AttackTomcat

AttackTomcat 检测漏洞清单 CVE-2017-12615 PUT文件上传漏洞 tomcat-pass-getshell 弱认证部署war包 弱口令爆破 CVE-2020-1938 Tomcat 文件读取/包含 使用方式 初次使用前请先在设置中重新设置配置文件，其他问题请仔细阅读！！！，java -jar .jar 启动可查看运行日志信息！！ ​ 下载源码maven编译，或者直接下载Releases。 ​ 双击jar包即可运行或执行java -jar AttackTomcat 代理 ​ 使用http和socket代理。 配置 ​ 启动jar包，生成配置文件config。 ​...

sj

sj Swagger Jacker sj 是一款命令行工具，旨在通过检查关联的 API 端点是否存在弱身份验证，来协助审计暴露的 Swagger/OpenAPI 定义文件。它还提供用于手动漏洞测试的命令模板。 它通过解析定义文件中的路径、参数和可接受的方法，然后将结果用于以下五个子命令之一： automate - 构造一系列请求并分析响应的状态码。 prepare - 生成用于手动测试的命令列表。 endpoints - 生成原始 API 路由列表。 路径值不会替换为测试数据 。 brute - 向目标发送一系列请求，以基于常用文件路径查找操作定义。 convert -...

CVE-2024-33676

CVE-2024-33676 Autenticación y autorización débiles en el cargador EV Enel X JuiceBox Level 2 permite el acceso a funciones y parámetros del sistema operativo. Descripción Los usuarios en la red WLAN local del cargador EV pueden extraer PII, cambiar configuraciones y manipular el sistema de...

ls-poc

CVE-2026-30368 Prueba de concepto !IMPORTANT Esto ya está parcheado y ahora requiere credenciales, usa el workaround para realizar acciones sobre ti mismo. Introducción CVE-2026-30368 permite a un atacante controlar los dispositivos de los estudiantes mediante una falla de autenticación débil en ...

CVE-2025-70994

CVE-2025-70994: Autenticación Débil en la Bicicleta Eléctrica Yadea T5 !WARNING Este repositorio se publica estrictamente con fines educativos y de investigación académica en seguridad. La información y el código de prueba de concepto aquí proporcionados tienen como objetivo demostrar una falla...

Weak Authentication

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Weak Authentication via the JWT authentication flow's email-based fallback lookup, which does not verify the emailverified claim before resolving a user identity. An attack...

CVE-2026-93355

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

CVE-2026-93355

The LiteLLM platform is vulnerable to a weak JWT authentication flaw caused by an email-based fallback lookup that fails to verify the email_verified claim. An attacker with a valid JWT from a configured identity provider can authenticate as any existing user by using an unverified email address ...

EUVD-2026-88462

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

CVE-2026-93355: Weak Authentication

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

PT-2026-102338

Name of the Vulnerable Software and Affected Versions LiteLLM affected versions not specified Description A weak authentication issue exists in the JWT authentication flow. An attacker with a valid JSON Web Token JWT from the configured identity provider can authenticate as any existing user by...

CVE-2026-92288: Weak Authentication

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...

BIT-DOTNET-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

BIT-DOTNET-SDK-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

BIT-ASPNET-CORE-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

sj v2.8.2

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...

CVE-2025-15679 BMC root account active without password on BullSequana XH3406 and XH3515

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

CVE-2026-77483

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-73025

Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-77483

CVE-2026-77483 affects Microsoft SQL Server and involves a weak authentication mechanism that allows an authorized attacker (low privileges required) to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) with vectors for network attack, low complexity, no user interaction, and h...