AppInfoScanner

语言/Language : 简体中文 | English 该项目目前仅仅是规划项目中的冰山一角，如果您对此项目感兴趣或者想参与后续项目的开发工作或者翻译工作中，请发送邮件至[email protected]说明你的能力和诉求。 AppInfoScanner 一款适用于以HW行动/红队/渗透测试团队为场景的移动端Android、iOS、WEB、H5、静态网站信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、状态信息等。 官网/文档站 :...

cloudtoolkit

CloudToolKit English | 简体中文 Multi-cloud defensive validation toolkit for CSPM / CNAPP detection, telemetry, and investigation workflows in authorized environments. CloudToolKit gives security teams a practical way to verify whether cloud controls are discoverable, detectable, alertable, and...

awesome-censys-queries

Awesome Censys Queries A collection of fascinating and bizarre Censys Search queries. Contributing Found an awesome query? Submit it here Interested in contributing in another way? See the contributing guidelines Resources Censys Search CensysGPT Beta - AI Generated Queries Legacy Search Queries ...

cloudlist

機能 • インストール • 使用方法 • 設定 • cloudlistの実行 • サポート対象プロバイダ • ライブラリ • Discordに参加 Cloudlistは、クラウドプロバイダからアセットを取得するためのマルチクラウドツールです。ブルーチームが攻撃対象領域管理（Attack Surface Management）の取り組みを強化するために、最小限の設定作業で複数のクラウドにわたるアセットの集中管理リストを維持することを目的としています。 機能 複数の設定でクラウドアセットを一覧表示 複数のクラウドプロバイダをサポート キーレス認証のサポート（AWS IRSA /...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization via the GET /hardware/asset/barcode endpoint. An attacker can access barcodes and enumerate asset tags across tenants, including soft-deleted and...

CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-86737: Missing Authorization

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-75108

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...

CVE-2026-75108

Next Terminal is vulnerable due to missing per-asset authorization checks on its portal ping and wake-on-LAN endpoints . Any authenticated user (PR:L) can supply arbitrary asset IDs to retrieve unauthorized asset metadata (display names, reachability, network addresses) or trigger wake-on-LAN pac...

CVE-2026-75108 Next Terminal Missing Per-Asset Authorization on Portal Endpoints

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...

PT-2026-76802

Name of the Vulnerable Software and Affected Versions Next Terminal affected versions not specified Description Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints. This allows any authenticated user to probe and wake assets they are not...

CVE-2026-44012

Craft CMS is a content management system CMS. From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder fetches an asset by ID and returns its filename and complete folder hierarchy including volume handle, volume UID, folder names, folder UIDs, and folder URI paths without checking...

CVE-2026-44012

Craft CMS is a content management system CMS. From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder fetches an asset by ID and returns its filename and complete folder hierarchy including volume handle, volume UID, folder names, folder UIDs, and folder URI paths without checking...

CVE-2026-44012: Missing Authorization

Craft CMS is a content management system CMS. From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder fetches an asset by ID and returns its filename and complete folder hierarchy including volume handle, volume UID, folder names, folder UIDs, and folder URI paths without checking...

Craft CMS 安全漏洞

Craft CMS is an open-source content management system developed by Craft Studio. Versions of Craft CMS from 5.0.0-RC1 to 5.9.18 contained security vulnerabilities. These vulnerabilities stemmed from the AssetsController::actionShowInFolder method, which did not check user permissions when...

CVE-2026-35383

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete...

EUVD-2026-18544

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete...

CVE-2026-35383

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete...