132 matches found
Cr3dOv3r
Cr3dOv3r Your best friend in credential reuse attacks. You give Cr3dOv3r an email then it does two simple useful jobs with it: Search for public leaks for the email and returns the result with the most useful details about the leak Using haveibeenpwned API and tries to get the plain text password...
credmap
credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...
credmap
credmap: クレデンシャルマッパー Credmapは、認証情報の再利用の危険性について認識を高めるために作成されたオープンソースツールです。提供されたユーザー認証情報を、いくつかの既知のウェブサイトでテストし、パスワードがそれらのいずれかで再利用されていないかを確認できます。公式の紹介記事はこちらでご覧いただけます。 ヘルプメニュー root@kitploit: Usage: credmap.py --email EMAIL | --user USER | --load LIST options Options: -h/--help show this help message a...
pentest_teamcity
Metasploit を使用した TeamCity のペネトレーションテスト 要約:JetBrains IDE IntelliJ や PyCharm など からパスワードを取得し、その認証情報を TeamCity Continuous Integration Server 内で使用して、Metasploit を使用してサーバーおよびビルドエージェント上でメータープリターセッションを取得します。Kacper Szurek 著。 JetBrains コメント 以下はベンダー JetBrains TeamCity チーム からのコメントです。Yegor Yarko 氏によるもの:...
CVE-2025-14269
CVE-2025-14269 Se descubrió un problema de seguridad en la versión dentro del clúster de Headlamp donde usuarios no autenticados pueden reutilizar credenciales en caché para acceder a la funcionalidad de Helm a través de la interfaz de usuario de Headlamp. Los clústeres de Kubernetes solo se ven...
htb-labs-nexus
🏴☠️ HTB Labs - Nexus English 🇺🇸 | Español 🇪🇸 English | Español 📋 概述 Nexus 是 Hack The Box 上一台简单难度的 Linux 机器 ，演示了一条多阶段攻击链，涉及虚拟主机枚举、暴露的凭据、易受攻击的 Web 应用功能、远程代码执行、凭据重用和本地权限提升。 攻击链 root@kitploit: 侦察 │ ▼ 虚拟主机枚举 │ ├── git.nexus.htb └── billing.nexus.htb │ ▼ Gitea 提交历史 │ ▼ 暴露的凭据 │ ▼ Krayin CRM 登录 │ ▼...
CVE-2026-50199
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/updateexchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...
libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials
A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...
EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-2962)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one,...
Security Bulletin: consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...
CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...
CVE-2026-16498
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
CVE-2026-16498
The terraform-mcp-server package is affected up to version 1.0.x; in the streamable-HTTP stateless transport mode, a cross-tenant credential reuse vulnerability allows one user’s Terraform token to be used to execute tool calls for subsequent users. Root cause: improper isolation between tenants ...
EUVD-2026-49941
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
PT-2026-65551
Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A cross-tenant credential reuse issue exists in the streamable-HTTP stateless transport mode. This flaw may allow a Terraform token belonging to one user to be reused to execute tool cal...
CVE-2026-64391 ksmbd: use opener credentials for ADS I/O
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...
FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices
Key Takeaways FortiBleed refers to June 2026 public reporting of large-scale credential exposure and abuse targeting internet-reachable FortiGate management and SSL-VPN gateways driven by credential reuse and brute-force, not a single new zero-day. Risk is highest for internet-exposed FortiGate...
CVE-2026-9079
A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...
