IIS-ShortName-Scanner

IIS Short Name Scanner - 2012-2023 y sigue dando de sí... Última presentación: Más allá de la divulgación de nombres cortos de archivos en Microsoft IIS Última entrada del blog: https://soroush.me/blog/2023/07/thirteen-years-on-advancing-the-understanding-of-iis-short-file-name-sfn-disclosure/...

sast-rules

Reglas de Semgrep Este es el repositorio central de reglas de Semgrep que alberga las reglas de Semgrep para el analizador Semgrep de GitLab. El repositorio está estructurado de la siguiente manera: . ├── mappings │ ├── findsecbugs.yml │ ├── eslint.yml │ └── ... ├── rules │ ├── lpgl │ │ ├──...

check-spelling

@check-spelling/check-spelling Acción de GitHub Resumen Todo el mundo comete errores tipográficos. Esto incluye a las personas que escriben documentación y comentarios, pero también a los programadores al nombrar variables, funciones, APIs, clases y nombres de archivos. A menudo, los programadore...

spectrIDA-Reverse_Engineering_Stack

es-define-property Object.defineProperty, but not IE 8's broken one. Example const assert = require'assert'; const $defineProperty = require'es-define-property'; if $defineProperty assert.equal$defineProperty, Object.defineProperty; else if Object.defineProperty assert.equal$defineProperty, false...

alibaba__nacos_CVE-2021-44667_2-0-3

Nacos: Dynamic Na ming and Co nfiguration S ervice What does it do Nacos official site: nacos.io is an easy-to-use platform designed for dynamic service discovery and configuration and service management. It helps you to build cloud native applications and microservices platform easily. Service i...

shortscan

🌀 Shortscan Una herramienta de enumeración de nombres cortos de archivos en IIS. Funcionalidad Shortscan está diseñado para determinar rápidamente qué archivos con nombres cortos existen en un servidor web IIS. Una vez identificado un nombre corto, la herramienta intentará identificar...

SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE

SolarWinds Web Help Desk before version 2026.1 contains an insecure deserialization vulnerability in the jabsorb JSON-RPC library. When chained with a CSRF whitelist bypass CVE-2025-40536, remote unauthenticated attackers can exploit JNDI injection via the Apache Xalan JNDIConnectionPool class to...

go-cpe

go-cpe A Go library for CPEA Common Platform Enumeration 2.3 go-cpe is a implementation of the CPE Naming and Matching algorithms, as described in NIST IRs 7695 and 7696. For the reference Java implementation, see: https://cpe.mitre.org/specification/CPEReferenceImplementationSep2011.zipx...

CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

Astra Linux – Vulnerability in h2database

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes the class name of the driver and the URL of the database as parameters. An attacker may pass in a JNDI driver name and a URL that points to an LDAP or RMI server, allowing for remote code execution. This vulnerability can be...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: JNDI. The supported versions affected include Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3, and 22.2.0. This vulnerabili...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML Jackson-Databind 2.x versions before 2.9.10.8 mishandle the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool...

Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6

Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence AI model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. The AI company said the incident...

PT-2026-89470

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...

CVE-2026-9745

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an...

CVE-2026-9745

IBM Netezza Software versions 11.3.0.3 through Interim Fix 002 are affected by a missing bucket ownership validation when using the ExpectedBucketOwner parameter. This omission allows a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an uninte...

CVE-2026-9745 Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an...

CVE-2026-9745 Vulnerabilities exists in IBM Netezza Software

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an...

PT-2026-85259

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an...

CVE-2026-76797

The MongoSQL Transition Readiness Tool (MongoDB) is vulnerable to CSV injection through its generated reports. Database and collection names are written into CSV output without neutralizing leading characters that spreadsheet applications interpret as formulas. An attacker with write privileges o...