149 matches found
rengine
reNgine: The Ultimate Web Reconnaissance & Vulnerability Scanner 🚀 reNgine 2.2.0 is released! reNgine 2.2.0 comes with bounty hub where you can sync and import your hackerone programs, in app notifications, chaos as subdomain enumeration tool, ability to upload multiple nuclei and gf patterns,...
lazyrecon
/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com About...
CVE-2026-118418
The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...
EUVD-2026-123174
The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...
CVE-2026-118418
The WP Directory Kit WordPress plugin, in versions prior to 1.6.3 , is vulnerable to unauthenticated data disclosure. The flaw exists because the public directory-search action fails to restrict which database models and columns are returned and does not verify authorization. This allows unauthen...
CVE-2026-118418 WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message Disclosure
The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...
PT-2026-145010
The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...
CVE-2026-118418: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public…
The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...
Mozilla Thunderbird security vulnerabilities
Security vulnerabilities exist in Mozilla Thunderbird versions prior to 153.6 and 159. These vulnerabilities arise from the server directory search for calendars, account settings, or network calendar entries; it accepts calendar locations pointing to other servers, local files, or network shares...
dirsearch
dirsearch - Descubrimiento de rutas web Un avanzado brute-forcer de rutas web dirsearch está siendo desarrollado activamente por @maurosoria y @shelld3v. Únete al servidor de Discord para comunicarte con el equipo. Inicio rápido dirsearch requiere Python 3.11 o superior. git clone...
CVE-2026-97586
A flaw was found in the Linux kernel's AFS Andrew File System implementation. An error-handling path in the directory search mechanism fails to unmap a previously mapped memory block when an error occurs. A local user could trigger this flaw during directory lookup operations, causing a kernel...
EUVD-2026-67568
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...
CVE-2026-14567: Exposure of Sensitive Information to an Unauthorized Actor
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...
PT-2026-82874
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...
Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.14 Images Security Update
New images are available for Red Hat build of Keycloak 26.4.14 and Red Hat build of Keycloak 26.4.14 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...
CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
Important: Red Hat Security Advisory: sssd security update
An update for sssd is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...