3217 matches found
CVE-2019-10475
CVE-2019-10475 Quick POC for Jenkins CVE-2019-10475 / SECURITY-1490 reported on 2019-10-23. The issue is within the build-metrics plugin which generates some basic build metrics. It's commonly used with the Jenkins sidebar links plugin. This is a simple & generic reflected XSS vulnerability. The...
http-desync-guardian
Overview HTTP/1.1 went through a long evolution since 1991 to 2014: HTTP/0.9 β 1991 HTTP/1.0 β 1996 HTTP/1.1 RFC 2068 β 1997 RFC 2616 - 1999 RFC 7230 - 2014 This means there is a variety of servers and clients, which might have different views on request boundaries, creating opportunities for...
AIF360
AI Fairness 360 AIF360 The AI Fairness 360 toolkit is an extensible open-source library containing techniques developed by the research community to help detect and mitigate bias in machine learning models throughout the AI application lifecycle. AI Fairness 360 package is available in both Pytho...
popeye
Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...
AIX360
AI Explainability 360 v0.3.0 β¨ NEW: IBM Research has a new In-Context Explainability 360 ICX360 toolkit that extends explainability to LLMs , specifically in terms of the input given to the LLM. Please check it out! πβ¨ The AI Explainability 360 toolkit is an open-source library that supports...
suricata_exporter
Suricata Prometheus Exporter This is a Prometheus Exporter for Suricata using dump-counters via the unix socket to query metrics. Usage $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default "/var/run/suricata.socket" -versio...
ayaFlow
ayaFlow ayaFlow is a Rust + eBPF network traffic analyzer built with Aya. It runs one agent per Linux node, attaches a TC classifier at ingress and egress, and exposes live traffic data, historical SQLite-backed history, and Prometheus metrics. What It Does Captures IPv4, IPv6, TCP, and UDP traff...
scorecard
OpenSSF Scorecard Overview What Is Scorecard? Prominent Scorecard Users View a Project's Score Scorecard's Public Data Using Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard Command Line Interface Prerequisites Installation Authentication Basic Usage Checks Default...
Oracle WebLogic Server - Remote Command Execution
The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...
Apache Solr - Host Environment Variables Leak via Metrics API
Exposure of Sensitive Information to an Unauthorized Actor Vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users can specify which environment variables to hide, however, the default list is designed to wor...
Milvus - Unauthenticated Metrics API Access
Milvus 2.5.27 and 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091. id: CVE-2026-26190 info: name: Milv...
11in1 CMS 1.2.1 - Local File Inclusion (LFI)
Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php. id: CVE-2012-0996 info: name: 11in1 CMS 1.2.1 - Local File Inclusion LFI author: daffainfo...
DomainMOD 4.13.0 - Cross-Site Scripting
DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...
bug-bounty-reports-desai-vinayak
𧩠Bug Bounty Reports β Desai Vinayak π Bug bounty and vulnerability research reports by Desai Vinayak. This repository collects passive, non-destructive vulnerability write-ups and supporting evidence for coordinated disclosure and remediation tracking. π Contents π reports/ β PDF, DOCX, and...
CVE-2024-32030-Nuclei-Template
CVE-2024-32030 Nuclei Template Description This repository contains a Nuclei template for detecting the CVE-2024-32030 vulnerability. This vulnerability allows for remote code execution via JMX Metrics Collection JNDI Resolution. Vulnerability Details ID: CVE-2024-32030 Name: JMX Metrics Collecti...
GHSA-9969-6676-49H5 vulnerabilities
Vulnerabilities for packages: kube-metrics-adapter, kube-metrics-adapter-fips, temporal-ui-server, falcosidekick-ui, gotenberg, perses, perses-fips, temporal, listmonk, temporal-fips, temporal-ui-server-fips, falcosidekick-ui-fips...
GHSA-CXF3-9H37-7RR8 vulnerabilities
Vulnerabilities for packages: kube-metrics-adapter, kube-metrics-adapter-fips, temporal-ui-server, falcosidekick-ui, gotenberg, perses, perses-fips, temporal, listmonk, temporal-fips, temporal-ui-server-fips, falcosidekick-ui-fips...
GHSA-F48P-C9V4-H7XV vulnerabilities
Vulnerabilities for packages: kube-metrics-adapter, kube-metrics-adapter-fips, temporal-ui-server, falcosidekick-ui, perses, perses-fips, temporal, listmonk, temporal-fips, temporal-ui-server-fips, falcosidekick-ui-fips...
GHSA-H7WR-284F-5QVC vulnerabilities
Vulnerabilities for packages: kube-metrics-adapter, kube-metrics-adapter-fips, temporal-ui-server, falcosidekick-ui, perses, perses-fips, temporal, listmonk, temporal-fips, temporal-ui-server-fips, falcosidekick-ui-fips...
