382 matches found
bypass-url-parser
Bypass Url Parser Tool that tests MANY url bypasses to reach a 40X protected page. If you wonder why this code is nothing but a dirty curl wrapper, here's why: Most of the python requests do url/path/parameter encoding/decoding, and I hate this. If I submit raw chars, I want raw chars to be sent...
autovpn
!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...
aiodnsbrute
Async DNS Brute A Python 3.5+ tool that uses asyncio to brute force domain names asynchronously. Speed It's fast. Benchmarks on small VPS hosts put around 100k DNS resoultions at 1.5-2mins. An amazon M3 box was used to make 1 mil requests in just over 3 minutes. Your mileage may vary. It's probab...
fileintel
fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...
hostintel
hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...
CVE-2026-102937
A flaw was found in virtualenv. An attacker can achieve arbitrary code execution by supplying specially crafted prompt values or environment configurations containing unescaped quote characters when generating Windows virtual environments. When a user executes the resulting activation script, the...
EUVD-2026-89461
virtualenv bash and fish activation scripts execute commands embedded in paths...
virtualenv bash and fish activation scripts execute commands embedded in paths
Impact The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs comman...
EUVD-2026-89464
virtualenv: Command injection via --prompt in activate.bat batch activator...
virtualenv: Command injection via --prompt in activate.bat (batch activator)
BatchActivator.quote returned its input unchanged, the only activator with no escaping at all. --prompt, the VIRTUALENVPROMPT environment variable, and the config file all set the prompt, and activate.bat writes it straight into @set "VAR=value". A prompt containing a double quote closes that...
Linux Distros Unpatched Vulnerability : CVE-2026-102930
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for...
Linux Distros Unpatched Vulnerability : CVE-2026-102937
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat...
CentOS Linux 7 [TuxCare] Security Update: python-virtualenv (CENTOS7:CLSA-2026:1771855894)
The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1771855894 advisory. - virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not...
Linux Distros Unpatched Vulnerability : CVE-2026-102925
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place...
Linux Distros Unpatched Vulnerability : CVE-2026-102938
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented...
Rocky Linux 8.6 [CIQ] Security Update: python2-virtualenv Multiple Vulnerabilities (ciqsa-2026_0195)
The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260195 advisory. This advisory aggregates security fixes for the python-virtualenv SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2023-32681, CVE-2022-4506...
EUVD-2026-89462
virtualenv: Downloaded seed wheels pip/setuptools are not integrity-checked before use...
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
downloadwheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or the...
GHSA-94P9-XGH2-XP45 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
downloadwheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or the...