socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

LDAP-Password-Hunter

LDAP 密码猎人 由于旧服务需求或不良安全实践，密码在LDAP数据库中对任何能够通过身份验证的用户都是可读的。 LDAP密码猎人是一个工具，它封装了getTGT.py（Impacket）和ldapsearch的功能，用于查找存储在LDAP数据库中的密码。Impacket的getTGT.py脚本用于对枚举使用的域账户进行身份验证，并保存其TGT Kerberos票据。随后，TGT票据被导出到KRB5CCNAME变量中，ldapsearch脚本利用该变量进行身份验证，并为每个运行LDAP密码猎人的域/DC获取TGS...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

log4shell

log4shell Python脚本，用于扫描服务器文件系统中存在CVE-2021-44228和CVE-2021-45046漏洞的log4j jar文件。该脚本递归遍历文件系统（包括zip、ear、war），查找包含org/apache/logging/log4j/core/lookup/JndiLookup.class的log4j 2.至2.15版本。 脚本接受要扫描的文件系统路径，并列出存在漏洞的jar文件路径、Bundle-Version和Bundle-Name。这些值以冒号":"分隔。如果该脚本由类似Ansible的编排工具执行，且需要机器可读的输出格式，这种输出格式非常有用。...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: The TOCTOU issue in skisreadable has been fixed. sk-skprot-sockisreadable is a valid function pointer when sk resides in a sockmap. After the last skpsockput call which usually occurs when a socket is removed from the sockma...

krane

Krane Kubernetes RBAC Analysis made Easy Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its...

openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21970-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21970-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has extracted the...

readable-thrift

Readable Thrift Readable Thrift facilita el trabajo con mensajes binarios del protocolo Thrift, convirtiéndolos a y desde un formato legible para humanos. Esto hace que el análisis manual y la manipulación de mensajes Thrift en formato binario sean tan sencillos como trabajar con protocolos de...

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

SummaryWhen OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...

CVE-2020-10977

Exploit en Python para lectura arbitraria de archivos en instancia privada de gitlab En la fecha 23/03/2020, se publicó un informe de vulnerabilidad con su PoC en hackerone por William Bowling Con esta vulnerabilidad podemos leer cualquier archivo legible por el mundo con permiso 444 o más en el...

Rocky Linux 8 [CIQ] Security Update: rear (crlsa-2024_1719)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20241719 advisory. rear: creates a world-readable initrd CVE-2024-23301 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus...

Rocky Linux 8 [CIQ] Security Update: jss / jss-debuginfo / jss-debugsource / jss-javadoc / ldapjdk / etc (crlsa-2021_2235)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212235 advisory. pki-server: Dogtag installer pkispawn logs admin credentials into a world-readable log file CVE-2021-3551 The PKI installer pkispawn logs admin credentials into a...

Linux Distros Unpatched Vulnerability : CVE-2026-102675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5,...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init (ALMALINUX9.2:CLSA-2026:1782809708)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782809708 advisory. - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could...

Rocky Linux 8 [CIQ] Security Update: cloud-init (crlsa-2021_3081)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20213081 advisory. cloud-init: randomly generated passwords logged in clear-text to world-readable file CVE-2021-3429 Tenable has extracted the preceding description block directly fr...

CVE-2026-102675

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

EUVD-2026-89093

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

OPENSUSE-SU-2026:21970-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...

CVE-2026-102675: Origin Validation Error

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

Linux Distros Unpatched Vulnerability : CVE-2026-97025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users o...