CVE-2025-32433-Detection

Rilevamento CVE-2025-32433 Autore: te0rwx Creazione: 2025-08-27 Agg. 2026-08-16 Descrizione Una regola YARA personalizzata per il rilevamento di artefatti noti associati a CVE-2025-32433 , una vulnerabilità di esecuzione remota di codice RCE pre-autenticazione SSH in Erlang/OTP. La regola è stata...

CVE-2024-6387_Checker

CVE-2024-6387Checker Versioni patchate escluse SSH-2.0-OpenSSH8.9p1 Ubuntu-3ubuntu0.10+ SSH-2.0-OpenSSH9.3p1 Ubuntu-1ubuntu3.6+ SSH-2.0-OpenSSH9.3p1 Ubuntu-3ubuntu3.6+ SSH-2.0-OpenSSH9.6p1 Ubuntu-3ubuntu13.3+ SSH-2.0-OpenSSH9.2p1 Debian-2+deb12u3+ SSH-2.0-OpenSSH8.4p1 Debian-5+deb11u3+...

CVE-2024-6387

CVE-2024-6387 Questo script, creato da R4Tw1z, è progettato per scansionare indirizzi IP e verificare se eseguono una versione potenzialmente vulnerabile di OpenSSH. Questo script è una versione più veloce e semplice di uno scanner di vulnerabilità OpenSSH. Lo strumento sfrutta il multi-threading...

Scanner_CVE_OpenSSH

Scanner zur Identifizierung von Servern mit SSH-Software, die möglicherweise anfällig für die CVEs CVE-2024-6387 und CVE-2023-48795 ist. Abgedeckte CVEs CVE| Name| Bedingung| Schweregrad ---|---|---|--- CVE-2024-6387| regreSSHion| OpenSSH 9.8p1| CRITICAL CVE-2023-48795| Terrapin| OpenSSH 9.6| HIG...

Belati

Belati Belati - Il tradizionale coltellino svizzero per OSINT Belati è uno strumento per la raccolta di dati pubblici e documenti pubblici da siti web e altri servizi a scopo OSINT. Questo strumento è ispirato da Foca e Datasploit per OSINT : Versione corrente v0.2.4 Belati in azione Perché l'ho...

CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

PS2

PS2 Uno scanner di porte scritto interamente in PowerShell. Dichiarazione di non responsabilità Questo strumento è stato progettato solo per scopi legali; gli utenti sono responsabili di garantire che il loro utilizzo di questo strumento sia conforme a tutte le leggi applicabili. Utilizzando ques...

PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response

The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor whose plugins are available in the official WordPress plugins directory. Currently, all the affected plugins are temporarily closed pending a full...

MAL-2026-13320 Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

EUVD-2026-53340

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with permissioncallback = 'returntrue' in all versions up to, and including, 1.1.16. This makes i...

CVE-2026-7529 wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with permissioncallback = 'returntrue' in all versions up to, and including, 1.1.16. This makes i...

MAL-2026-12048 Malicious code in tinkoff-boxy-desktop-features-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9792640803b7c90320c995d134baefcd36a52037d1947a3c0262c9d9e5ada168 The package's main entry index.js requires./setup at load time. setup.js assembles obfuscated Cloudflare Workers hostnames via array-join concatenati...

CVE-2026-15136

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated...

CVE-2026-15136 Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated...

CVE-2026-49977

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by...

CVE-2026-49977

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by...

CVE-2026-49977 tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by...

SUSE CVE-2026-44240

basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before...

PYSEC-2026-2470 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Summary fides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the...