CloudScraper

CloudScraperは、ターゲットをスパイダリングおよびスクレイピングしてクラウドリソースを探すツールです。URLを入力すると、スパイダリングを行い、スパイダリングされたページのソースから's3.amazonaws.com'、'windows.net'、'digitaloceanspaces'などの文字列を検索します。現在、AWS、Azure、Digital Oceanのリソースをサポートしています。 @okbyenow 前提条件 標準外のPythonライブラリ: requests rfc3987 termcolor Python 3.6で作成 概要 このツールは、Bryce...

CVE-2024-41107

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 我々は、テロ組織ハマスによって人質に取られたすべての市民の安全な帰還を要求します。すべての人質が解放され、無事に帰還するまで、我々は休むことはありません。あなたも彼らを家に連れ戻す手助けができます。https://stories.bringthemhomenow.net/ 🚀 CVE-2024-41107 エクスプロイト 🚀 このリポジトリには、Apache CloudStack の深刻な脆弱性 CVE-2024-41107 に対するエクスプロイトが含まれています。この脆弱性は、バージョン 4.5.0 から...

CloudBrute

CloudBrute 企業（ターゲット）のインフラ、ファイル、アプリを主要クラウドプロバイダー（Amazon、Google、Microsoft、DigitalOcean、Alibaba、Vultr、Linode）上で見つけるためのツールです。 その成果は、バグバウンティハンター、レッドチーム、ペネトレーションテスターのいずれにも役立ちます。 完全な解説記事はこちらで入手可能です。 一目で 動機...

CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

PT-2026-71081

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource tags, assembled by unroll dict and parse html string, into generated reports without HTML escaping, allowing a cloud principal who can modify a...

Duplicate Advisory: Google Service Account Private Key Exposed in JWT Header

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9r8p-h6cc-6qhm. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a...

report-anonymizer

🛡️ Report Anonymizer Local LLM anonymizer for penetration-t...

CVE-2025-61120

AG Life Logger Android App version v1.0.2.72 and before package name com.donki.healthy, developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force...

EUVD-2025-37025

AG Life Logger Android App version v1.0.2.72 and before package name com.donki.healthy, developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force...

CVE-2025-61120

AG Life Logger Android App version v1.0.2.72 and before package name com.donki.healthy, developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force...

CVE-2025-61121

Mobile Scanner Android App version 2.12.38 package name com.glority.everlens, developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handling of cloud service credentials may allow attackers to obtain them and carry out unauthorized actions, such as sensitiv...

PT-2025-44431

Name of the Vulnerable Software and Affected Versions Mobile Scanner version 2.12.38 Description The Mobile Scanner Android App has a flaw where cloud service credentials are not handled securely. This could allow attackers to gain access to these credentials and perform unauthorized actions. The...

IOFIT AG Life Logger Android App 安全漏洞

IOFIT AG Life Logger Android App is a sports app from IOFIT Japan. A security vulnerability exists in IOFIT AG Life Logger Android App v1.0.2.72 and earlier versions, which stems from improper access control and a predictable CAPTCHA, and could lead to account disclosure and misuse of cloud...

CVE-2025-55306

GenXFX is an advance IA trading platform that will focus on forex trading. A vulnerability was identified in the GenX FX backend where API keys and authentication tokens may be exposed if environment variables are misconfigured. Unauthorized users could gain access to cloud resources Google Cloud...

Microsoft WinJS winjsdevelop Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft WinJS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of WinJS. When installed from the official Microsoft NPM repository, th...

Amazon AWS CloudFormation Templates Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Amazon AWS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of AWS Simple Storage Service. When installed from the official GitHub...

Axis Communications Autodesk Plugin AxisAddin axisapphelpfiles Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Axis Communications Autodesk Plugin. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of a cloud resource. The issue results from allowi...

Amazon AWS aws-glue-with-s2s-vpn Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Amazon AWS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of AWS Glue. When installed from the official GitHub repository, the...

Microsoft Partner Resources openhacks Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Partner Resources. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of Partner Resources. When installed from the official...

Microsoft Azure uAMQP azure-iot-sdks-ci Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of uAMQP. When installed from the official Microsoft GitHub repository,...