punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

radare2-scripts

radare2 Scripts Summary A 'collection' of scripts to be used with radare2. r2bincarver.py - A script used to carve files from memory dumps. r2hashfuncdecoder.py - A script used to decode hashed functions, commonly found in shellcode. Scripts Binary Carver This script will carve files from memory...

CVE-2023-36144

CVE-2023-36144 PoC of CVE-2023-36144 - Intelbras Switch SG 2404 MR L2+ firmware 1.00.54 Download the backup file unauthenticated Steps to Reproduce: 1. Go to the following link http://127.0.0.1/cgi-bin/exportCfgwithpasswd replace 127.0.0.1 with the device IP 2. It will auto download the backup...

better-auth: OAuth state can be used as a Magic Link to sign in as another user

Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with storeToken:...

deepsecrets

OWASP DeepSecrets — a better tool for secrets scanning What is it? Another token-wasting CLI proxy to an AI API? Absolutely not! In our LLM-hype era, DeepSecrets still runs entirely on your machine — giving you great results offline, securely, and for free. So why yet another tool? Most existing...

TYPO3 sgalinski Cookie Consent SQL Injection Vulnerability

In versions of TYPO3 sgalinski Cookie Consent from 8.0.0 to 8.1.12 and before, as well as 7.4.6 and before, there is an SQL injection vulnerability. This vulnerability arises due to the backend module for reviewing consent history not verifying the sorting, grouping, and indexing options in...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: advansys: Fix kernel pointer leak Pointers should be printed using %p or %px instead of being cast to ‘unsigned long’ and then printed using %lx. Replace %lx with %p when printing hashed pointers...

PT-2026-111351

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

Jiangnan One Point Rain vhr Information Leakage Vulnerability

The Jiangnanvhr system has a vulnerability regarding information leakage. This vulnerability stems from the GET /chat/hrs interface, where any authenticated user can access other operators’ BCrypt hashed passwords. Operators with low privileges may be able to collect administrator password hashes...

EUVD-2026-92762

Ghost: Password Hash Ordering Disclosure in Ghost Admin API...

CVE-2026-105652

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105652

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

PT-2026-106186

Name of the Vulnerable Software and Affected Versions Ghost versions 0.7.2 through 6.63.x Description Staff-level users can determine the relative ordering of hashed passwords belonging to other staff users. This issue does not directly disclose the password hashes or provide a practical method f...

CVE-2026-105652: Observable Discrepancy

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

Rocky Linux 8 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel Multiple Vulnerabilities (crlsa-2024_10379)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410379 advisory. pam: libpam: Libpam vulnerable to read hashed password CVE-2024-10041 pam: Improper Hostname Interpretation in pamaccess Leads to Access Control Bypass...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init (ALMALINUX9.2:CLSA-2026:1782809708)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782809708 advisory. - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_7435)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257435 advisory. thunderbird: User Interface UI Misrepresentation of attachment URL CVE-2025-3523 thunderbird: Information Disclosure of /tmp directory listing CVE-2025-283...

CVE-2026-101089

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089

Versions of Nezha before 2.2.7 are susceptible to an information disclosure vulnerability within the GET /api/v1/profile endpoint. This flaw allows authenticated users to retrieve their bcrypt-hashed password field. Because there are no rate limiting or audit trail constraints, an attacker can ex...