LinkedInDumper

LinkedInDumper Script de Python 3 para volcar empleados de empresas desde la API de LinkedIn 💬 Descripción LinkedInDumper es un script de Python 3 que vuelca datos de empleados desde la plataforma de redes sociales LinkedIn. Los resultados incluyen nombre, apellido, cargo puesto, ubicación y un...

CVE-2020-14368

CSWSH-THEIA-CVE-2020-14368 Objetivo del informe: Implementación de Eclipse CHE disponible en che.openshift.io Tipo de vulnerabilidad: Cross-site websocket hijack Fecha de descubrimiento: 2020-04-08 Autor: Robin Duda codingchili@github Resumen El endpoint websocket /services en Eclipse CHE adn The...

wafpass

WAFPASS ██╗ ██╗ █████╗ ███████╗██████╗ █████╗ ███████╗███████╗ ██║ ██║██╔══██╗██╔════╝██╔══██╗██╔══██╗██╔════╝██╔════╝ ██║ █╗ ██║███████║█████╗ ██████╔╝███████║███████╗███████╗ ██║███╗██║██╔══██║██╔══╝ ██╔═══╝ ██╔══██║╚════██║╚════██║ ╚███╔███╔╝██║ ██║██║ ██║ ██║ ██║███████║███████║ ╚══╝╚══╝ ╚═╝...

cve-2025-29927-lab

Laboratorio CVE-2025-29927 Laboratorio de reproducción mínima para CVE-2025-29927 — Bypass de autorización de middleware de Next.js CVSS 9.1. Acompañante de: Análisis de N-Day en Medium Qué es esto Una aplicación Next.js 15.2.2 vulnerable con una ruta /dashboard protegida por cookie. La...

SubGPT

SubGPT examina los subdominios que ya has descubierto para un dominio y usa BingGPT para encontrar más. ¿La mejor parte? ¡Es gratis! Los siguientes subdominios fueron encontrados por esta herramienta con estos 30 subdominios como entrada. call-prompts-staging.example.com...

CVE-2020-10199-10204

CVE-2020-10199-10204 http://1984-0day.com python3 poc.py -i 127.0.0.1 -p 8081 -c cookie -csrf csrf-token parse = argparse.ArgumentParser parse.addargument'-i', '--ip', help='ip' parse.addargument'-p', '--port', default='8081', help='port' parse.addargument'-c', '--cookie', help='HTTP cookie'...

EUVD-2026-75111

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-74752

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP. When cookie authentication is disabled, the system improperly validates authentication AUTH fields restored directly from peer-controlled cookie bytes. A local attacker could exploit this by forging RANDOM lengths o...

SUSE CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

UBUNTU-CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74752 sctp: validate cookie AUTH state before use

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74752

CVE-2026-74752 is a critical (CVSS 9.8) vulnerability in the Linux kernel's SCTP implementation. When cookie authentication is disabled, the COOKIE_ECHO handler restores fixed-size AUTH fields directly from peer-controlled cookie bytes without validating them against local backing arrays. A forge...

CVE-2026-74752 sctp: validate cookie AUTH state before use

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-72398

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. When cookie authentication is disabled, a remote attacker can tamper with the INIT chunk data during the SCTP handshake. This occurs because the reconstructed INIT chunk from the COOKIE-ECHO...

CVE-2026-74867: Cross-Site Request Forgery (CSRF)

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-72398 sctp: add INIT verification after cookie unpacking

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

Linux Distros Unpatched Vulnerability : CVE-2026-72398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried i...

PT-2026-72586

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Stream Control Transmission Protocol SCTP handshake process. During this process, a server embeds an INIT chunk into a cookie sent via INIT-ACK, which the client...

CVE-2026-50183

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI plugin. The plugin renders the snippet.title field returned by the YouTube Data API into the homepage gallery markup with no HTML encoding. The title is set ...