Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

GHSA-8PHW-XRJ9-CPQP Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.71 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.71 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

spacesiren

SpaceSiren SpaceSiren is a honey token manager and alert system for AWS. With this fully serverless application, you can create and manage honey tokens at scale -- up to 10,000 per SpaceSiren instance -- at close to no cost.1 How It Works SpaceSiren provides an API to create no-permission AWS IAM...

TriforceAFL

New: For those looking to play with TriforceAFL and TLSF, Richard Johnson created a Dockerfile which installs both and even builds a Linux kernel for you. It's available here https://hub.docker.com/r/moflow/afl-triforce/tags/. Also new: afl-tmin now works with the forkserver!...

OSINT-with-LLM

POC : OSINT with LLM This repository demonstrates domain, IP, and email reconnaissance with LLM-powered security reporting.. Overview The project is divided into two main components : 1. Recon Modules 2. LLM Analysis and reporting Recon Modules Purpose Gathering information about an ip, domain or...

sift-kg

sift-kg Convierte cualquier colección de documentos en un grafo de conocimiento. Sin código, sin base de datos, sin infraestructura — solo una CLI y tus documentos. Ingresa PDFs, artículos, papers o registros — obtén un grafo de conocimiento navegable que muestra cómo todo se conecta, en cuestión...

matchlock

Matchlock Experimental: Este proyecto aún está en desarrollo activo y sujeto a cambios importantes. Matchlock es una herramienta CLI para ejecutar agentes de IA en microVMs efímeras, con listas de permisos de red, inyección de secretos a través de un proxy MITM y aislamiento a nivel de VM. Tus...

globaleaks-whistleblowing-software

GlobaLeaks 是一款免费且开源的举报软件，任何人都能轻松地建立并维护一个安全的举报平台。 该软件已被数字公共产品联盟认定为数字公共产品。 持续集成与测试 质量指标与评分 OpenHub 上的项目统计: www.openhub.net/p/globaleaks 基础设施状态: uptime.globaleaks.org 文档 GlobaLeaks 的文档可访问: docs.globaleaks.org 社区支持 如果您需要技术支持、有一般性问题或对 GlobaLeaks 有新想法，请在社区论坛上发布您的消息。 加入我们的社区聊天与开发团队和 GlobaLeaks 社区取得联系：...

CVE-2025-29927

Advanced CVE-2025-29927 Vulnerability Scanner This is a professional-grade scanner designed to detect the CVE-2025-29927 middleware bypass vulnerability in Next.js applications. 🧠 What It Does Uses a real headless browser Playwright to deeply crawl a target website JS-rendered content included...

trojanizer

TROJANIZER root@kitploit: Version release : v1.1 Stable Author : pedro ubuntu r00t-3xp10it Codename: TroiaRevisited Distros Supported : Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam develop @2017 FRAMEWORK DESCRIPTION root@kitploit: The Trojanizer tool uses WinRAR SFX to...

trojanizer

TROJANIZER（特洛伊制造器） root@kitploit: 版本发布 : v1.1（稳定版） 作者 : pedro ubuntu r00t-3xp10it 代号 : TroiaRevisited 支持的发行版 : Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam 开发 @2017 框架描述 root@kitploit: Trojanizer 工具使用 WinRAR（SFX）压缩用户输入的两个文件， 并将其转换为 SFX 可执行（.exe）存档。当 SFX 存档执行时，...

CVE-2025-31131

CVE-2025-31131 - Explotación de Path Traversal en YesWiki 4.5.2 Este es un exploit de path traversal no autenticado dirigido a versiones de YesWiki anteriores a la 4.5.2. La vulnerabilidad existe en el parámetro squelette, que permite leer archivos arbitrarios del servidor. Detalles de la...

vet v1.19.1

Quick Start • Documentation • Community !NOTE vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository. Why vet? 70-90% of modern software is open source code — how do you know it's safe? Traditional SCA tools drown you in CVE...

ThreatKB

NOTA: ESTE REPOSITORIO ESTÁ EN ESTADO ALFA ThreatKB es un panel de gestión de flujo de trabajo de base de conocimiento para reglas YARA y artefactos C2. Las reglas se categorizan y se utilizan para indicar intención, gravedad y confianza en los artefactos acumulados. Para empezar a usar ThreatKB,...

gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

gcp_scanner

免责声明 本项目并非 Google 官方项目。Google 不对其提供支持，且明确声明不对其质量、可销售性或特定用途的适用性承担任何保证责任。 GCP Scanner 这是一个 GCP 资源扫描器，可以帮助确定特定凭据在 GCP 上的访问级别。该扫描器旨在帮助安全工程师评估特定 VM/容器被入侵、GCP 服务帐户或 OAuth2 令牌密钥泄露的影响。 目前，该扫描器支持以下 GCP 资源： GCE GCS GKE App Engine Cloud SQL BigQuery Spanner Pub/Sub Cloud Functions BigTable CloudStore KMS...

DVSA

una aplicación serverless deliberadamente vulnerable Damn Vulnerable Serverless Application DVSA es una aplicación deliberadamente vulnerable que pretende ser una ayuda para que los profesionales de la seguridad pongan a prueba sus habilidades y herramientas en un entorno legal, ayudar a los...

Exploit for CVE-2026-88533

CVE-2026-88533: Unauthenticated Arbitrary File Write → Root RC...

flopz

Flopz - 基于Python的固件解放工具 Flopz 是一个纯 Python 编写的汇编工具包。可用它来： 为嵌入式系统创建 Shellcode 动态修补大量二进制文件 对固件镜像进行插桩，用于调试和模糊测试 目前 Flopz 支持： ARM：Thumb 模式 PPC：仅 VLE RISC-V：RV32I、RV32C IA-32 如果您希望看到其他架构得到支持，欢迎随时联系我们——我们乐于从事这项工作！ Flopz 与 keystone、rasm2、gcc 等工具有何不同？ Flopz 不仅仅是将汇编字符串转换为字节，而是致力于让交互式修补和固件插桩变得更加容易。...