electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

inql

InQL v6.1.2 - 고급 GraphQL 테스트를 위한 Burp 확장 프로그램 !Doyensec Research...

electronegativity

일렉트로네거티비티Electronegativity ⚠️ 이 프로젝트는 더 이상 적극적으로 유지 관리되지 않습니다 ⚠️ 일렉트로네거티비티란? 일렉트로네거티비티 는 Electron 기반 애플리케이션에서 잘못된 설정과 보안 안티패턴을 식별하는 도구입니다. 이 도구는 "Electron Security Checklist - A Guide for Developers and Auditors" 백서에 설명된 대로 AST 및 DOM 파싱을 활용하여 보안 관련 구성을 찾아냅니다. 소프트웨어 개발자와 보안 감사자는 이 도구를 사용하여 Electron을...

exploit_cve_2025_67303

exploitcve202567303 CVE-2025-67303 用の PoC を作成する PoC のオリジナルは https://www.doyensec.com/resources/DoyensecAdvisoryComfyUIManagerRCEviaCustomNodeInstall.pdf...

CSPTPlayground

Client-Site Path Traversal プレイグラウンド !Doyensec Research...

GHSA-267V-3V32-G6Q5 Cross-site Scripting via missing Binding syntax validation

Impact The package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting XSS in the IdP contex...

Cross-site Scripting via missing Binding syntax validation

Impact The package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting XSS in the IdP contex...

Exploit for Improper Verification of Cryptographic Signature in Passport-Saml_Project Passport-Saml

Exploiting CVE-2022-39299 Signature bypass via multiple ro...

apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page

Impact The default landing page contained HTML to display a sample curl command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from window.location.href. On some older...

F-Secure Internet Gatekeeper 5.40 - Heap Overflow Exploit

Exploit for linux platform in category web applications Title: F-Secure Internet Gatekeeper 5.40 - Heap Overflow PoC Author: Kevin Joensen Vendor: F-Secure Software: https://www.f-secure.com/en/business/downloads/internet-gatekeeper CVE: N/A Reference:...

Apache Commons Jelly connects to url with certain custom doctype definitions.

Severity: Medium Vendor: The Apache Software Foundation Versions Affected: commons-jelly-1.0 core, namely commons-jelly-1.0.jar Description: During jelly xml file parsing with xerces, if a custom doctype entity is declared with a ?SYSTEM? entity with a url and that entity is used in the body of t...