sj

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...

AttackTomcat

AttackTomcat 検出脆弱性リスト CVE-2017-12615 PUTファイルアップロード脆弱性 tomcat-pass-getshell 弱認証によるwarパッケージのデプロイ 弱いパスワードのブルートフォース CVE-2020-1938 Tomcat ファイル読み取り/インクルード 使用方法 初回使用前に、設定で設定ファイルを再設定してください。その他の問題はよくお読みください！！！、java -jar .jar で起動すると実行ログ情報を確認できます！！ ​ ソースコードをダウンロードしてMavenでコンパイルするか、直接Releasesをダウンロードしてください。 ​...

CVE-2024-33676

CVE-2024-33676 弱い認証と認可により、Enel X JuiceBox Level 2 EV充電器のオペレーティングシステムの機能やパラメータへのアクセスが可能になります。 説明 ローカルのEV充電器WLANネットワーク上のユーザーは、個人識別情報（PII）を抽出し、設定を変更し、オペレーティングシステムのファイルシステムを操作できます。これは、ポート2000上のローカルのGecko OSインターフェースの機能にアクセスすることで行われます。 この情報は2025年7月26日にBSides Albuquerqueで発表されました。スライドはこちらです。 製品詳細...

ls-poc

CVE-2026-30368 概念実証コード !IMPORTANT これはパッチ適用済みであり、現在は認証情報が必要です。回避策を使用して自分自身に対して操作を実行してください。 はじめに CVE-2026-30368 により、攻撃者は Lightspeed Classroom 管理の脆弱な認証の欠陥を介して生徒のデバイスを制御できます。 この POC（poc.js）は、LS Classroom 拡張機能のサービスワーカーをグローバルコンテキストで実行します。ワーカーは一部の機能で classroom.wasm も実行します。wasm-loader.js...

CVE-2025-70994

CVE-2025-70994: Weak Authentication in Yadea T5 Electric Bicycle !WARNING This repository is published strictly for educational and academic security research purposes. The information and proof-of-concept code provided here are intended to demonstrate a known cryptographic flaw CWE-1390 to assis...

CVE-2025-15679 BMC root account active without password on BullSequana XH3406 and XH3515

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

CVE-2026-77483

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-73025

Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-77483

CVE-2026-77483 affects Microsoft SQL Server and involves a weak authentication mechanism that allows an authorized attacker (low privileges required) to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) with vectors for network attack, low complexity, no user interaction, and h...

EUVD-2026-73784

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network...

EUVD-2026-73778

Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-73025

CVE-2026-73025 is a Security Feature Bypass vulnerability in Windows iSCSI , rooted in weak authentication that allows an unauthorized attacker to bypass a security feature over a network. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector, low complexity, n...

Windows iSCSI Security Feature Bypass Vulnerability

Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network...

SQL Server Elevation of Privilege Vulnerability

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network...

EUVD-2026-69787

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

EUVD-2024-55746

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...

CVE-2026-73819 Ebyte NA111-M Weak Authentication

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...

CVE-2026-73819

Ebyte NE2-D11 (and NA111-M ) vendor configuration utility contains a weak authentication flaw: under certain credential conditions, administrative functions are accessible without verifying the operator's identity. An unauthenticated attacker on the adjacent network could modify critical settings...

CVE-2026-65098

NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering...

EUVD-2026-66095

NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering...