dheat_dos_attack_poc

DHeat DoS Attack POC CVE-2002-20001 POC para testar a existência do ataque DoS DHEat CVE-2002-20001 no serviço SSH Uso comando: python3 dheatdosattackpoc.py : Substitua pelo endereço IP real ou nome de host do servidor SSH que você tem permissão para testar. : Número da porta de destino que execu...

CVE-2026-44596

CVE-2026-44596 — YAMCS Assenza di limitazione della frequenza sull'endpoint di autenticazione Riepilogo L'endpoint di autenticazione POST /auth/token in yamcs-core è privo di qualsiasi forma di limitazione della frequenza, blocco dell'account o limitazione dei tentativi falliti. Un attaccante...

tcconfig

.. contents:: tcconfig :backlinks: top :depth: 2 Summary tcconfig is a tc command wrapper. Make it easy to set up traffic control of network bandwidth/latency/packet-loss/packet-corruption/etc. to a network-interface/Docker-containerveth. |PyPI pkg ver| |Supported Python ver| |CI status| |CodeQL|...

CVE-2026-75575

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

CVE-2026-72699

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72700

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

CVE-2026-75575 Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

CVE-2026-75575 Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

CVE-2026-75575

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, allowing an unauthenticated caller to invoke it via DDP or the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail. Because no DDPRateLimiter rule is registered, an attacker can send an unbounded v...

EUVD-2026-65218

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

CVE-2026-75575 Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

EUVD-2026-65214

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

CVE-2026-72699 Grav Login Plugin before 3.9.1 Email Enumeration via Registration

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

EUVD-2026-65213

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72699

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration . The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email already belongs to an existing account, while allowing registration to pr...

CVE-2026-72699 Grav Login Plugin before 3.9.1 Email Enumeration via Registration

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2021-39409

CVE-2021-39409 O registro de conta de administrador é possível no Online Student Rate System v1.0, permitindo que um ator malicioso crie uma conta de administrador e acesse o painel de administração. Vulnerabilidade root@kitploit: POST /ajax.php?action=signup HTTP/1.1 Host: localhost User-Agent:...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

CVE-2021-39408

CVE-2021-39408 Una vulnerabilità di Cross Site Scripting XSS riflesso esiste in più versioni 1.0 dell'applicazione Online Student Rate System che consente l'esecuzione arbitraria di comandi JavaScript. Pagina vulnerabile In index.php, il parametro page è vulnerabile, consentendo a un attaccante d...

CVE-2026-78551 RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...