SFPolDevChk

Salesforce Policy Deviation Checker NCC Group Plc가 오픈소스로 공개 - https://www.nccgroup.com/ Jerome Smith@exploresecurity가 개발 Stephen Tomkinson@neonbunny9에게 감사 https://www.github.com/nccgroup/SFPolDevChk AGPL 라이선스로 배포됨 - 자세한 내용은 LICENSE를 참조하세요. 설명 Salesforce에서는 최상위 Organization 레벨에서 설정된 비밀번호 정책과 세션 설정...

CVE-2022-22536

CVE-2022-22536 Vulnérabilité de désynchronisation des pipes mémoire SAP MPI CVE-2022-22536. Description - POC pour CVE-2022-22536 : vulnérabilité de désynchronisation des pipes mémoire SAP MPI. - créé par antx le 15/02/2022. Détail SAP NetWeaver Application Server ABAP, SAP NetWeaver Application...

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

Уведомление о безопасности: HTTP Request Smuggling через десинхронизацию Transfer-Encoding rouille Присвоенный CVE ID: CVE-2026-67181 Краткое описание rouille::proxy::proxy передаёт заголовок Transfer-Encoding клиента на бэкенд без изменений, но записывает тело запроса, которое tinyhttp уже...

CTT-Refraction-Vortex-CVE-2026-7731-

CTT-Refraction-Vortex-CVE-2026-7731- В рамках CTT мы рассматриваем это как Временное Расхождение Синхронизации между Поставщиком Удостоверений и Поставщиком Услуг. Внедряя импульс на частоте \alpha=0.0302011, мы не обходим подпись — мы Преломляем Временное Окно, чтобы подпись подтверждалась...

CTF-Web-Exploitation

Nether Portal Desync HUUP "Je ne voyage pas sur des routes établies mais je saute librement à travers le vide. Empaquetez-moi mal, et je livrerai un secret à la mauvaise porte." Description Le défi présente une application HTTP/3 QUIC superposée à UDP. Comme UDP est sans état et que le proxy...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1725382183)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1725382183 advisory. - Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This...

AlmaLinux 9.6 [TuxCare] Security Update: wget (ALMALINUX9.6:CLSA-2026:1784136800)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784136800 advisory. - GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within...

AlmaLinux 9.2 [TuxCare] Security Update: wget (ALMALINUX9.2:CLSA-2026:1784310537)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784310537 advisory. - GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within...

NPM: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

NPM: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization vulnerability discovered by ? in WordPress Npm fast-uri versions = 4.1.3, 4.1.5...

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

Impact fast-uri's mailto scheme parser compares each query field name to the reserved names to, subject, body while the name is still percent-encoded, and only percent-decodes it when storing it as a generic header. On serialize, the decoded name is re-emitted, so a field name such as %74o...

undici vulnerable to downstream response splitting via retry interceptor

Impact Undici's interceptors.retry can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length, the application can...

EUVD-2026-71661

undici vulnerable to downstream response splitting via retry interceptor...

CVE-2026-100666

A flaw was found in Netty's HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the...

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536

SAP-tuyaux-mémoire-désynchronisation-vulnérabilité-MPI-CVE-2022-22536 En quoi consiste la vulnérabilité ? SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 et SAP Web Dispatcher sont vulnérables à la contrebande de requêtes et à l...

CVE-2024-14029

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

CVE-2026-29057-POC

CVE-2026-29057 — лаборатория по контрабанде запросов в Next.js Этот репозиторий представляет собой специализированную лабораторию для презентации CVE-2026-29057. В ней сравнивается уязвимая цель Next.js 15.5.12 с исправленным релизом 15.5.13 при одинаковой топологии и одном и том же сыром...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in http-proxy-middleware

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in http-proxy-middleware in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0,...

CVE-2026-100666

The io.netty:netty-codec-http component in Netty's HttpServerCodec is vulnerable in versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final . The root cause is that the codec pairs outbound responses with inbound requests by calling pollMethod() once per response, including 1xx informat...

CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...