shortscan

🌀 Shortscan Ein IIS-Tool zur Aufzählung kurzer Dateinamen. Funktionalität Shortscan wurde entwickelt, um schnell zu ermitteln, welche Dateien mit kurzen Dateinamen auf einem IIS-Webserver vorhanden sind. Sobald ein kurzer Dateiname identifiziert wurde, versucht das Tool automatisch, den...

alibaba__nacos_CVE-2021-44667_2-0-3

Nacos: Dynamischer Na mens- und Ko nfigurations-S ervice...

check-spelling

@check-spelling/check-spelling Azione GitHub Panoramica Tutti fanno errori di battitura. Questo include le persone che scrivono documentazione e commenti, ma include anche i programmatori che nominano variabili, funzioni, API, classi e nomi di file. Spesso i programmatori useranno...

go-cpe

go-cpe Una libreria Go per CPE Common Platform Enumeration 2.3 go-cpe è un'implementazione degli algoritmi di Naming e Matching del CPE, come descritto nei NIST IR 7695 e 7696. Per l'implementazione Java di riferimento, vedi:...

IIS-ShortName-Scanner

IIS Short Name Scanner - 2012-2023 & Ancora Funzionante... Ultima presentazione: Beyond Microsoft IIS Short File Name Disclosure Ultimo post sul blog: https://soroush.me/blog/2023/07/thirteen-years-on-advancing-the-understanding-of-iis-short-file-name-sfn-disclosure/ Raccomando a tutti di provare...

SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE

SolarWinds Web Help Desk before version 2026.1 contains an insecure deserialization vulnerability in the jabsorb JSON-RPC library. When chained with a CSRF whitelist bypass CVE-2025-40536, remote unauthenticated attackers can exploit JNDI injection via the Apache Xalan JNDIConnectionPool class to...

spectrIDA-Reverse_Engineering_Stack

👻 spectrIDA Geist durch Binaries. Ein lokaler, KI-gestützter Reverse-Engineering-Assistent: parallele IDA-Pro-Analyse, KI-Funktionsbenennung, ein Terminal, das nicht nervt, ein Neo4j-Wissensgraph von allem, was er je herausgefunden hat, und ein MCP-Server, damit Claude direkt in diesem Graphen...

sast-rules

Regole Semgrep Questo è il repository centrale delle regole Semgrep che ospita le regole Semgrep per l'analizzatore Semgrep di GitLab. Il repository è strutturato come segue: root@kitploit: . ├── mappings │ ├── findsecbugs.yml │ ├── eslint.yml │ └── ... ├── rules │ ├── lpgl │ │ ├── java │ │ │...

CVE-2025-14602 Weak File Name Generation in vsDesk

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

How to Spot and Stop Rogue Device Joins

Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attack...

BIT-JENKINS-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

PT-2026-73346

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

GO-2026-5371 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno-notation-aws...

CVE-2026-70430

A flaw was found in Jenkins. This vulnerability allows an attacker with Overall/Manage permission to instantiate arbitrary types of objects within the project naming strategy configuration. This includes types typically reserved for administrators, potentially leading to unauthorized configuratio...

CVE-2026-68181

In the Linux kernel, CVE-2026-68181 affects the mei bus cleanup path. The vulnerability arises in mei_cl_bus_dev_release() where mei_cl_flush_queues() runs without holding a lock, and subsequent access to bus-&gt;file_list after mei_dev_bus_put(bus) can lead to a use-after-free if it was the last...

CVE-2026-54206

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54207

CVE-2026-54207 affects Tobit TeamDavid’s Webbox move-archive feature (ArcEntryMove). The function accepts an arbitrary path, including UNC network paths like \Server\Share, which the server processes without validation. This can trigger outbound connections to attacker-controlled SMB servers, all...

CVE-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

CVE-2026-70430

CVE-2026-70430 affects Jenkins up to version 2.575 (non‑LTS) and 2.568.1 LTS. The root cause is that the project naming strategy configuration allowed instantiating arbitrary object types without restricting them, enabling attackers with Overall/Manage permission to instantiate configuration‑rela...