thingsboard

Open-source IoT platform for data collection, processing, visualization, and device management. 💡 Get started • 🌐 Website • 📚 Documentation • 📔 Blog • 🔗 LinkedIn 🚀 Installation options Install ThingsBoard on-premises or use ThingsBoard Cloud. 💡 Getting started with ThingsBoard Check out our Getti...

365-Stealer

365-Stealer Table of Contents About 365-Stealer About Illicit Consent Grant Attack Key Features of 365-Stealer Setup Attacking Environment Automated Azure App Registration Manual Azure App Registration Configuring the Application Creating Client Secrets Adding API Permissions Setting Up 365-Steal...

CVE-2025-51864

CVE-2025-51864 Vulnerability description AIBOX is a web application for exploring AI consulting and trying out multiple LLMs. It allows users to chat with various LLMs. A reflected cross-site scripting XSS vulnerability exists in the chat component, which could lead to JWT token theft and remote...

CVE-2023-31779

CVE-2023-31779 Stored XSS in Wekan Description : Stored XSS vulnerability exists in the "Reaction to comment" feature. An attacker with user privilege on kanban board can execute JavaScript code in the browsers of users who open card with malicious reaction. Impact : An attacker can steal...

keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Stored Cross-Site Scripting XSS in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by craftin...

CVE-2026-63127

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

CVE-2026-63127 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

CVE-2026-63127

RMCP is the official Rust SDK for the Model Context Protocol . Prior to version 2.0.0 , the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-...

CVE-2026-63127 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

EUVD-2026-80824

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

EUVD-2026-80008

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via uploadmarkdown enables PAT exfiltration and full account takeover...

CVE-2026-25253

CVE-2026-25253: RCE con un solo clic en OpenClaw mediante el robo de tokens de autenticación Software afectado: OpenClaw clawbot AVISO LEGAL: Este código y análisis se proporcionan únicamente con fines de investigación de seguridad autorizada y educativos. El uso de este exploit contra sistemas s...

CVE-2026-66421-OpenClaw-Dashboard-Stored-XSS-via-lastMessage-Session-Field

Aviso de Seguridad: Cross-Site Scripting Almacenado a Través de Mensajes de Agente Que Conduce al Robo de Tokens de Sesión openclaw-dashboard Título: OpenClaw Dashboard XSS Almacenado a través del campo lastMessage de la sesión ID de CVE: CVE-2026-66421...

The vulnerability of the TrueConf Server software, related to deficiencies in the authentication process, allows a perpetrator to obtain a token with administrator privileges.

The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain an administrator-level token...

CVE-2024-55040-Sensaphone-XSS

DIVULGACIÓN DE VULNERABILIDADES DE SENSAPHONE Resumen A mediados de septiembre de 2024, identifiqué varios problemas de seguridad de severidad media a baja en el Sensaphone Web600 Monitoring System, incluyendo vulnerabilidades de cross-site scripting XSS almacenado en las opciones de Configuració...

Microsoft365_devicePhish

Microsoft365devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow. Using this, one can connect to Microsoft's OAuth API endpoints t...

CVE-2019-0803

CVE-2019-0803 PoC de elevación de privilegios de Win32k Captura de pantalla Referencia robar token de seguridad https://github.com/mwrlabs/CVE-2016-7255...

offensive-azure

一组针对 Microsoft Azure 的攻击工具集合，使用 Python 编写以实现平台无关性。当前工具列表及其简要功能描述如下。 ./DeviceCode/devicecodeeasymode.py 生成一个供目标用户输入的代码 可用于通用令牌生成，或在钓鱼/社会工程攻击活动中使用。 ./AccessTokens/tokenjuggle.py 以多种方式接收一个刷新令牌，并为指定资源获取一个新的刷新令牌和一个访问令牌 ./AccessTokens/readtoken.py 接收一个访问令牌，解析其包含的声明信息，检查过期时间，并尝试验证签名...