5970 matches found
SUSE CVE-2026-28699
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication...
SUSE CVE-2026-40885
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and th...
SUSE CVE-2026-47203
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth i.e via the Authorization header with the Basic scheme on t...
axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth
A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in it...
Tomcat Manager Default Login
Detects Apache Tomcat Manager default credentials via HTTP Basic. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat Manager default login.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient Common Tomcat Manager credential pairs CREDS = "tomcat"...
CVE-2026-68503: Use of Default Credentials
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payloadschema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachabl...
PT-2026-66625
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The MMS server connection handler contains a flaw in the processing of BER-encoded request data. When an MMS confirmed request PDU Protocol Data Unit containing ...
PT-2026-66413
The Spring Boot language server logs the raw value of the https proxy/HTTPS PROXY/http proxy/HTTP PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth...
PT-2026-66624
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The MMS BER decoder contains a flaw when decoding fixed-width BER Basic Encoding Rules fields, specifically booleans and integers. The issue occurs because a...
PT-2026-66609
Name of the Vulnerable Software and Affected Versions LazyOwn RedTeam/APT Framework versions prior to 0.2.154 Description LazyOwn ships with default C2 credentials in payload.json and core/payload schema.py, which are passed unchanged to lazyc2.py for HTTP Basic authentication. This allows a...
vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects
A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...
Guarding Organizations against Malware Risk: A Novel Graph-Based Malware Detection Method
Organizational digitalization expands cybersecurity risks, making cybersecurity an increasingly important research area in Information Systems IS. Among these risks, malware has become a pervasive and destructive threat. Byte-based machine learning ML methods are widely used for malware detection...
hono: Hono - Timing Attack in basicAuth and bearerAuth Middleware
A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...
hono: Hono - Timing Attack in basicAuth and bearerAuth Middleware
A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...
Malicious Package
Overview basic-vite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
CVE-2026-56764
A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...
MAL-2026-11131 Malicious code in basic-vite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...
Telecontrol Server Basic Panel - Detect
Telecontrol Server Basic panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Telecontrol Server Basic panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Telecontrol Server Basic Pane...
Basic Auth Detection
Detects Basic Auth Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Basic Auth Detection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Basic Auth Detection', 'description': 'Detects Basic...
