firmwalker

firmwalker Un semplice script bash per cercare nel filesystem del firmware estratto o montato. Cercherà nel filesystem del firmware estratto o montato cose di interesse come: etc/shadow e etc/passwd elenca la directory etc/ssl cerca file correlati a SSL come .pem, .crt, ecc. cerca file di...

Kraken

Uno strumento basato su Python per centralizzare e semplificare gli attacchi di Forza Bruta Informazioni sul Progetto Kraken è un potente strumento basato su Python, progettato per centralizzare e semplificare vari compiti di brute-force. Kraken offre una suite di strumenti per professionisti del...

agentZ

AgentZ Piattaforma Agentica AI Zero Trust Costruisci, esegui e governa agenti AI. Sicura by design. Ogni agente viene eseguito all'interno di una sandbox con negazione predefinita e non riceve mai una credenziale. Ogni azione dell'agente è tracciabile. AgentZ è una piattaforma multi-tenant per...

LSTAR

LSTAR - Aggressor Un plugin dal primo accesso al dominio: realizzare il roaming nella rete interna Con l'obiettivo di semplificare il tasto destro di CS e facilitare l'integrazione personale, ho fatto riferimento a molti plugin post-esploitazione Ho ristrutturato e arricchito funzionalità come...

CVE-2020-7961-Mass

CVE-2020-7961-Mass Compra Password 10$ Email A [email protected]...

CVE-2024-41290

CVE-2024-41290 FlatPress CMS v1.3.1 1.3 wurde festgestellt, dass es unsichere Methoden zur Speicherung von Authentifizierungsdaten verwendet. Zusätzliche Informationen: FlatPress CMS Version 1.3.1 speichert authentifizierungsbezogene Daten, einschließlich Benutzernamen und gehashter Passwörter,...

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81098

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-75871

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...

CVE-2025-25968

CVE-2025-25968: Vulnerabilità di controllo degli accessi improprio in DDSN Interactive cm3 Acora CMS versione 10.1.1 DDSN Interactive cm3 Acora CMS versione 10.1.1 contiene una vulnerabilità di controllo degli accessi improprio. Un utente con privilegi di editor può accedere a informazioni...

CVE-2026-19854

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

CVE-2026-19889

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an...

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

evilginx

Evilginx v.1.1.0 QUESTA VERSIONE È OBSOLETA. USA L'ULTIMA VERSIONE! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx è un framework per attacchi man-in-the-middle utilizzato per il phishing di credenziali e cookie di sessione di qualsiasi servizio web. Il suo core gira sul server HTTP...

Koh

Koh Koh ist eine Tool-Sammlung in C und Beacon Object File BOF, die das Erfassen von Benutzeranmeldeinformationen durch absichtliches Prellen/Verlust von Token-/Anmeldesitzungen ermöglicht. Ein Teil des Codes wurde inspiriert von Elad Shamir's Internal-Monologue-Projekt keine Lizenz sowie von...

EUVD-2026-67089

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

EUVD-2026-67088

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...

CVE-2026-75871 Server-Side Request Forgery (SSRF) in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...

CVE-2026-75871

GitLab AI Gateway is affected by a Server-Side Request Forgery (SSRF) vulnerability (classified in the CVE title) across versions 18.10–19.0.12, 19.1–19.1.7, and 19.2–19.2.2 . An authenticated user with Duo Agent Platform access can craft an inline flow configuration that overrides the HTTP Host ...