AWS-Loot

AWSLoot Busca secretos en un entorno AWS enumerando variables de entorno y código fuente. Esta herramienta permite una enumeración rápida sobre grandes conjuntos de instancias y servicios de AWS. Instalación root@kitploit: pip install -r requirements.txt Se requiere un archivo de credenciales de...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

git-all-secrets

git-all-secrets Acerca de git-all-secrets es una herramienta que puede: Clonar múltiples repositorios públicos/privados de GitHub de una organización y escanearlos, Clonar múltiples repositorios públicos/privados de GitHub de un usuario que pertenece a una organización y escanearlos, Clonar un so...

Locky

Locky Locky genera contraseñas "realmente" fuertes pero fáciles de recordar. Las contraseñas generadas por Locky tienen las siguientes características: 20+ caracteres Entropía realmente alta Fáciles de recordar Relleno entre palabras Elemento personalizado nombre Por lo tanto, las contraseñas no ...

CVE-2026-59941

CVE-2026-59942: Dompdf Resource Exhaustion DoS - Proof of Concept Vulnerability Type: Denial of Service DoS via Resource Exhaustion Affected Software: Dompdf = 3.1.5 Credits: Fabian Rosales far00t01. Disclaimer This repository and its content are provided for educational and research purposes onl...

Pwdb-Public

PWDB - Nuova generazione di analisi di massa delle password Obiettivo Lasciando alle spalle la roba di red team vecchia di 20 anni. Le cose funzionano bene e nessuno si preoccupa di controllarle/sostituirle per decenni. Dump inclusi Puoi controllare il file status.txt in questo repository per...

CVE-2025-51726

Come richiesto, ho ora dimostrato entrambe le vulnerabilità BA2022 e BA2015 con scenari di sfruttamento pratici e prove di PoC, che mostrano come un attaccante potrebbe abusare di questi problemi in un contesto reale. 📌 1. BA2022 Hash Debole nella Firma del Codice – Dimostrazione dello Sfruttamen...

entropy

Paranoico riguardo alla fuga di segreti nella tua enorme base di codice? Entropy è qui per aiutarti a trovarli! Entropy Entropy è uno strumento CLI che scansionerà la tua base di codice per linee ad alta entropia , che spesso sono segreti. Installazione Dal sorgente con Go consigliato...

CVE-2026-18050

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

CVE-2026-59942

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

GHSA-F5GF-2CJ8-52G2 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

PT-2026-63554

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf is susceptible to a Denial of Service DoS attack via resource exhaustion. An unauthenticated remote attacker can crash the PHP process by submitting a specially crafted HTML document containing ...

MAL-2026-1234 Malicious code in uxproject11 (npm)

Collects and exfiltrates sensitive system information to suspicious domains. Multiple YARA rules are triggered. High entropy file. Extension mismatch. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b478ab519bbd87949cad8be7d77296e0eddd01aa0be1b4b168ed2f6a0f7413...

Malicious code in uxproject11 (npm)

Collects and exfiltrates sensitive system information to suspicious domains. Multiple YARA rules are triggered. High entropy file. Extension mismatch. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b478ab519bbd87949cad8be7d77296e0eddd01aa0be1b4b168ed2f6a0f7413...

FedPoisonTTP: A Threat Model and Poisoning Attack for Federated Test-Time Personalization

Test-time personalization in federated learning enables models at clients to adjust online to local domain shifts, enhancing robustness and personalization in deployment. Yet, existing federated learning work largely overlooks the security risks that arise when local adaptation occurs at test tim...

LexiMark: Robust Watermarking via Lexical Substitutions to Enhance Membership Verification of an LLM's Textual Training Data

Large language models LLMs can be trained or fine-tuned on data obtained without the owner's consent. Verifying whether a specific LLM was trained on particular data instances or an entire dataset is extremely challenging. Dataset watermarking addresses this by embedding identifiable modification...

Spill the Beans: Exploiting CPU Cache Side-Channels to Leak Tokens from Large Language Models

Side-channel attacks on shared hardware resources increasingly threaten confidentiality, especially with the rise of Large Language Models LLMs. In this work, we introduce Spill The Beans, a novel application of cache side-channels to leak tokens generated by an LLM. By co-locating an attack...

Crypto-NcRNA: Non-Coding RNA (NcRNA) Based Encryption Algorithm

In the looming post-quantum era, traditional cryptographic systems are increasingly vulnerable to quantum computing attacks that can compromise their mathematical foundations. To address this critical challenge, we propose crypto-ncRNA-a bio-convergent cryptographic framework that leverages the...

PT-2023-26384 · Unknown · Rws Worldserver

Name of the Vulnerable Software and Affected Versions: RWS WorldServer versions 11.7.3 and earlier Description: Session tokens in RWS WorldServer have a low entropy and can be enumerated, leading to unauthorized access to user sessions. Recommendations: For RWS WorldServer versions 11.7.3 and...