ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

ssrf-sheriff

SSRF Sheriff これはGoで書かれたSSRFテスト用の保安官です。元々はUber H1-4420 2019 London Live Hacking Eventのために作成されましたが、現在は他の組織が実装して貢献できるようにオープンソース化されています。 機能 任意のHTTPメソッド（GET、POST、PUT、DELETEなど）に応答します 設定可能なシークレットトークン（base.example.yamlを参照） コンテンツ固有の応答 応答本文にシークレットトークンを含む JSON XML HTML CSV TXT PNG JPEG 応答本文にトークンを含まない GIF MP...

CVE-2019-5420

CVE-2019-5420 PoC 開発モードのRails 5.2.2.1、6.0.0.beta3におけるリモートコード実行の脆弱性により、攻撃者が自動生成された開発モードのシークレットトークンを推測できる可能性があります。このシークレットトークンは、他のRails内部機構と組み合わせてリモートコード実行エクスプロイトに昇格させることができます。CVE-2019-5420用のこのPoCコードは、リモートコード実行自体は行わず、管理者アカウントへの権限昇格を行います。 使い方 cookieの値をコピーし、11行目の"VALUEOFTHECOOKIE"に置き換えてください: cookie =...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

EUVD-2026-56902

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474 Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

PT-2026-70869

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where the application logs request headers upon receiving a non-200 response. This process may expose the cloud.openshift.com pull-secret token. A local user with access...

CVE-2026-71474: Insertion of Sensitive Information into Log File

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

EUVD-2026-51855

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

CVE-2026-18378 Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18378

The CVE-2026-18378 issue affects the koku-metrics-operator. A vulnerability exists in the CostManagementMetricsConfig custom resource, which allows a user to edit the CR to set an arbitrary upload URL. When authentication.type is token (default), the cluster-global Red Hat Cloud pull-secret beare...

CVE-2026-15212

CVE-2026-15212 affects the WPO365 | Login plugin for WordPress (up to version 43.2). The root cause is that Ajax_Service::verify_ajax_request() gates wp_verify_nonce() behind the boolean option enable_nonce_check, which is missing from the default wpo365_options. This causes wp_ajax_wpo365_update...

CVE-2026-15212

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

CVE-2026-27882 Coolify: Timing Attack in GitLab Webhook Token Validation

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator !== to validate the webhook secret token. This implementation is vulnerable to timing attack...

CVE-2026-27882

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator !== to validate the webhook secret token. This implementation is vulnerable to timing attack...

GHSA-RPJ7-HR7H-W6P9 CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

Impact When a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped. Preconditions The service is configured to authenticate using SAML tokens and an out of band token resolver commonly the IssuerTokenResolve...

SUSE CVE-2025-1296

Nomad Community and Nomad Enterprise “Nomad” are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19...