pwnlift

pwnlift Nombrado en homenaje a pwndrop, pwnlift es una aplicación de servidor dotnet simple para subir archivos desde un escritorio sin el uso de un C2. Útil si tienes acceso a la consola de una máquina y necesitas llevarte archivos fuera de línea para su análisis como archivos de directiva de...

woodpecker-plugins

woodpecker-plugins usage Copie el plugin en el directorio woodpecker-framwork/plugin y ejecute java -jar woodpecker-framework.1.3.3.jar de https://github.com/woodpecker-appstore weblogic-info check T3 isOpen: echo 't3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n'|nc 10.20.31.1...

EUVD-2026-84984

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...

CVE-2026-92930

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...

CVE-2026-92930: Use of Insufficiently Random Values

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...

CVE-2026-92930

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...

PT-2026-97113

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder NVR versions 2.2.3.4 through 3.2.9.376 Description The administrator password-reset unlock-code design lacks a per-device secret or server-side cryptographic material. An attacker with physical-console acces...

ROS-20260812-73-0037

The vulnerability of the XStream library used by Jenkins automation servers is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to replace HTTP requests, gain unauthorized access to the Script Console, execute arbitrary code, or...

EUVD-2026-55081

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-67357

ArcadeDB before 26.7.3 has an information-disclosure vulnerability in the MCP get_server_settings tool that leaks arcadedb.ha.clusterToken in cleartext. With MCP access, an attacker can use the cluster token via X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root an...

Permissive regular expression vulnerability in Tegalog -Fumy Otegaru Memo Logger-

Overview Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains the following vulnerability: Permissive Regular Expression CWE-625 - CVE-2026-64940 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

EUVD-2021-34855

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2021-32084

The Quest KACE Systems Deployment Appliance (SMA) 11.0.273 is vulnerable to an improper access control issue where API endpoints are not restricted even if the web console is limited by IP address or subnets. If an attacker obtains valid credentials or API keys , they can bypass these network res...

EUVD-2026-46047

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

CVE-2026-12588

An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger decompression of a large file that consumes an excessive amount of system resources thus causing a Denial of Service...

CVE-2026-12588

The CVE-2026-12588 entry describes a DoS condition in HX devices where an attacker with access to HX 10.0.0 and earlier can send specially crafted data to the HX console. The malicious detection triggers decompression of a large file, consuming excessive system resources and causing denial of ser...

OESA-2026-2923 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger...

OESA-2026-2922 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger...

OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

PYSEC-2026-883 OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...