authcov

AuthCov Analyse de couverture d'autorisation d'application web. Introduction AuthCov explore votre application web à l'aide d'un navigateur Chrome sans tête headless tout en étant connecté en tant qu'utilisateur prédéfini. Il intercepte et enregistre les requêtes API ainsi que les pages chargées...

chrome-vuln-scanner

Chrome脆弱性スキャナー 軽量で依存関係のない防御的 ツールです。インストールされているGoogle Chromeのバージョンを既知の脆弱性と照合し、わかりやすい視覚的なHTMLレポートを生成します。 機能 Chromeバージョンの自動検出 （macOS対応。--versionで手動指定も可能） 既知のCVEとの照合 （拡張可能な脆弱性データベース） 視覚的なHTMLレポート — 明確なVULNERABLE / SAFEステータスダッシュボード付き Use-After-Free（CWE-416）の教育用可視化 — 概念的なメモリ図 JSON出力 — CIやさらなる分析に対応 バイリン...

CVE-2026-32722

CVE-2026-32722 Bloomberg Memray: Stored XSS через неэкранированные метаданные командной строки Введение Я обнаружил эту проблему при проверке Memray , Python-профилировщика памяти от Bloomberg, с простым вопросом: Могут ли контролируемые злоумышленником метаданные времени выполнения небезопасно...

USN-8777-1: GNU Bison vulnerability

It was discovered that GNU Bison incorrectly handled grammar-defined configuration variables when generating HTML reports. An attacker could possibly use this issue to execute arbitrary code...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

CVE-2026-76798

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-76794

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

CVE-2026-76798

The MongoSQL Transition Readiness Tool (part of MongoDB's SQL/BI Connector stack) writes query text and user names from BI Connector log files into its generated HTML reports without encoding them for the HTML output context. An attacker with low privileges who can issue queries through the BI Co...

EUVD-2026-67778

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-76798: Improper Neutralization of Input During Web Page Generation

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

PT-2026-83276

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

Exploit for CVE-2026-79266

Chrome Vulnerability Scanner A lightweight, dependency-free...

papa

Papa, l'analizzatore WireShark - PRO Uso: Inserisci il tuo file .pcapng nella directory di papa root@kitploit: python .\papa.py python3 .\papa.py Controlla il tuo report HTML...

JLSEC-2026-1345 GNU Bison allows for an execution of an arbitrary program during HTML report generation due to...

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

CVE-2026-56389

A flaw was found in GNU Bison. During HTML report generation, the software improperly handles grammar-defined configuration variables. An attacker can provide a specially crafted grammar file that overrides the executable used for XML-to-HTML transformation. This allows for the execution of an...

Cross-site Scripting (XSS)

Overview prowler is a Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI,...

CVE-2026-73262

CVE-2026-73262 – Prowler : Stored XSS in HTML reports due to unescaped cloud resource tags in the HTML output formatter (prowler/lib/outputs/html/html.py). Before 5.37.0, finding.resource_tags was inserted into reports without HTML escaping, allowing a privileged cloud principal who can modify a ...

CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...