ephemera

Ephemera : 零信任SSH证书颁发机构 Zero-Trust SSH Certificate Authority Ephemera 是一个轻量级、自托管的SSH证书颁发机构，旨在为基础设施实施零信任访问。它用短生命周期证书替换静态SSH密钥，集成硬件支持的WebAuthn多因素认证（MFA），并维护密码学可验证的审计追踪。 !NOTE 主源仓库 : Codeberg GitHub镜像 : GitHub（用于可用性和托管） 高层架构 graph LR subgraph Client"用户（操作者）" SSH"SSH客户端" HW"硬件密钥WebAuthn / YubiKey" en...

shortscan

🌀 Shortscan IIS のショートファイル名を列挙するツールです。 機能 Shortscan は、IIS ウェブサーバー上にどのショートファイル名のファイルが存在するかを迅速に特定するために設計されています。ショートファイル名が見つかると、ツールは自動的に完全なファイル名を特定しようと試みます。 標準的な発見方法に加えて、Shortscan は独自のチェックサム照合アプローチも使用して、ショートファイル名が Windows 独自のショートネーム衝突回避チェックサムアルゴリズムに基づいている場合に、長いファイル名を見つけようとします（この研究の詳細は後日公開予定です）。 インストー...

fulcio

Fulcio 用于代码签名的免费 CA Fulcio 是一个免费的证书颁发机构，用于为 OpenID Connect OIDC 身份（例如电子邮件地址）签发代码签名证书。 Fulcio 仅签发有效期为 10 分钟的短期证书。 公共实例 Fulcio 已正式发布（General Availability），提供 99.5% 可用性 SLO，并遵循 semver 规则 以保证 API 稳定性。 有关 Fulcio 公共实例的运行时间数据，请参阅 https://status.sigstore.dev。 Fulcio 的证书链可通过 TrustBundle API 获取，例如公共实例...

IIS-ShortName-Scanner

IIS短文件名扫描器 - 2012-2023 & 仍然活跃 最新演讲： 超越Microsoft IIS短文件名泄露 最新博文： https://soroush.me/blog/2023/07/thirteen-years-on-advancing-the-understanding-of-iis-short-file-name-sfn-disclosure/ 我建议大家在尝试这个旧工具之前，先试试@bitquark用Go写的新工具：https://github.com/bitquark/shortscan...

rustbuster

rustbuster 包括的なWebファズツール＆コンテンツディスカバリーツール はじめに ブログ記事を参照: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool ダウンロード ビルド済みのバイナリはこちらからダウンロードできます。 インストール installrustbuster echo "Installing latest version of Rustbuster" latestversion=curl -s...

m4ngl3m3

m4ngl3m3! Quick Installation: $ git clone https://github.com/localh0t/m4ngl3m3 $ cd m4ngl3m3 $ ./main.py Basic Help: usage: main.py -h -fy FROMYEAR -ty TOYEAR -sy -nf NUMBERSFILE -sf SYMBOLSFILE -cf CUSTOMFILE -sbs -sap -mm MUTATIONMETHODS MUTATIONMODE STRINGSFILE OUTPUTFILE Common password patte...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload 任务 → 无认证 → 3字符串过滤器绕过（ 概述 DJ-Classifieds（Joomla 扩展）存在未授权任意文件上传漏洞。imageupload 任务端点在无身份验证 的情况下处理文件上传，并依赖一个3字符串黑名单 （?php、eval、base64），该黑名单可通过 PHP 短开标签（?=）轻松绕过。结合 GIF 多语言（polyglot）文件，上传的文件能通过所有图像校验，同时包含功能完整的 PHP WebShell。 字段| 详情 ---|--- CVE|...

gpgsm-cve-2026-57062-cms-gcm-short-tag

gpgsm CVE-2026-57062：CMS AES-GCM 短标签（USN-8720-1） GnuPG 的 gpgsm（S/MIME 和 CMS 工具）从 CMS AuthEnvelopedData（RFC 5083）AES-256-GCM 消息中的 mac OCTET STRING 派生其验证的身份验证标签长度，而 libgcrypt 接受短至 4 字节的标签。RFC 5084 要求至少 12 字节。Ubuntu 在 noble gnupg2 2.4.4-2ubuntu17.6 中通过拒绝任何短于 12 个八位字节的 authtag 修复了此问题。 这是一个概念验证：完全相同的伪...

openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to forge PKCS12 Public-Key Cryptography Standards 12 files that use Password-Based Message Authentication Code 1 PBMAC1 with short HMAC Hash-based Message Authentication Code keys. This can lead to a service accepting...

AZL-105609 CVE-2026-75806 affecting package openvmm 0.1.0-1

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is rout...

AETHER-PROTOCOL-P

⬡ AETHER PROTOCOL — Aether AI LLC. 2026 面向自主AI系统的密码学验证短时身份基础设施 专利申请中 — 美国申请号 64/006,746 — 2026年3月16日提交 "世界上每一个AI系统都可能因向其流水线注入虚假指令而被攻破。Aether Protocol 使这种情况在物理上不可能发生。" 问题 2026年2月25日，Check Point Research 披露了 CVE-2025-59536 — 一个存在于 Claude Code 中的严重漏洞（CVSS 8.7），该漏洞允许攻击者向 .claude/settings.json...

CVE-2026-97929

The Linux kernel contains a vulnerability in the ALSA: usbusx2y driver within the i_usx2y_in04_int() function. The driver fails to validate urb->actual_length , allowing a malfunctioning device to trigger a short transfer. This causes the handler to process uninitialized heap data from the kma...

CVE-2026-97565

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

CVE-2026-71465

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-71465

The automation-controller component within the Red Hat Ansible Automation Platform is vulnerable to command-line argument injection via the ad-hoc command limit field. The root cause is that RunAdHocCommand.build_args() appends the limit as a bare positional argument instead of using args.extend(...

CVE-2026-71465

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-71465: Improper Neutralization of Argument Delimiters in a Command

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-93559

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attac...

CVE-2026-93559

A missing authentication vulnerability affects Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha through 0.3.2) in an unknown function of backend/app/dependencies.py, a FastAPI component. An unauthenticated remote attacker can exploit this without user interaction, leading to low imp...

CVE-2026-93559 Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attac...