281 matches found
PetitPotam
PetitPotam Herramienta PoC para forzar a hosts Windows a autenticarse en otras máquinas a través de MS-EFSRPC EfsRpcOpenFileRaw u otras funciones : Las herramientas utilizan la tubería con nombre LSARPC con la interfaz c681d488-d850-11d0-8c52-00c04fd90f7e porque es más prevalente. Pero es posible...
Coercer
Un script en Python para forzar automáticamente a un servidor Windows a autenticarse en una máquina arbitraria mediante muchos métodos. Soporte para Windows Para compilar un binario para Windows, descarga el script installer.ps1 de este repositorio. Ejecútalo simplemente sin argumentos para crear...
windows-coerced-authentication-methods
This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine. All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine usually a domain controller to authenticate ...
Astra Linux – Vulnerability in exim4
Exim NTLM Challenge Out-of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected Exim installations. Authentication is not required to exploit this vulnerability. The specific flaw lies in the handling of NTLM...
CVE-2026-73005
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
EUVD-2026-73767
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
Windows Authentication Methods Elevation of Privilege Vulnerability
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
CVE-2026-73005: Use After Free
Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally...
PT-2026-87914
Name of the Vulnerable Software and Affected Versions Windows Authentication Methods affected versions not specified Description A use after free issue in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. Use after free is a memory corruption flaw that...
CVE-2026-13192: Server-Side Request Forgery (SSRF)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...
CVE-2026-57288
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native ADSI authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a...
LDAP injection vulnerability in active-directory
In active-directory 2.41.1 and earlier, the Windows native ADSI authentication path does not escape the user name before building the LDAP search filter. This allows unauthenticated attackers to inject LDAP wildcard characters into the user name, enabling them to enumerate directory user and grou...
CVE-2026-56968
CVE-2026-56968 affects GNU SASL versions prior to 2.2.4. The NTLM client’s short challenge in the function _gsasl_ntlm_client_step has inadequate sanitization, which can lead to memory disclosure when interacting with a crafted server. Public sources (SUSE, Debian OSV, Ubuntu/Ubuntu-related advis...
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
Impact When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT default 10 hours and decrypt or forge any subsequent WS‑SecureConversation traffic that uses...
GHSA-WQP7-X3PW-XC5R Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Summary When serving static files on Windows, StaticFiles resolves the requested path with os.path.realpath. If a UNC path such as \attacker.com\share reaches the resolver, realpath causes the process to open a connection to the remote host over SMB port 445. This is a server-side request forgery...
EUVD-2026-36725
Mattermost Desktop App versions =6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that...
PT-2026-49575
Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.1 Description The launch-editor NPM package allows the access of arbitrary paths, including Windows UNC Universal Naming Convention paths. On Windows systems, accessing a UNC path triggers an automatic NTLM...
CVE-2026-50508
Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-50508
CVE-2026-50508 describes an exposure of sensitive information in Windows NTLM that enables an unauthenticated network-based spoofing capability. The vulnerability affects the Windows NTLM authentication path and is documented with a network attack vector and a high confidentiality impact. Public ...
