1017 matches found
CVE-2024-56344
IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using...
EUVD-2024-55771
IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using...
CVE-2024-56344
IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 are affected by a failure to properly enable HTTP Strict Transport Security (HSTS) , classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). A remote attacker with no privileges can exploit thi...
eaphammer
by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...
badssl.com
Посетите badssl.com для просмотра списка тестовых поддоменов, включая: self-signed.badssl.com expired.badssl.com mixed.badssl.com rc4.badssl.com hsts.badssl.com Настройка сервера Виртуальная машина со стандартной Ubuntu, DNS A-записи для badssl.com. и указывают на ВМ...
hstsparser
HSTS Parser HSTS Parser — это простой инструмент для разбора баз данных HSTS Firefox и Chrome в полезные криминалистические артефакты! Вы можете узнать больше об исследованиях, лежащих в основе этого инструмента, и его возможных применениях в моём блоге! Установка HSTS Parser можно установить чер...
PRISM-AP
PRISM-AP 소개: PRISM-AP는 자동화된 무선 RogueAP MITM 공격 프레임워크입니다. 기능: 설정과 사용이 쉽고 완전 자동화됨 MANA WiFi 공격을 활용하여 클라이언트 연결을 유인합니다 bettercap을 통한 부분적 HSTS 우회 모든 HTTP 헤더, 쿠키 및 URL을 가로채고 확인합니다 클라이언트의 모든 DNS 요청을 확인합니다 쉬운 분석을 위해 전체 Wireshark PCAP을 저장합니다 driftnet을 통해 "스니핑된" 모든 이미지를 저장합니다 모든 HTTP 요청에 BeeF 훅을 주입합니다...
CVE-2019-13498
CVE-2019-13498 익스플로잇 제목: MITM - HSTS 부재로 인한 자격 증명 탈취 및 콘텐츠 변조 날짜: 07/10/2019 익스플로잇 작성자: Furqan Khan 공급업체 홈페이지: https://www.oneidentity.com/ 소프트웨어 링크: https://www.oneidentity.com/products/cloud-access-manager/ 버전: 8.1.3 테스트 환경: Kali Linux , Windows 7 , Ubuntu 16.04 MITM 공격을 수행하고 사용자 이름 , 비밀번호 및 OT...
pythem
pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...
sniffly
Sniffly2 Sniffly2 is a variant of Sniffly which abuses HTTP Strict Transport Security headers and the Performance Timing API in order to sniff your browsing history in Chromium-based browsers. Demo Visit http://diracdeltas.github.io/sniffly in Chrome/Chromium/Brave/etc. with HTTPS Everywhere...
sniffly
Sniffly2 Sniffly2는 HTTP Strict Transport Security 헤더와 Performance Timing API를 악용하여 Chromium 기반 브라우저에서 사용자의 방문 기록을 스니핑하는 Sniffly의 변형입니다. 데모 HTTPS Everywhere가 비활성화된 상태에서 Chrome/Chromium/Brave 등으로 http://diracdeltas.github.io/sniffly를 방문하세요. 주의사항: 모바일 또는 Firefox에서는 작동하지 않음 혼합 콘텐츠 차단으로 인해 HTTPS에서는 작동...
CVE-2022-31629-poc
CVE-2022-31629 poc PHP 버그 리포트 테스트 방법 설치 root@kitploit: git clone https://github.com/SilNex/CVE-2022-31629-poc cd ./CVE-2022-31629-poc docker-compose up -d 테스트 https://localhost:8110 : v8.1.10 https://localhost:8111 : v8.1.11 Chrome HSTS 문제 thisisunsafe 를 hsts페이지에서 입력하면됩니다. hsts 오류 페이지에서...
Astra Linux – Vulnerability in WebKit2GTK
A logic issue has been resolved through improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8, iPadOS 14.8, tvOS 15, Safari 15, and watchOS 8. An attacker in a privileged network position may be able to bypass HSTS...
CVE-2026-65655
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...
PT-2026-70889
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...
CVE-2026-35145
HCL DFXAnalytics is reported as affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The issue arises because the application’s web responses do not include the Strict-Transport-Security header, potentially allowing an attacker to downgrade to HTTP and perform MITM attacks. ...
CVE-2026-53624
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol for https instead of c.Scheme. This issue is fixe...
CVE-2026-53624 Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol for https instead of c.Scheme. This issue is fixe...
CVE-2026-53624 Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol for https instead of c.Scheme. This issue is fixe...