NoArgs

NoArgs: Manipulating and Hiding Process Arguments Twitter: @AzizWho Disclaimer: Educational Use Only This tool is intended solely for educational purposes. I am not liable for any misuse and all users must adhere to applicable laws. Illegal use is prohibited. Introduction NoArgs is a tool designe...

BRC4-BOF-Artillery

Generic This repository includes a collection of generic BOFs I wrote over a period of time. This repository solely focuses on porting and execution, without modifying the original source for stability. While I may conduct further testing in the future, this is not officially supported. Contact...

GHSA-M8F5-RH7H-VGG3 microsandbox: Secret values exposed in world-readable process arguments

Summary When the SDK spawns a sandbox, the msb sandbox child process receives the full network configuration as an inline --network-config command-line argument, and any per-sandbox environment as repeated --env KEY=VALUE arguments. On Linux a process's arguments are world-readable via...

CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...

CVE-2026-61670

CVE-2026-61670 affects microsandbox , a local-first microVM runtime and library, prior to version 0.5.10 . The root cause is that sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments...

CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...

CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...

DEBIAN-CVE-2026-92768

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password value...

CVE-2026-92745 Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management RHSM offline token. The token is exposed when it is passed as a command-line argument to a helper script during the...

CVE-2026-92745

A flaw in cockpit-machines allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token . The token is exposed because it is passed as a command-line argument to a helper script during the token validation proces...

CVE-2026-18915 Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

MAL-2026-6070 Malicious code in libsc-runtime-telemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280cf690237f367f57670f695c85d84227b06c563f5f1c1c3f69d437c52cbfe4 Importing libsc-runtime-telemetry auto-invokes a bootstrap routine that schedules a periodic job collecting host identity hostname, public IP, revers...

CVE-2026-1995

In versions before 7.0.0.64, IDrive’s idservice.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDrive\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any...

BIT-RABBITMQ-C-2023-35789

An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for amqp-publish or amqp-consume and are thus visible to local attackers by listing a process and its arguments...

CVE-2025-6571

A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it...

EUVD-2025-74041

A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it...

CVE-2025-6571

A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it...

CVE-2025-6571

A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it...

CVE-2025-6571

A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it...

CVE-2025-6571

CVE-2025-6571 affects AXIS OS (Axis edge device OS). A third-party component exposes its password in process arguments, allowing low-privilege users to access it. The available documents describe the root cause (password exposure in parameters) and the impact (local access by low-privilege users)...