CVE-2026-81706 openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81706 openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81706

openssl_encrypt before 1.4.9 is vulnerable to key substitution via identity shadowing . The root cause lies in IdentityStore , which fails to prevent namespace collisions between a user's own identities and contacts. An attacker can create shadowed contact entries that remain invisible until the ...

CVE-2026-81702

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, enabling silent key substitution . An attacker can replace legitimate public keys in identity stores with their own while maintaining the claimed fingerprint, so that encryption u...

CVE-2022-22954-POC

CVE-2022-22954-POC VMware Workspace ONE Access precedentemente noto come VMware Identity Manager consente ai dipendenti di accedere più rapidamente ad applicazioni SaaS, Web e mobili native tramite autenticazione multifattoriale, accesso condizionato e single sign-on. Recentemente, il sito...

CVE-2024-0044

CVE-2024-0044- CVE-2024-0044: una vulnerabilità ad alta gravità "run-as any app" che colpisce Android versioni 12 e 13 Script di Exploit per CVE-2024-0044 Questo script Bash dimostra come sfruttare CVE-2024-0044. Solo per scopi educativi e di test. Prerequisiti ADB Android Debug Bridge installato...

CVE-2026-75020 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope...

CVE-2026-75020

This LDAP Injection vulnerability in Apache APISIX's ldap-auth plugin (versions 2.11.0 through 3.17.0 ) allows a caller holding valid credentials for one LDAP directory entry to authenticate as a consumer mapped to a different entry, effectively bypassing the plugin's configured scope and enablin...

check-cve-2026-3055-netscaler

CVE-2026-3055 NetScaler SAML IdP-Check Python-Helfer zum Untersuchen von Citrix NetScaler / NetScaler Gateway Appliances auf CVE-2026-3055 Speicher-Overread bei Verwendung als SAML Identity Provider. Die Erkennungslogik entspricht dem öffentlichen Write-up von watchTowr Labs. Voraussetzungen Pyth...

AzureAD-Attack-Defense

Microsoft Entra ID - Playbook di attacco e difesa Questa pubblicazione è una raccolta di vari scenari di attacco comuni su Microsoft Entra e di come possono essere mitigati o rilevati. Tutti gli scenari, le intuizioni e i commenti inclusi si basano sulle esperienze dei contributori durante le lor...

SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity

SCTT-2026-33-0004: Singolarità dell'Identità SSO di FortiCloud Questa è l'implementazione completa del vettore SCTT-0004. 📡 Analisi Tecnica Mentre la mitigazione di Fortinet del 27 gennaio 2026 per CVE-2026-24858 si concentra sul blocco di account specifici come [email protected], non riesce...

CTT-Refraction-Vortex-CVE-2026-7731-

CTT-Refraction-Vortex-CVE-2026-7731- Nel contesto CTT, lo vediamo come un Disallineamento di Sincronizzazione Temporale tra il Provider di Identità e il Provider di Servizi. Iniettando un impulso alla frequenza \alpha=0.0302011, non aggiriamo la firma—rifrangiamo la Finestra Temporale così che la...

boundary

Boundary Cos'è Boundary: https://developer.hashicorp.com/boundary/docs/what-is-boundary Sito web: https://www.developer.hashicorp.com/boundary/ Forum: HashiCorp Discuss Documentazione: https://developer.hashicorp.com/boundary/docs Tutorial: Piattaforma Learn di HashiCorp Boundary è un proxy...

The Hitchhikers Guide to Online Anonymity

La guida completa per l'anonimato online e l'OpSec. Benvenuti. Questa è una guida che mira a fornire un'introduzione a varie tecniche di tracciamento online, tecniche di verifica dell'identità online e una guida dettagliata per creare e mantenere identità online veramente anonime. È scritta con l...

VMware Workspace ONE Access - Authentication Bypass

VMware Workspace ONE Access has two authentication bypass vulnerabilities CVE-2022-22955 & CVE-2022-22956 in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework. id: CVE-2022-22956...

WSO2 - Cross-Site Scripting

WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0,...

Oracle Identity Manager REST WebServices - Authentication Bypass

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager...

agent-bom

I marchi sopra rappresentano backend supportati di discovery, scansione, connessione, deployment o evidenze — non una profondità di connettore identica. Consulta la matrice delle capacità...

ldapsdk

UnboundID LDAP SDK для Java Скачать последний релиз LDAP SDK здесь UnboundID LDAP SDK для Java — это быстрая, мощная, удобная и полностью бесплатная библиотека Java с открытым исходным кодом для взаимодействия с LDAP-серверами каталогов. Она обеспечивает лучшую производительность, удобство...

sigcorr

SigCorr Пассивное обнаружение межпротокольных атак для мобильных опорных сетей SigCorr — это первый инструмент с открытым исходным кодом для обнаружения межпротокольных цепочек атак, охватывающих SS7/MAP, Diameter S6a и GTPv2-C, с помощью унифицированной корреляции идентификаторов абонентов...