fuzzowski

Fuzzowski root@kitploit: █ █ ████████ ██████████ ██ ████ ██ ██ ████ ██ ████ ████ █ ████████████ █ █ ██████████ █ مُختبر الشبكة Fuzzowski █ █ █ █ 🄯 شركة Fuzzers ██ ██ بواسطة ماريو ريفاس الفكرة هي أن تكون مُختبر بروتوكول الشبكة الذي سنرغب في استخدامه. الهدف من هذه الأداة هو المساعدة طوال عملية اختب...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

ICPin

ICPin أداة Pintool لمراقبة فحوصات السلامة ما هي؟ أداة pintool تسجّل عمليات القراءة والكتابة على الملف التنفيذي في الذاكرة. كما تتعقّب التعليمات البرمجية المنفَّذة ديناميكيًا وتتعامل مع بعض فحوصات مكافحة التصحيح وهي محصّنة ضد معظم تقنيات مكافحة التصحيح بحكم تصميم pintool وتُخرج تتبعات الاستدعاءات...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185 Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185

CVE-2026-84185 affects the jwcrypto library, a Python implementation of the JOSE (JSON Object Signing and Encryption) standards. The flaw occurs during verification of a General JSON Serialization JWS against a key set (JWKset): due to a coding error, the library fails to correctly match the key ...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

anti-anti-automation

Framework Anti-Anti-Automatisation Un framework de techniques permettant de contourner les contrôles de sécurité anti-automatisation courants. Contrôles anti-automatisation courants Vérification par e-mail CAPTCHA SMS/Téléphone Carte de crédit WASC-21: Anti-automatisation insuffisante...

frogy2.0

Orbis - Attack Surface Intelligence Full-Spectrum Attack Surface Intelligence Orbis automatically maps your organisation's entire internet-facing attack surface, subdomains, open ports, web applications, cloud infrastructure, TLS certificates, email posture, exposed secrets, login panels, and mor...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

CVE-2026-84736

Eclipse aeriOS (current development version, no official release published) has a vulnerability in its Federator component where TLS certificate validation is disabled by default for outbound HTTPS connections. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the...

ics-forensics-tools

ICSpector: Microsoft ICS Forensics Framework Microsoft ICS Forensics Tools framework is an open-source forensics framework that enables the analysis of Industrial PLC metadata and project files. The framework provides investigators with a convenient way to scan for PLCs and identify any suspiciou...

CVE-2026-85237

MISP 's email_otp() endpoint lacked brute-force protection when validating OTP values, allowing an attacker who had passed the primary credential check to submit unlimited OTP guesses while the same OTP remained valid. The risk was compounded because OTPs are bound to the user rather than a singl...

CVE-2026-85221

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

CVE-2026-59272

A flaw was found in the Log4j2 AMQP Appender. When configured to ship logs to RabbitMQ over Transport Layer Security TLS, the appender disables hostname verification by default. This misconfiguration allows a remote attacker to perform a man-in-the-middle MITM attack, intercepting sensitive log...