021-23636

ParsedReport CompletenessLow 07-10-2025 Crimson Collective: A New Threat Group Observed Operating in the Cloud https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud Report completeness: Low Actors/Campaigns: Crimson collective Threats: Truffleho...

GitDorker - A Tool To Scrape Secrets From GitHub Through Usage Of A Large Repository Of Dorks

GitDorker is a tool that utilizes the GitHub Search API and an extensive list of GitHub dorks that I've compiled from various sources to provide an overview of sensitive information stored on github given a search query. The Primary purpose of GitDorker is to provide the user with a clean and...

Commit Stream - OSINT Tool For Finding Github Repositories By Extracting Commit Logs In Real Time From The Github Event API

commit-stream drinks commit logs from the Github event firehose exposing the author details name and email address associated with Github repositories in real time. OSINT / Recon uses for Redteamers / Bug bounty hunters: Uncover repositories which employees of a target company is commiting code...