S3-from-csp

S3-from-csp Extrae todos los buckets S3 de las cabeceras de los informes CSP y luego prueba vulnerabilidades de subida de archivos Instalación root@kitploit: go install github.com/RandomRobbieBF/S3-from-csp@latest Ejecución root@kitploit: s3fromcsp file.txt...

PT-2026-85429

Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-66391 Apache Wicket: leaked and missing CSP headers

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

CVE-2026-66391

This vulnerability involves the Use of Insufficiently Random Values and a Protection Mechanism Failure within Apache Wicket . It affects versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0 . To remediate this issue, users are recommended to upgrade to version 10.10.0 . No specific technical r...

CVE-2026-66391 Apache Wicket: leaked and missing CSP headers

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

EUVD-2017-14493

Malware in sbrugna...

EUVD-2025-18105

Malicious code in bioql PyPI...

EUVD-2024-1019

Malicious code in bioql PyPI...

EUVD-2023-1699

Malicious code in bioql PyPI...

FreeBSD : Firefox -- content injection attack (a3291f81-3d7c-11f0-9a55-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a3291f81-3d7c-11f0-9a55-b42e991fc52e advisory. [email protected] reports: Previewing a response in Devtools ignored CSP headers, which could have...

CVE-2025-5271

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139...

CVE-2025-5271 Devtools' preview ignored CSP headers

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139...

CVE-2025-5271 Devtools' preview ignored CSP headers

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139...

CVE-2025-5271

Mozilla Firefox and the Thunderbird email client are affected by a vulnerability in the DevTools suite. The issue stems from a lack of mechanisms for encoding or blocking output data, which causes the previewing function to ignore Content Security Policy (CSP) headers. This oversight could allow ...

PT-2025-22996

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 139 Description The issue involves previewing a response in Devtools ignoring CSP headers, potentially allowing content injection attacks. Recommendations For versions prior to 139, update to version 139 or later to...

Firefox -- content injection attack

[email protected] reports: Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks...

CVE-2024-29896

Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the C...

ROS-20250121-03

Vulnerability The contentsecuritypolicy function of the Ruby interpreter's Action Pack extension is related to a vulnerability in the dynamically set Content-Security-Policy CSP headers. Content-Security-Policy CSP dynamically set headers vulnerability. Exploitation The vulnerability could allow ...

GHSA-W387-5QQW-7G8M Content-Security-Policy header generation in middleware could be compromised by malicious injections

Impact When the following conditions are met: - Automated CSP headers generation for SSR content is enabled - The web application serves content that can be partially controlled by external users Then it is possible that the CSP headers generation feature might be "allow-listing" malicious inject...

CVE-2024-29896

Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the C...