5529 matches found
zappzarapp-php-security
⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...
JoySafety
JoySafety — Large Model Security Framework 📋 Table of Contents Project Introduction ✨ Features 🚀 Quick Start 📖 User Guide 🏆 Best Practices 🏗️ Architecture Design 🛠️ Development 📄 License 📅 Roadmap Star History new release ✅ Prompt injection detection model fully upgraded : Training system...
CSPBypass
CSP 绕过 欢迎使用 CSPBypass.com ，一款旨在帮助道德黑客绕过限制性内容安全策略（CSP）并利用 XSS（跨站脚本）漏洞的工具，适用于注入被仅允许某些白名单域的 CSP 所阻止的站点。 网站 访问 CSPBypass.com 搜索现成的 CSP 绕过 gadget，帮助您实现 XSS，或贡献您自己的发现。 离线使用 构建 Docker 镜像并在本地运行，以通过捆绑的数据集提供静态 UI： root@kitploit: docker build -t cspbypass . docker run --rm -p 8080:80 cspbypass 浏览到...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in the Content Security Policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page...
Astra Linux – Vulnerability in WebKit2GTK
A logic issue has been addressed through improved state management. This issue is fixed in iOS 15.3, iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, and macOS Monterey 12.2. Processing maliciously crafted web content may prevent the Content Security Policy from being enforced...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...
JSONBee
JSONBee A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...
cspparse
cspparse 描述 cspparse 是一个用于评估内容安全策略（Content Security Policies）的工具。它利用 Google 的 API 获取 CSP 头，并以 ReconJSON 格式返回。它不仅通过 Google 的 API 检查头信息，还会解析目标站点的 HTML，查找 标签中指定的任何 CSP 规则。 安装 安装命令并通过 Go Get 下载源码 cspparse 命令将被安装到 $GOPATH/bin，源码（来自 https://github.com/lc/cspparse）将位于...
cspparse
cspparse Description cspparse is a tool to evaluate Content Security Policies. It uses Google's API to retrieve the CSP Headers and returns them in ReconJSON format. Not only does it check for headers with Google's API, it also parses the target site's HTML to look for any CSP rules that are...
browsertunnel
browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...
CVE-2020-6519
これは元々、PerimeterX社の公式Github から、私の仕事用Githubアカウント を通じて公開されました。 これは私の仕事ではありますが、すべての権利および法的な問題はPerimeterX社に帰属します。 Chromium 83 ゼロデイ 完全CSPバイパス クロスプラットフォーム CVE-2020-6519 Exploit DB 技術記事 （ 済み）...
CVE-2020-6519
Chromium 83 ゼロデイ 完全CSPバイパス クロスプラットフォーム CVE-2020-6519 技術記事 POC 報告済み Chromiumプロジェクトへ デモ動画...
CVE-2026-54477
CVE-2026-54477: Panel de administración sin cabeceras de seguridad clickjacking / XSS Aviso Campo| Valor ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medio Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...
CVE-2026-82838
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-82838
Venueless 's default Docker image had a vulnerability where uploaded SVG files could be served with executable JavaScript content, potentially allowing stored XSS. The root cause was the absence of a proper Content Security Policy (CSP) in the image's default configuration. The fix sets a valid C...
EUVD-2026-68392
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-82838 Default webserver configuration with incorrect CSP
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-81852
Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
Summary Stored cross-site scripting XSS in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new...