bluesnoop

bluesnoop Un sniffer simple de Bluetooth Low Energy BLE usando Python y la librería Bleak Características Identificar UUIDs y nombres de dispositivos cercanos Seguimiento persistente de la primera y última aparición Traducción de IDs de modelo crípticos Exportar inteligencia para análisis externo...

CVE-2025-22828

CVE-2025-22828 📜 Descripción Apache CloudStack 4.16.0 y versiones posteriores presentan un problema de control de acceso roto que permite a los usuarios con conocimiento de los UUID de recursos leer o añadir comentarios anotaciones en recursos a los que no están autorizados a acceder. Los UUID...

CVE-2026-55255-Lab

CVE-2026-55255 - Langflow IDOR in /api/v1/responses Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-55255, an Insecure Direct Object Reference IDOR vulnerability affecting Langflow's OpenAI-compatible Responses API. Langflow is an open-source...

bluffy

Bluffy Convierte shellcode en ✨ diferentes ✨ formatos! Bluffy es una utilidad que se utilizó en experimentos para evadir productos antivirus de forma estática formateando shellcode en formatos de datos de apariencia realista. Herramientas de prueba de concepto, como NinjaUUIDRunner de 0xBoku y...

FUD-UUID-Shellcode

FUD-UUID-Shellcode Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either Havoc, CobaltStrike or...

CVE-2019-16113-Dockerfile

Vulnerabilidad de cruce de directorios de Bludit CVE-2019-16113 Bludit-3.9.2 es un CMS ligero que solo necesita un entorno LAMP para funcionar. Al cargar imágenes, Bludit verifica la extensión del archivo pero no lo elimina a tiempo, y un atacante puede lograr un cruce de directorios controlando ...

Directus - Unauthenticated File Modification

Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/id endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning ...

EUVD-2026-87981

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: Una reimplementación de https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py Utiliza UUIDs como parte del nombre de archivo solicitado para evitar que el servidor remoto se bloquee después de la primera explotación de path traversal. run.py /...

RDL-detect

Verificación del servicio Remote Desktop Licensing Referencia: https://github.com/fortra/impacket/blob/master/examples/rpcdump.py Enumera los servicios abiertos a través de MSRPC y determina si incluye Terminal Server Licensing según el UUID: 3d267954-eeb7-11d1-b94e-00c04fa3080d Uso: python3...

EUVD-2026-87091

The AIL Framework crawler task creation API apiaddcrawlertask contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Descripción general Este repositorio contiene la Prueba de Concepto PoC para CVE-2026-24134 , una vulnerabilidad de Autorización Rota a Nivel de Objeto BOLA en StudioCMS. Contenido cve202624134poc.py - Script de explotación en Python Requisitos previos StudioCMS=0.1.1 pip...

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Cross-tenant disclosure risk on DurableTask bidi RPC This is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task's event log, and returning them to the caller via th...

Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities

Summary The vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION:...

CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied taskexternalid values in the durableInvocations routing map before tenant ownership is verified, and callback delivery...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0  by vulnerabilities in uuid

Summary Security Bulletin:Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in uuid, IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of...

CVE-2026-94393

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

EUVD-2026-83911

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94393

MISP versions below 2.5.47 are affected by a cross-event authorization flaw in the editReport function. When creating or editing a report, MISP resolves an existing report by UUID without verifying that the report belongs to the same event. A user with editor access to at least one event can ther...