SwaggerSpy

SwaggerSpy 概述 SwaggerSpy 是一款专为对 SwaggerHub 进行自动化开源情报（OSINT）分析而设计的工具。本项目旨在简化从 SwaggerHub 上记录的 API 中收集情报的过程，为安全研究人员、开发者和 IT 专业人员提供有价值的洞察。 什么是 Swagger？ Swagger 是一个开源框架，允许开发者设计、构建、文档化和消费 RESTful Web 服务。它通过使用 JSON 或 YAML 格式提供描述 REST API 的标准方式，从而简化 API 开发。Swagger 使开发者能够为其 API 创建交互式文档，让开发者和非开发者都能更轻松地理解和...

CVE-2026-82433

Apache Storm Nimbus and UI components are affected by a credential disclosure vulnerability. The getNimbusConf function returned the full daemon configuration without masking sensitive values after only a user-level authorization check. The UI endpoint /api/v1/cluster/configuration compounded the...

EUVD-2026-77524

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

EUVD-2026-77521

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

CVE-2026-82434 Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

EUVD-2026-77516

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82437

Apache Storm Logviewer fails to enforce its configured logs.users and logs.groups access controls for daemon logs . The root cause is twofold: the access-decision logic discarded the authorizer's result whenever the "daemon log" flag was set, and the daemon log page and download endpoints reached...

EUVD-2026-77515

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2025-53694

CVE-2025-53694: Divulgación de información en la API de ItemService con un usuario anónimo restringido, que conduce a la exposición de claves de caché mediante un enfoque de fuerza bruta La API de ItemService, accesible en /sitecore/shell/api/sitecore/ItemService/GetChildren, permite a usuarios n...

CVE-2020-25078

D-Link DCS系列账号密码信息泄露漏洞 D-Link DCS系列账号密码信息泄露漏洞，通过脚本获取账号密码登录。 漏洞编号 CVE-2020-25078 工具利用 python3 CVE-2020-25078.py -u http://127.0.0.1:1111 单个url测试 python3 CVE-2020-25078.py -f url.txt 批量检测 免责声明 由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。...

EUVD-2026-77482

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

CVE-2026-84179 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

CVE-2026-84179

Apache Storm (Nimbus component and Storm UI) is affected by an information disclosure vulnerability in getTopologyPageInfo, which merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field. The Storm UI copied ...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM 泄露 新漏洞允许通过一次点击从浏览器泄露NTLM哈希 作者：Ruben Enkaoua 描述 Microsoft ms-photos URI 方案将 fileName 作为参数，该参数可以提交带有 UNC 路径，在打开时泄露 NTLMv2-SSP 哈希。通过构造一个特殊格式的链接，攻击者可以强迫受害者直接从浏览器启动 Microsoft Photos 应用。当触发时，此行为会导致受害者的 NTLMv2-SSP...

CVE-2025-68461

CVE-2025-68461 扫描器 一个用于检测 Roundcube Webmail 安装中跨站脚本 XSS 漏洞的 C++ 安全扫描工具。 影响 未经授权访问用户账户 会话劫持 数据泄露 以用户身份执行未授权操作 受影响版本 扫描器检查以下存在漏洞的版本： 1.5.x 系列： 1.5.0 至 1.5.11 1.6.x 系列： 1.6.0 至 1.6.11 缓解措施 升级到： Roundcube Webmail 1.5.12 或更高版本（适用于 1.5.x） Roundcube Webmail 1.6.12 或更高版本（适用于 1.6.x） ✨ 特性 自动检测 Roundcube...

CVE-2024-10140

CVE-2024-10140 该脚本利用了在端点 /php/managesupplier.php?action=delete&id=32 中发现的一个 SQL 注入漏洞。该漏洞允许攻击者通过 id 参数注入任意 SQL 命令，可能危及数据库安全并泄露敏感信息。...

cottage

cott age es una herramienta GitOps para equipos que gestionan secretos cifrados con age en repositorios git. Proporciona un flujo de trabajo sencillo para cifrar/descifrar secretos, gestionar destinatarios y mantener los secretos fuera del repositorio, permitiendo al mismo tiempo compartirlos...

CVE-2025-9216

StoreEngine – 强大的WordPress电子商务插件，支持支付、会员、联盟营销、销售等 root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin...

Credential-and-breach-monitoring

泄露/窃密日志/身份暴露服务对比（附评分） 本文档从现代安全团队实际关心的维度，对泄露情报、暗网监控和身份暴露服务进行了比较。 重点关注： 泄露语料库深度 窃密日志覆盖率 API 可用性 会话令牌 / Cookie 监控 厂商定位 目标不是评选单一胜者，而是为安全团队评估以下用途的供应商提供一个结构化、实用的比较： 泄露情报增强 身份暴露监控 窃密软件驱动的入侵检测 自动化与安全运维中心集成 原始比较表 服务| 链接| 泄露语料库深度| 窃密日志访问| API| 会话令牌/Cookie| 核心定位 ---|---|---|---|---|---|--- Lunar|...