1233 matches found
LEAKEY
LEAKEY 🔑 LEAKEY is a tool is for validation of leaked API tokens/keys found during pentesting and Red Team Enegagments. The script is really useful for Bug Hunters inorder to validate and determine the impact of leaked credentials. LEAKEY uses a json based signature file located at...
CVE-2025-50433
CVE-2025-50433 — Critical Account Takeover Vulnerability Affecting Monnit Cloud Platforms .imonnit.com Summary A critical authentication vulnerability exists across .imonnit.com that allows full Account Takeover ATO on any user account without victim interaction. The backend fails to validate the...
EUVD-2026-118913
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intend...
CVE-2026-108178
IBM API Connect (versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 ) contains a vulnerability where an improperly implemented security check allows a token to be accepted that should have been rejected. Under certain conditions, incomplete token validation may result in a token be...
ownCloud Guests - User Enumeration
ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...
CVE-2026-104135
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...
CVE-2026-46455
CVE-2026-46455 — camel-keycloak Missing ISACTIVE Check Expired Tokens Accepted Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-keycloak 4.18.2 Cam...
CVE-2018-0114
CVE-2018-0114 Exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT. This vulnerability in Cisco's node-jose allows an attacker to forge malicious tokens. JWT allows users to embed public keys using the jwk value inside the header of the token. However,...
CVE-2026-36956
CVE-2026-36956: Cross-Site Request Forgery CSRF in Web Management Interface CVE ID: CVE-2026-36956 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: Shenzhen Dibit Network Equipment Co., Ltd. Product: Dbit Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Descripti...
CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation
CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized organization registration via improper invitation token validation Disclaimer This tool is for educational and security testing purposes only. Use only on systems you have explicit permission to test. Unauthorized access to computer syste...
CVE-2026-1529
CVE-2026-1529 Keycloak Exploit Tool CVE-2026-1529 : Keycloak - Unauthorized organization registration via improper invitation token validation ⚠️ WARNING : This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. 📋 Table of...
CVE-2020-28874
This repository contains the description of the vulnerability found CVE-2020-28874 in ProjectSend r1270 release. Thank you to my colleagues from Entelgy Innotec Security for pushing me to improve! CVE-2020-28874: Privilege Escalation Description The vulnerability is in the reset password componen...
cs50-cyber-paloalto-oauth
CS50 Cybersecurity Final Project Title: The Salesloft OAuth Breach & CVE-2024-3400 Palo Alto impact Author: Yafiya Darwesh GitHub: Yafiah-Darwesh YouTube video: https://youtu.be/CxQNj9qWoZ0?si=cHCwuTIY26YHJ8aw CVE: CVE-2024-3400 Files presentation.pdf — slides script.txt — speaker notes Summary...
CVE-2024-38822
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...
Improper Token Validation
pac4j-oidc is vulnerable to Improper Token Validation. The vulnerability is due to the library accepting OIDC callbacks that contain only an access token without performing authorization code or ID token validation, where attackers can substitute access tokens minted for other clients to create...
CVE-2026-87879
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 42587...
CVE-2026-87101
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 42587...
CVE-2026-87103
Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 Linux, Windows before build 42587...
