Tag
Insecure Default Configuration in PraisonAI Allows Unauthenticated Access
2 rules 3 TTPs 1 CVEAn insecure default configuration in PraisonAI before version 1.7.3 allows unauthenticated attackers to exploit CVE-2026-61426 by reading sensitive agent instructions and system prompts via the `/api/agents` endpoint and invoking agents without authentication through the `/api/chat` endpoint, leading to unauthorized information disclosure and potential control over AI functionalities.
goshs SSH Tunnel Vulnerable to MITM via Insecure Host Key Handling
2 rules 6 TTPsThe goshs application disables SSH host key verification when using the --tunnel flag, making it vulnerable to man-in-the-middle attacks that expose plaintext HTTP traffic.
HKUDS OpenHarness Insecure Default Configuration Vulnerability
2 rules 1 TTP 1 CVEHKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit permissive access, potentially leading to unauthorized file disclosure and read access.
libssh Insecure Configuration Allows Local MITM Attacks (CVE-2025-14821)
2 rules 2 TTPs 1 CVECVE-2025-14821 in libssh allows local man-in-the-middle attacks, SSH downgrade attacks, and trusted host manipulation due to insecure default configuration loading from a world-writable directory on Windows.