27613 matches found
ROPE
ROPE: Routed Origin Policy Enforcement Source code of our paper: ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection by Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik Abstract Indirect prompt injection IPI plants instructions in the content a...
Log4J-Log4Shell-CVE-2021-44228-Spring-Boot-Test-Service
CVE-2021-44228 Spring Boot Test Service This is a dirty hack spring boot hello world proejct to test your tooling/payloads/detection capabilities locally before you hit production targets with them. The configured Log4j version is 2.13.0 Building the docker image bash build.sh Running the docker...
Zerodapi
Zerodai Documentation Start! pip install zerodai==0.0.0.20 export zerodapikey="YOURAPIKEY" Get your api key https://zerodai.com Simple Conversational Chat - No memory from zerodai import zerodai import os zerodai.apiauthos.getenv"zerodapikey" messages = while True: prompt = input" " if prompt ==...
CVE-2024-32019-ndsudo
The ndsudo vulnerability allows an attacker to gain root permissions by exploiting an untrusted search path in the ndsudo tool, which is part of the Netdata Agent. This can enable the execution of arbitrary programs with elevated privileges if the attacker places a malicious binary in a writable...
gatekeeper-cve-2020-8554
Gatekeeper constraint for CVE-2020-8554 Install OPA client Follow the instructions. Run unit tests $ opa test --ignore=.yaml ./policies verbose output $ opa test -v --explain=full --format=pretty --ignore=.yaml ./policies...
Agent-Skills-Security-Standard
This repository does not have a README...
php-8.1.0-dev-backdoor-rce
PHP 8.1.0-dev Backdoor Remote Code Execution PHP 8.1.0-dev Backdoor System Shell Script PHP verion 8.1.0-dev was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by...
CVE-2026-61791
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...
CVE-2026-61791
Versions of OCO-Server prior to 1.2.1 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The Html::commandButton() function in lib/Html.class.php incorrectly handles stored computer hostnames by using htmlspecialchars(ENT_QUOTES) for HTML escaping only. Because browsers decode HTML entit...
EUVD-2026-108209
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...
CVE-2026-61791 OCO-Server: Stored XSS through agent hostnames in command buttons
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...
OpsGuard-simulation
OpsGuard - Simulation Dashboard ๐ฅ๏ธ This is the Frontend UI for OpsGuard. It serves as a visual "Brain" to demonstrate the autonomous SRE agent in action. Since OpsGuard is a backend-first agent, this dashboard is designed to simulate a production environment and visualize the agent's invisible...
CVE-2025-4660
Description A PoC for CVE-2025-4660, Forescout SecureConnector RCE forescoutredirect.py This is the exploit itself where you can redirect an agent to a specific IP address under the attackers control forescoutc2.py A simple C2 implementation that speaks the ForeScout SecureConnector language...
agent-scanning
Control your AI agents. Track costs. Stay compliant. open-souce What It Does One dashboard to manage your AI team. Feature| How It Helps ---|--- Connect your agents| Plug in OpenAI, Anthropic, or custom agents Set goals & budgets| Assign work, cap costs, define success Watch in real-time| See wha...
Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis
1. Native API & APC Injection The x64dbg memory dump reveals that Agent Tesla uses Native API NT API calls for low-level operations, including APC Asynchronous Procedure Call injection. Key Functions Observed: NtQueueApcThread โ Injects code into a target thread via APC. NtReadVirtualMemory โ...
SBOM-VEX-Taint-Analysis
SBOM โ VEX Agent Automatically generate signed CycloneDX VEX documents from SBOMs using a secure multi-agent AI pipeline, built in accordance with the OWASP GenAI Security Project guidelines. The Problem Generating an SBOM surfaces hundreds of CVEs. In practice, over 90% are not exploitable in a...
CVE-2025-68664
CVE-2025-68664 All I Want for Christmas Is Your Secrets: LangGrinch Strikes LangChain Core CVE-2025-68664 Author: Yarden Porat Cyata Research: LangGrinch Vulnerability in LangChain Published: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Yesterday LangChain published a critical...
StepJack
StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection Setup 1. Python Environment Setup First, install all dependencies and ensure youโre running Python 3.10. conda create -n stepjack python=3.10 conda activate stepjack pip install -r requirements.txt 2...
CVE-2025-9816
CVE-2025-9816 Stored XSS On WP-Statistics Plugin Scanner Detection & PoC "The WP Statistics โ The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to...