nextpnr

nextpnr -- 便携式FPGA布局布线工具 nextpnr 的目标是成为一个供应商中立、时序驱动、开源免费的FPGA布局布线工具。 目前nextpnr支持： 由Project IceStorm支持的Lattice iCE40器件 由Project Trellis支持的Lattice ECP5器件 由Project Oxide支持的Lattice Nexus器件 由Project Apicula支持的高云小蜜蜂和Aurora V器件 由Project Beyond支持的NanoXplore NG-Ultra器件 由Project Peppercorn支持的Cologne Chip...

CVE-2020-13457

CVE-2020-13457 CVE-2020-13457 时间线 ================ 2020-05-04: 发现 2020-05-11: 在研究员环境中重新测试问题 2020-05-20: 在 Windows 2012 x64 上测试了 PoC 漏洞利用 2020-05-25: 已通知厂商 2020-05-27: 在 Windows 10 x64 上测试了 PoC 漏洞利用 2020-06-01: 等待厂商反馈/修复... 作者 Alex Hernandez aka @alt3kx...

CVE-2026-93343

The MarketKing WordPress plugin (Multivendor Marketplace for WooCommerce) before version 2.1.72 contains a missing authorization flaw in the marketking_admin_vendors_ajax AJAX action. Due to absent capability checks, any authenticated user with subscriber-level access or higher can send a crafted...

fire-hd-ownership

fire-hd-ownership Siendo dueño de la tableta que ya compré. En noviembre de 2022 compré una Fire HD 10 11.ª generación, modelo de 2021 en eBay por $114.26 para que fuera un kiosco de Home Assistant. Funcionó bien durante años, pero luego empezó a apagarse sola. Los registros decían por qué: el...

umap

umap - the USB host security assessment tool Based on Facedancer by Travis Goodspeed: http://goodfet.sourceforge.net/hardware/facedancer21/ Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com...

owasp-cstg

OWASP 云安全测试指南 云安全测试指南（CSTG） 是一份全面、厂商中立的云环境安全测试手册。它面向渗透测试人员、云和平台工程师、安全架构师、检测工程师以及审计师——任何需要评估或防御运行在主流云提供商上的基础设施的人员。 云提供商发布和变更服务的速度比任何单一个团队能够追踪的速度都要快，而每一项新的托管服务都带来了其自身的身份模型、网络暴露面和滥用路径。传统的网络和应用测试方法论无法捕获这些提供商特定的风险：一个 S3 存储桶策略、一个权限过高的 IAM 角色、一个附加到虚拟机的托管标识、或者一个可写入的部署存储桶——这些都不是端口扫描或 Web 代理能够发现的结果。CSTG...

viproy-voipkit

Discontinued Viproy was a PoC VoIP security assessment tool which had several modules and exploits to maintain. However, it was developed as a modules set to Metasploit Framework. As Metasploit Framework had significant updates, Viproy's current modules won't be able to work unless you use legacy...

Credential-and-breach-monitoring

泄露/窃密日志/身份暴露服务对比（附评分） 本文档从现代安全团队实际关心的维度，对泄露情报、暗网监控和身份暴露服务进行了比较。 重点关注： 泄露语料库深度 窃密日志覆盖率 API 可用性 会话令牌 / Cookie 监控 厂商定位 目标不是评选单一胜者，而是为安全团队评估以下用途的供应商提供一个结构化、实用的比较： 泄露情报增强 身份暴露监控 窃密软件驱动的入侵检测 自动化与安全运维中心集成 原始比较表 服务| 链接| 泄露语料库深度| 窃密日志访问| API| 会话令牌/Cookie| 核心定位 ---|---|---|---|---|---|--- Lunar|...

CVE-2018-12597

CVE-2018-12597 CVE-2018-12597 时间线 ================ 2018-06-08: 发现 2018-06-11: 在预发布环境重新测试 2018-06-12: 在正式环境重新测试 2018-06-19: 内部沟通 2018-06-21: 通知供应商 2018-06-XX: 供应商反馈 2018-06-XX: 供应商反馈产品将修补 2018-06-XX: 补丁可用 2018-06-XX: 与供应商达成协议，发布CVE/公告 2018-06-XX: 公开报告 作者 Alex Hernandez 又名 @alt3kx...

CVE-2018-12598

CVE-2018-12598 CVE-2018-12598 Timeline ================ 2018-06-08: Discovered 2018-06-11: Retest staging environment 2018-06-12: Retest live environment 2018-06-19: Internal communication 2018-06-21: Vendor notification 2018-06-XX: Vendor feedback 2018-06-XX: Vendor feedback product will be...

should-i-trust

should-i-trust Summary should-i-trust is a tool to evaluate OSINT signals for a domain. Requirements should-i-trust requires API keys from the following sources: Censys.io - Free for for first 250/quries/month VirusTotal - Free GrayHatWarFare - Free with limited results Use Case You're part of a...

should-i-trust

should-i-trust 摘要 should-i-trust 是一个用于评估域名的 OSINT 信号的工具。 要求 should-i-trust 需要以下来源的 API 密钥： Censys.io - 注册后前250次查询/月免费 VirusTotal - 免费 GrayHatWarFare - 免费，结果有限 使用场景 您是负责评估新供应商的审查委员会成员。您的具体职责是确保新供应商满足合规性和安全要求。 标准操作流程是要求提供以下一项或全部：SOC...

buyer-eval-skill

Buyer Eval — El Rotten Tomatoes del software B2B Un skill gratuito y de código abierto para Claude que evalúa proveedores B2B conversando con sus agentes de IA, contrastando cada afirmación con fuentes independientes y puntuando lo que está verificado frente a lo que es solo marketing optimista...

ike-scan

ike-scan Discover and fingerprint IKE hosts IPsec VPN Servers Table of Contents Building and Installing Overview Usage Implementation Details Host Input and Memory Requirements Rate Limiting Cookie Generation and Remote Host Identification IKE Packet Details Backoff Fingerprinting Program Output...

Emlog Pro v2.1.14 - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. id: CVE-2023-41621 info: name: Emlog Pro v2.1.14 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. impact: ...

Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection

SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request. id: CVE-2018-6605 info: name: Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection author: DhiyaneshDk severity...

74cms - ajax_officebuilding.php SQL Injection

A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajaxofficebuilding.php. id: CVE-2020-22210 info: name: 74cms - ajaxofficebuilding.php SQL Injection author: ritikchaddha severity: critical description: | A SQL injection vulnerability exists in 74cms 3.2.0 via the x...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

74cms - ajax_street.php 'x' SQL Injection

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php. id: CVE-2020-22208 info: name: 74cms - ajaxstreet.php 'x' SQL Injection author: ritikchaddha severity: critical description: | SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php. impact: | Successful...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...