1537 matches found
catphish
CATPHISH Genera domini dall'aspetto simile per attacchi di phishing. Controlla i domini scaduti e il loro stato di categorizzazione per eludere la categorizzazione proxy. I domini nella whitelist sono perfetti per i tuoi server C2. Ideale per le attività Red Team. Installazione root@kitploit:...
domainhunter
Domain Hunter Autori Joe Vest @joevest & Andrew Chiles @andrewchiles La selezione del nome di dominio è un aspetto importante nella preparazione per test di penetrazione e, in particolare, per gli impegni Red Team. Comunemente, domini utilizzati in precedenza per scopi benigni e adeguatamente...
CVE-2026-46455
CVE-2026-46455 — camel-keycloak controllo ISACTIVE mancante token scaduti accettati Reproducer proof-of-concept eseguibili per la stessa vulnerabilità di Apache Camel, uno per runtime:...
CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass
opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...
CVE-2026-81700
openssl_encrypt versions before 1.4.9 contain a signature verification bypass in the gpg_runner.verify_detached function. The root cause is that the function only checks the VALIDSIG status without inspecting REVKEYSIG , EXPKEYSIG , or GPG exit codes, causing it to accept revoked and expired sign...
CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass
opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...
MagicSigner
MagicSigner DLL patcher para o signtool que permite assinar com certificados expirados Uso Basta colocar o XmlLite.dll ao lado do signtool.exe Demonstração Antes do MagicSigner Depois do MagicSigner Soluções alternativas Você também pode simplesmente atrasar o relógio do seu computador. No entant...
CVE-2022-24449
CVE-2022-24449 Solar Appscreener XXE सुझाया गया विवरण Solar AppScreener SAST टूल के 3.10.4 संस्करण तक एक समस्या पाई गई। कोई अनधिकृत अभिकर्ता, उन होस्ट्स पर हमला कर सकता है जहाँ संवेदनशील संस्करण स्थापित है, विशेष रूप से तैयार किए गए XML फ़ाइलों को अपलोड करके, जिनका लाइसेंस समाप्त हो चुका है या...
badssl.com
Visita badssl.com per un elenco di sottodomini di test, tra cui: self-signed.badssl.com expired.badssl.com mixed.badssl.com rc4.badssl.com hsts.badssl.com Configurazione del server VM Ubuntu standard, record DNS A per badssl.com. e puntano alla VM...
domainhunter
Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...
CVE-2026-77130
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...
CVE-2026-77130 Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...
EUVD-2026-65345
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...
CVE-2026-77130
The TYPO3 extension SYSSY – TYPO3 Monitoring & Security Checks (syssy) fails to properly validate the expiration of a client-supplied JWT token . This allows an attacker who already holds a valid SYSSY project API key to continue authenticating with an expired token , effectively bypassing sessio...
packj
Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...
Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments
Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale POS terminal reads over near-field communication NFC, without breaking any of the card...
CVE-2026-76891
Wireshark's sharkd component (versions 4.6.0–4.6.7 and 4.4.0—4.4.18) crashes due to an expired pointer dereference, causing denial of service. CVSS 3.1 rates it LOW (3.1). References: wireshark.org/security/wnpa-sec-2026-64.html, gitlab.com/wireshark/wireshark/-/work_items/21395. Exploitation sta...
CVE-2026-76891 Expired Pointer Dereference in Wireshark
Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
CVE-2026-76890
Wireshark's sharkd service crashes via expired pointer dereference in versions 4.6.0–4.6.7 and 4.4.0–4.4.18, enabling remote denial of service. CVSS 3.1 LOW (network attack, high complexity, no privileges). No exploitation details are provided; update to a patched version per the Wireshark securi...