RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.2 (RHSA-2026:76952)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76952 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libsoup vulnerabilities (USN-8890-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8890-1 advisory. It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.41 packages and security update

Red Hat OpenShift Container Platform release 4.20.41 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

h2spacex

H2SpaceX Librería de bajo nivel HTTP/2 basada en Scapy que puede utilizarse para Single Packet Attack Race Condition en H2 Esta librería formó parte de una investigación académica con el título de QUIC-er Races: HTTP/3 won’t save you from TOCTOU vulnerabilities. Sumérgete en el artículo de Single...

h2spacex

H2SpaceX HTTP/2 low level library based on Scapy which can be used for Single Packet Attack Race Condition on H2 This library was part of an academic research with title of QUIC-er Races: HTTP/3 won’t save you from TOCTOU vulnerabilities. Dive into Single Packet Attack Article I wrote an article...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ 概述 CVE-2026-49975 是 Apache HTTP Server 中的一个拒绝服务（DoS）漏洞。 该漏洞出现在 HTTP/2 请求处理路径中，多个 cookie 头字段可以在不经过 LimitRequestFields 正确计数的情况下合并。 通过发送一个小的 HPACK 编码的 HTTP/2 请求，该请求扩展成多个 cookie 头字段，攻击者可以强制服务器在 Cookie 头合并过程中反复分配内存。 攻击者随后可利用 HTTP/2...

cve-2019-2215_SH-M08

2019年10月之前的安全补丁的Android终端上获取root权限的概念证明代码的AQUOS sense 2（SH-M08）移植版。 运行环境 已验证以下OS版本可以运行。在其它版本或其它机型上运行时，请按照“移植方法”章节进行移植。 ro.build.date: 2019年 3月 20日 水曜日 04:58:03 JST ro.build.description: Anasui-user 8.1.0 S3200 01.00.02 release-keys ro.build.display.id:...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 Uso Requisitos Python 3 Ejecución $ python poccve20133651.py - p. ej. $ python poccve20133651.py http://127.0.0.1:9000/ Resultado: ¡Vulnerable! PoC Vulnerabilidad | Construcción y renovación de sitios de comercio electrónico: «EC Open Platform EC-CUBE»...

USN-8890-1: libsoup vulnerabilities

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-4271 It was discovered that libsoup incorrectly handled certain HTTPS...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

Exploit for Privilege Chaining in Canonical Ubuntu_Linux

CVE-2026-3888 - snap-confine - Escalacion de Privilegios a Roo...

network-security-lab

🔬 网络安全实验室 一个模拟真实攻击与防御场景的受控虚拟环境 📋 概述 本实验室在一个完全隔离的虚拟环境中模拟了真实的渗透测试和防御加固练习。它演示了完整的攻击性安全生命周期——从侦察到利用——以及能够缓解每种风险的防御控制措施。 关键成果： 通过利用已知后门，在无需凭据且无特殊工具的情况下，于60秒内获取了目标机器的完全 root 访问权限。 🏗 实验室环境 组件| 详情 ---|--- 虚拟机管理程序| VMware Workstation 网络| 仅主机模式 / NAT（完全隔离） 攻击机操作系统| Ubuntu 24 LTS 目标操作系统| Metasploitable 2...

Hardware-Vulnerability-with-Proof-of-Concept-

🛡️ Spectre Variant 2 CVE-2017-5715 — Investigación de Vulnerabilidad de Hardware Un documento de investigación en profundidad y una Prueba de Concepto PoC práctica que explora ataques de ejecución especulativa en CPUs modernas. 📖 Resumen Este proyecto es una exploración de investigación y...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.17 packages and security update

Red Hat OpenShift Container Platform release 4.22.17 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

web-penetration-drupal

Web 渗透测试 — Drupal CVE-2018-7600 类型: 实习项目 | 公司: BB CyberSec | 时间: 2024年11月 – 2025年1月 📋 项目概述 本项目记录了在 BB CyberSec 网络安全实习期间对 Drupal Web 应用进行的完整渗透测试。评估重点是识别并利用影响 Drupal 核心的严重漏洞 CVE-2018-7600 （Drupalgeddon 2），这是一个远程代码执行漏洞。 🎯 目标 对基于 Drupal 的 Web 应用执行结构化安全审计 使用行业标准工具识别漏洞 利用 CVE-2018-7600 展示其影响和严重性...

CVE-2021-44228

🚨 CVE-2021-44228 — “Log4Shell” Apache Log4j 2 中的一个关键远程代码执行漏洞，广泛被称为 Log4Shell 。 📖 目录 概述 技术细节 严重性与 CVSS 受影响版本 利用与影响 现实世界影响 检测 缓解与修复 总结 🔎 概述 CVE-2021-44228 是 :contentReferenceoaicite:0index=0 版本 2.x （2.15.0 之前）中的一个关键 RCE 漏洞，于 2021 年 12 月被发现。 它允许未认证的远程攻击者通过向被 Log4j...

CVE-2023-44487-dos

CVE-2023-44487 HTTP/2 Rapid Reset 这个仓库里有一些例子并未完全测试以分析影响，但我只是想要演示这种攻击的概念（启动大量流并立即发送RSTSTREAM帧以避免达到MAXCONCURRENTSTREAMS）。 我使用H2SpaceX低级HTTP/2库，这是我为利用单包攻击而创建的。 发送100000个POST请求（使用单包攻击技术），导致服务器等待最后一个字节，然后在每个请求后发送RESET STREAM帧。 该工具还使用线程来打开更多的H2连接。 只需运行 python...

undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts...

CVE-2026-103831

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...