paskto

Paskto - Passive Web Scanner Paskto will passively scan the web using the Common Crawl internet index either by downloading the indexes on request or parsing data from your local system. URLs are then processed through Nikto and known URL lists to identify interesting content. Hash signatures are...

CVE-2017-6640-POC

CVE-2017-6640-POC Доказательство концепции для CVE-2017-6640 как расширение burp Cisco Prime Data Center Network Manager DCNM реализует статические учетные данные. См. также: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2 Более конкретно, веб-интерфе...

hashes

RustCrypto: Хеш-функции !Project Chatchat-imagechat-link !dependency statusdeps-imagedeps-link !Apache2/MIT licensedlicense-image Коллекция криптографических хеш-функций1, написанных на чистом Rust. Все алгоритмы находятся в отдельных крейтах и реализованы с использованием типажей из крейта diges...

CVE-2026-104437

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASHSINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts an...

EUVD-2026-91447

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASHSINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts an...

CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – Повторное воспроизведение дайджест-аутентификации VoIP SIP Программный код SIP-симулятор на Python sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces...

ctf-party

ctf-party Qu'est-ce que c'est Une bibliothèque pour améliorer et accélérer l'écriture de scripts/exploits pour les joueurs de CTF ou chercheurs en sécurité, chasseurs de bugs, pentesteurs mais surtout axé sur le CTF en patchant la classe String pour ajouter une syntaxe courte des motifs de code...

CVE-2026-48005

A flaw was found in the modauthdigest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of...

CVE-2026-81642

CVE-2026-81642 — Unbound DNSKEY digest heap overflow tracking site Source for the CVE-2026-81642 patch-status tracker: a single-page site recording which distributions have shipped a fix for the Unbound DNSSEC validator heap overflows and the ReTrap complexity attacks disclosed alongside them...

tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

CVE-2026-7020

CVE-2026-7020 Произвольное чтение файлов в Ollama через path traversal в digest тензора. Похищает SSH host keys и любые другие файлы с доступного хоста Ollama за три неаутентифицированных API-вызова. Writeup: Соисследователь @gouldnicholas Использование python3 poc.py Перебирает все три типа SSH...

CTT-enhanced-Apache-mod_auth_digest-timing-attack-exploit

CTT-Enhanced Apache modauthdigest Timing Attack — CVE-2026-33006 🔥 Обзор Это улучшение на основе Конвергентной Теории Времени CTT для CVE-2026-33006 — уязвимости, основанной на анализе времени ответа, в компоненте modauthdigest веб-сервера Apache HTTP Server версии ≤2.4.66. Исходная уязвимость...

tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

CVE-2026-48005

The Apache Software Foundation Apache HTTP Server (versions before 2.4.69 ) on all platforms is vulnerable to a denial of service (forced re-authentication) via a missing authentication check in mod_auth_digest . An unauthenticated remote client can trigger this by sending forged Authorization he...

Security Bulletin: IBM Operational Decision Manager for Sept 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2026-87822 DESCRIPTION: t-digest versions 3.1 through 3.3 fail to validate centroid means during...

cve-2026-43512-poc

CVE-2026-43512 — Apache Tomcat DIGEST 인증 우회 익스플로잇 가능성 분석 결과: 근본 원인이 확인되었습니다. 표준 UserDatabaseRealm 배포에 대한 종단 간 익스플로잇은 재현되지 않습니다. 자세한 내용은 분석을 참조하세요. 목차 개요 영향받는 버전 근본 원인 분석 저장소 구조 요구 사항 사용법 예상 출력 참고 자료 면책 조항 개요 CVE-2026-43512는 Apache Tomcat의 HTTP DIGEST 인증 메커니즘의 취약점입니다. RealmBase.getDigest 메서드는 A1 해...

Linux Distros Unpatched Vulnerability : CVE-2026-92899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but...

Rocky Linux 10.2 [CIQ] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-debuginfo / etc (crlsa-2026_66460)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202666460 advisory. gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gstrtspmessageparseauthcredentials when parsing a crafted Digest...

Linux Distros Unpatched Vulnerability : CVE-2026-102930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc Multiple Vulnerabilities (crlsa-2023_6267)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236267 advisory. SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication CVE-2023-46847 SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP...