cumulus

Application Weakness Monitoring Software What's Cumulus Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It's very simple and powerful. Key features Just install SDK to web front, can be found security weakness on...

CVE-2023-31594

CVE-2023-31594 IC Realtime ICIP-P2012T는 부적절한 접근 제어 취약점이 있습니다. IC Realtime IP PTZ 돔 카메라 ICIP-P2012 소프트웨어 버전 2.420의 인증되지 않은 스트리밍 채널 라이브 피드MJPEG는 노출된 HTTP 채널을 통해 VLC 네트워크 스트림으로 스트리밍될 수 있습니다. 이 취약점은 고객의 기밀성에 심각한 영향을 미치며 정찰 단계사람, 자산, 비밀번호 등 식별에 사용될 수 있습니다. 개념 증명 POC HTTP 스트리밍이 허용되는 경우, 사용자가 인증 없이 카메라의...

CVE-2023-31595

CVE-2023-31595 IC Realtime ICIP-P2012T는 열린 포트를 통한 부적절한 접근 제어Incorrect Access Control에 취약함 IC Realtime IP PTZ Dome Camera ICIP-P2012 소프트웨어 버전: 2.420 노출된 포트9989는 요청 시점의 라이브 스냅샷을 반환하며, 스크립트를 사용하면 매 x초마다 라이브 피드 이미지를 얻는 데 악용될 수 있습니다. 이 취약점은 데이터의 기밀성에 심각한 영향을 미치며, 정찰 단계사람 식별, 비밀번호 등에서 모든 위협에 사용될 수 있습니다...

Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery

Ignite Realtime Openfire through version 4.4.2 allows attackers to send arbitrary HTTP GET requests in FaviconServlet.java, resulting in server-side request forgery. id: CVE-2019-18394 info: name: Ignite Realtime Openfire =4.4.3 to fix this vulnerability. reference: -...

Pentest-Collaboration-Framework

Pentest Collaboration Framework Pentest Collaboration Framework - an opensource, cross-platform and portable toolkit for automating routine processes when carrying out various works for testing! Explore the docs » ‼️ Important Links Links | ---|--- 📖Installation Guide | 🌐Wiki 🚀Releases 💬Telegram...

FireShodanMap

FireShodanMap FireShodanMap은 Firebase와 Shodan을 통합한 실시간 지도입니다. Shodan을 사용하여 취약한 장치를 검색하고 분석을 위해 지도에 표시합니다. Firebase에 업데이트된 모든 데이터는 실시간입니다. 변경 사항 Firebase 데이터베이스를 채우기 위한 "fireshodan.py" 파일이 있으며, 다음을 변경해야 합니다: + FILEWITHKEY.json Credentials 탭을 열고 Create credentials 를 클릭합니다. API 키 옵션을 선택합니다. 서버 키를 생성...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

revsync

revsync IDA Pro、Binary Ninja、Vivisect 向けのリアルタイム同期プラグイン 同期対象： コメント シンボル名 スタック変数名 構造体 コードカバレッジ（ブロックの調査に費やした時間） IDA Pro のインストール まず、IDA データディレクトリにクローンします： Windows: %APPDATA%\Hex-Rays\IDA Pro Mac/Linux: /.idapro 次に： 上記のディレクトリに idapythonrc.py というファイルを作成し、import revsync を追記します。 config.json.template を...

CVE-2026-103057

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103055

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

EUVD-2026-89541

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103057

AiSOC versions 5.1.0 before 12.0.0 are vulnerable to an authentication bypass in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push . This flaw allows attackers to post arbitrary events using spoofed tenant identifiers , enabling them to broadcast malicious...

CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055

AiSOC versions 7.5.0 before 12.0.0 are vulnerable to an authentication bypass due to the use of a hard-coded constant for JWT verification in the realtime WebSocket and SSE service . This flaw occurs specifically when the AISOC_REALTIME_JWT_SECRET environment variable is not configured. Unauthent...

EUVD-2026-89539

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

CVE-2026-27579 – CORS設定ミスによる認証済みデータ漏洩 📌 アドバイザリ参照情報 CVE ID: CVE-2026-27579 GHSA: GHSA-qh5m-p8jh-hx88 ベンダー: karnop 製品: realtime-collaboration-platform 深刻度: HIGH CVSS 7.4 ベクトル: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N 🧠 脆弱性の概要 realtime-collaboration-platform プロジェクトには、Appwriteバックエンド設定におけるCORS設定ミス...

CVE-2026-100546

OpenClaw npm package openclaw versions = 2026.7.2 and 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a...