GHSA-687G-22H4-J4W4 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...

GHSA-G3JJ-5CMM-3HXX fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...

GHSA-6WJP-V33H-5CVQ PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

GHSA-CV3G-HJ65-PCFH PraisonAI: Shell command allowlist bypass via find -exec built-in action

Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...

PraisonAI: Shell command allowlist bypass via find -exec built-in action

Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...

GHSA-HC5V-GXVJ-58WH PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

GHSA-4W49-GWV8-FPJG PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

Summary PraisonAI's Async Jobs API enables its API-key middleware only when PRAISONAIJOBSAPIKEY is set, so by default every endpoint is unauthenticated. An unauthenticated POST /api/v1/runs accepts an attacker-controlled webhookurl; on job completion the server POSTs the job payload to it via...

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

Summary PraisonAI's Async Jobs API enables its API-key middleware only when PRAISONAIJOBSAPIKEY is set, so by default every endpoint is unauthenticated. An unauthenticated POST /api/v1/runs accepts an attacker-controlled webhookurl; on job completion the server POSTs the job payload to it via...

CVE-2019-7238

CVE-2019-7238 Nexus Repository Manager RCE Nexus Repository Manager 3 Ejecución remota de código sin autenticación nexus Acerca del eco de comandos: functionx, y, z, c, integer, defineClass c=1.class.forName'java.lang.Character'; integer=1.class;...

CVE-2022-22963-POC

CVE-2022-22963 Exploit Description In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local...

Spring-CVE

Spring CVE This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell". CVE-2022-22963 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing...

zuthaka

A collaborative free open-source Command & Control integration framework that allows developers to concentrate on the core function and goal of their C2. Explore the docs » · Report Bug · Request Feature · Table of Contents 1. About The Project Problem statement Solution Built With 2. Already...

pydictor

pydictor README.md中文版 pydictor —— A powerful and useful hacker dictionary builder for a brute-force attack | | | | ' | | | |/ | |/ | / | '| | | | || | | | | | || | | | ./ , |,|||\/|| || |/ Email: [email protected] Preface： Q: Why I need to use pydictor ? A: 1.it always can help you You...

webscan

webscan webscan es un escáner de IP de red basado en navegador y detector de IP local. Detecta IPs vinculadas al usuario/víctima escuchando en un canal de datos RTP a través de WebRTC y realizando un bucle de retorno al puerto a través de cualquier IP activa, así como descubriendo todas las...

webscan

webscan webscan is a browser-based network IP scanner and local IP detector. It detects IPs bound to the user/victim by listening on an RTP data channel via WebRTC and looping back to the port across any live IPs, as well as discovering all live IP addresses on valid subnets by monitoring for...

Recon

👑 Recon 👑 The step of recognizing a target in both Bug Bounties and Pentest can be very time-consuming. Thinking about it, I decided to create my own recognition script with all the tools I use most in this step. All construction of this framework is based on the methodologies of @ofjaaah and...