614 matches found
kerberoast
kerberoast Kerberoast is a series of tools for attacking MS Kerberos implementations. Below is a brief overview of what each tool does. Extract all accounts in use as SPN using built in MS tools PS C:\ setspn -T medin -Q / Request Tickets One ticket: PS C:\ Add-Type -AssemblyName...
sadcloud
Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...
RiskySPN
RiskySPNs RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs Service Principal Name. This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active...
CVE-2026-29000-pac4j-jwt-auth-bypass
HTB Principal — CVE-2026-29000 Writeup Disclaimer: This exploit was developed solely for the retired HackTheBox machine "Principal". For educational purposes only. Do not use against systems you do not own or have explicit permission to test. Machine Info Field| Details ---|--- Name| Principal...
CVE-2026-35414
CVE-2026-35414 CVE-2026-35414 Vuln block auth2-pubkeyfile.c vulnerable static int matchprincipalsoptionconst char principallist, struct sshkeycert cert char result; uint i; / XXX percentexpand sequences for authorizedprincipals? / for i = 0; i nprincipals; i++ if result = matchlistcert-principals...
GO-2026-6753 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
PT-2026-118057
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
PT-2026-118030
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api...
CVE-2026-109553 Gitea SSH certificate principal impersonation of other users
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...
CVE-2026-109553 Gitea SSH certificate principal impersonation of other users
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...
CVE-2026-109553
The Gitea SSH server is vulnerable to principal impersonation due to an incorrect logic in how it resolves SSH certificate principals. The software incorrectly searches the content of all stored public keys instead of only the principal keys. This issue occurs when Gitea trusts a user certificate...
ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...
ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation in the LDAP claim resolution process. An attacker can gain unauthorized access or escalate privileges by exploiting the lack of verification between the LDAP result and the Kerberos principal SID. Remediation Upgrade...
CVE-2026-109562: Missing Authorization
SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...
Principal-Type Confusion
code.vikunja.io/api is vulnerable to a principal-type confusion. The vulnerability is due to missing type validation in permission checks, which allows an attacker with a link-sharing JWT to exploit ID collisions to remove victims from teams, enumerate and delete their bot users, or access team...
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
Summary Vikunja's web.Auth interface pkg/web/web.go, single method GetID int64 is satisfied by BOTH user.User and models.LinkSharing. A link-share's GetID returns the raw positive share.ID pkg/models/linksharing.go:83-85, which lives in the same positive autoincrement ID space as users.id. The sa...
GHSA-32R8-5843-4QW2 Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
Summary Vikunja's web.Auth interface pkg/web/web.go, single method GetID int64 is satisfied by BOTH user.User and models.LinkSharing. A link-share's GetID returns the raw positive share.ID pkg/models/linksharing.go:83-85, which lives in the same positive autoincrement ID space as users.id. The sa...
SUSE CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...