goblob

Goblob 🫐 Goblob은 Azure Blob에 공개적으로 노출된 민감 정보를 발견하는 데 도움을 주는 가볍고 빠른 열거 도구입니다. 이는 취약점 평가, 침투 테스트, 정찰 등 다양한 연구 목적에 유용할 수 있습니다. 경고. Goblob은 각 저장소 계정에서 확인할 각 컨테이너 이름에 대해 개별 고루틴을 생성하며, -goroutines 플래그에 지정된 최대 동시 고루틴 수로만 제한됩니다. 이 구현은 기본 워드리스트를 사용할 경우 대부분의 경우 대역폭을 빠르게 소진하거나, 클라우드 환경에서 도구를 사용할 경우 많은 비용이 발...

s3-leaks

s3-leaks AWS S3 リークの一覧 他のリークをご存知の場合は、お気軽にPRをお送りください 日付| 説明| 備考 ---|---|--- April 2025| S3バケットからのAWSアクセスキーIDに関する考察| AWS王国への鍵 March 2025| オーストラリアのNine新聞の購読者16,000人| 氏名、郵便住所、および/またはメールアドレス Jan 2025| ノースダコタ州のテレビ局Valley News Liveで180万以上のファイルが流出|...

BlobHunter

BlobHunter Azure blob storage 계정에서 공개적으로 열린 blob을 스캔하는 오픈소스 도구입니다. BlobHunter는 Azure Blob 사냥으로 수백만 개의 민감한 파일 노출 연구의 일부입니다. 개요 BlobHunter는 인터넷에 연결된 모든 사람이 공개적으로 접근할 수 있는 파일을 저장하는 Azure blob storage 컨테이너를 식별하는 데 도움을 줍니다. 이 도구는 민감한 데이터를 저장하는 잘못 구성된 컨테이너를 식별하여 위험을 완화하는 데 도움이 되며, 특히 추적하기 어려운 많은 스토리지 계...

SOC-L1-OSINT-Investigation-MikroTik-CVE-2018-1156

SOC L1 脅威調査: MikroTik RouterOS 複数公開サービス アナリスト: Jonatan Alexander Guerrero Gomez | 対象ロール: SOC L1 / ジュニアサイバーセキュリティアナリスト ステータス: 調査終了 | 重大度: 高 エグゼクティブサマリー 公開されたMikroTik...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2025-13394 Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2026-18602

creationtimestamp| type| source ---|---|--- 2026-08-04 16:00:44+00:00| seen| https://www.acn.gov.it/portale/w/gl-inet-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-18601-cve-2026-18602-cve-2026-18612-cve-2026-18616 2026-08-05 01:00:34+00:00| seen|...

PT-2026-66766

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

GO-2026-6063 Gitea: REST API exposes organization membership of private organizations to public in gitea.dev

Gitea: REST API exposes organization membership of private organizations to public in gitea.dev...

CVE-2023-54366

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations o...

CVE-2026-49211

Symfony UX Autocomplete vulnerable in versions 2.2.0–2.35.0 and 3.1.0 where addSearchClause() builds LIKE literals with client input wrapped in %...%, without escaping %, _, or , allowing unauthenticated users to turn BaseEntityAutocompleteType into a broad matcher across default searchable_field...

CVE-2026-59720

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without...

CVE-2026-59720

Hoppscotch’s Mock API exposes private collection data due to a desync: mock-server.service.ts does not persist the isPublic input, while schema.prisma defaults isPublic to true, making mock servers linked to private collections publicly accessible without authentication. The vulnerability affects...

CVE-2026-59720 Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without...

CVE-2026-59720 Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without...

PYSEC-2026-291 Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Summary In backpropagate = 1.1.0, the optional Reflex web UI pip install backpropagateui, launched via backprop ui exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing...

GHSA-F65R-H4G3-3H9H Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Summary In backpropagate = 1.1.0, the optional Reflex web UI pip install backpropagateui, launched via backprop ui exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing...

CVE-2026-44622

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

CVE-2026-54092 File Browser: DoS Vulnerability on Public Login API

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after...