CVE-2026-107270

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

EUVD-2026-94401

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

boofuzz

.. image:: https://github.com/jtpereyda/boofuzz/raw/master/artwork/boo-logo-dark.svg :width: 60% :alt: boofuzz logo boofuzz: Network Protocol Fuzzing for Humans .. image:: https://github.com/jtpereyda/boofuzz/actions/workflows/test.yml/badge.svg?branch=master :target:...

stride-gpt

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models LLMs to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the...

sslscan

sslscan2 La version 2 de sslscan est maintenant publiée. Elle inclut une réécriture majeure du code de scan back-end, ce qui signifie qu'elle ne dépend plus de la version d'OpenSSL pour de nombreux contrôles. Il est ainsi possible de supporter les protocoles anciens SSLv2 et SSLv3, ainsi que...

CVE-2026-42533

CVE-2026-42533 — PoC-эксплойт для переполнения буфера в куче nginx Удалённое выполнение кода до аутентификации через затирание захватов при двухпроходной обработке Публичный PoC выпущен 2026-07-27 — Не ждите, патчите сейчас. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Critical Тип| Переполнение...

ThreatActors-TTPs

REMARQUE : Ceci est un fork de Crocodyli - Tout ce que je fais, c'est ajouter des éléments pour mes propres besoins. Je l'utilise pour alimenter les pages gapMATRIX sur https://incidentbuddy.ai ACTEURS DE MENACE ET RANSOMWARES - TTPs Ce dépôt a été créé dans le but d'aider les entreprises et les...

ransomware_map

Orange Cyberdefense CERT - Карта экосистемы программ-вымогателей Последняя версия = 29 январь 2026 - ожидается Карта, визуализирующая взаимосвязи и хронологию, связанные с более чем 300 группами программ-вымогателей, за период с 2015 по 2026 год. Надеемся, это поможет! Команда World Watch - Globa...

autovpn

!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...

awesome-threat-intelligence

awesome-threat-intelligence Курируемый список лучших ресурсов по Threat Intelligence Краткое определение Threat Intelligence: обоснованные знания, включая контекст, механизмы, индикаторы, последствия и практические рекомендации, о существующей или возникающей угрозе или опасности для активов,...

stegowiper

stegoWiper: A powerful and flexible active attack for disrupting stegomalware Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Pand...

terraform-aws-security-group

terraform-aws-security-group Module Terraform pour gérer les groupes de sécurité AWS. Actuellement, les règles d'entrée et de sortie prennent en charge les entrées IPv4, IPv6 et les identifiants de groupe de sécurité. Exigences Nom| Version ---|--- terraform| = 1.6 aws| = 5.0 Fournisseurs Nom|...

X-force

Bibliothèque IBM X-Force Exchange | Bibliothèque IBM Security X-Force Exchange en Python 3. Recherche : threatactivities, threatgroups, malwareanalysis, collector et industries. Pour d'autres applications. Voir ---|--- Installation pip3 install XForce Utilisation Utilisez votre clé API pour...

cloudformation-waf-acl

cloudformation-waf-acl Un modèle AWS CloudFormation utilisé pour provisionner et gérer les ressources AWS WAFv2, incluant une Web ACL, des groupes de règles managés, un ensemble de motifs d'expressions régulières personnalisé et un ensemble d'adresses IP. Composants Le modèle provisionne : 1. Une...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

SharpPrivesc

SharpPrivesc Практикую C и собираю поверхности атак Privesc вместе. Пока что любительские вещи. Проверки Privesc и тому подобное. Я предпочел классы разбора командной строки от Spectreops, поэтому решил использовать их вместо других .net пакетов, таких как command line parser и т.д. Список дел:...

pacbot

Introduction Policy as Code Bot PacBot is a platform for continuous compliance monitoring, compliance reporting and security automation for the cloud. In PacBot, security and compliance policies are implemented as code. All resources discovered by PacBot are evaluated against these policies to...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...