Cisco ASA Uncontrolled Resource Consumption (CVE-2019-12698)

A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load f...

Cisco ASA Improper Input Validation (CVE-2020-3304)

A vulnerability in the web interface of Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is...

ALSA-2026:75581 Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

CVE-2026-104956: Improper Neutralization of Special Elements in Data Query Logic

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

PT-2026-106181

Name of the Vulnerable Software and Affected Versions Ghost versions 6.54.1 through 6.64.0 Description A validation issue in the Webmentions functionality allows an unauthenticated user to perform limited HTTP requests to hosts within the internal network of the Ghost server. This type of flaw is...

Debian dla-4821 : libperl-dev - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4821 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4821-1 [email protected]...

The vulnerability of the Node.js software platform’s HTTP agent allows attackers to compromise the integrity of protected information.

The vulnerability of the Node.js software platform’s HTTP agent is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to compromise the integrity of the protected information...

Fedora 45 : curl (2026-663a2d0ba4)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-663a2d0ba4 advisory. - fix HTTP/2 server push UAF CVE-2026-18924 - fix Negotiate ambient user conn reuse CVE-2026-19931 - remove test1701 - HTTP/2 Upgrade in a HTTP/1.1...

Preproduce-CVE-2021-41773

复现 CVE-2021-41773 Apache HTTP Server 2.4.49 中的路径遍历和文件披露漏洞 CVE-2021-41773 POC $ docker compose up 确认运行正常 $ curl -I http://localhost HTTP/1.1 200 OK Date: Wed, 06 Oct 2021 13:25:18 GMT Server: Apache/2.4.49 Unix Last-Modified: Mon, 11 Jun 2007 18:53:14 GMT ETag: "2d-432a5e4a73a80" Accept-Ranges:...

Malicious code in hardhat-ftp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e916c23a0efbd49d3cfcd5993957df7afbade3f454925d0672acc8c9f68245c The package's declared main entry index.js unconditionally requires./lib/config, a 4,499,968-byte obfuscator.io-packed file 26,234-entry string array...

MAL-2026-17514 Malicious code in minimal-a11y-contrast-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance...

MAL-2026-17517 Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

CVE-2024-29973

CVE-2024-29973 - 远程命令注入漏洞 描述 CVE-2024-29973 是某些 Zyxel 网络设备中发现的一个严重漏洞。该漏洞允许未经身份验证的攻击者通过利用固件中输入验证机制不完善的问题，在目标设备上执行任意命令。攻击者可以向设备发送特制的 HTTP 请求，注入系统级命令，并可能完全控制该设备。 Dorks Hunter: product.name="ZyXEL NAS542"||product.name="ZyXEL NAS326" FOFA: app="NAS542" || app="ZYXEL-NAS326" SHODAN: http.title:"Zyxel...

[SECURITY] [DLA 4819-1] php8.2 security update

Debian LTS Advisory DLA-4819-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin October 05, 2026 https://wiki.debian.org/LTS Package : php8.2 Version : 8.2.34-1deb12u1 CVE ID : CVE-2025-1218 CVE-2025-14181 CVE-2026-6103 CVE-2026-91765 CVE-2026-91766 CVE-2026-91767...

CVE_2023_44487-Rapid_Reset

CVE-2023-44487 HTTP/2 Rapid Reset 测试工具 - 增强版 一个针对 CVE-2023-44487 （HTTP/2 Rapid Reset 漏洞）的全面 Python 测试工具。此仓库包含攻击测试和验证分析工具。 ⚠️ 重要免责声明 此工具仅用于教育和授权测试目的！ 仅对您拥有或已获得明确书面许可的系统使用 未经授权使用可能违法，并可能导致服务中断 这些工具执行攻击测试，可能影响服务器可用性 测试前务必确保持有适当授权 🔍 关于 CVE-2023-44487 CVE-2023-44487，也称为“HTTP/2 Rapid Reset”，是 HTTP/2...

CVE-2025-55183_POC

CVE-2025-55183 - Next.js RSC 服务器函数源代码泄露 Next.js React 服务器组件（RSC）中存在一个源代码泄露漏洞。当参数被字符串化时，向易受攻击的服务器函数发送的恶意 HTTP 请求可能会不安全地返回任意服务器函数的源代码。 参考 作者 ：AndrewMohawk 在 X/Twitter 上 搭建实验环境 git clone https://github.com/AndrewMohawk/RSC-sample-app.git cd RSC-sample-app npm install npm run dev 用法 pip install...

CVE-2026-42536-PoC

CVE-2026-42536：Apache HTTP Server modxml2enc 堆溢出 PoC 此 PoC 代码是博客文章 https://erberkan.github.io/2026/PatchDiffingandN-DayDefense/ 的一部分。 本仓库包含 CVE-2026-42536 的受控概念验证，这是 Apache HTTP Server 的 modxml2enc 模块中基于堆的越界写入漏洞。Apache HTTP Server 2.4.0 至 2.4.67 版本受影响；2.4.68 版本包含上游修复。 所演示的结果是内存损坏，随后导致 Apache...

cve-2023-44487-POC

cve-2023-44487 - http/2 快速重置攻击 by 7pirqte 这是什么 针对 http/2 快速重置攻击的概念验证。基本原理是：你打开一个流并发送 HEADERS 帧，然后立即发送 RSTSTREAM 来取消它。服务器需要完成建立和拆除流的所有工作，而你只需持续发送请求。被取消的流不计入最大流数量限制，因此你基本上可以发送无限的重置请求。 该攻击曾在 2023 年被用于一些大规模的 DDoS 攻击中。 安装 pip install -r requirements.txt 使用方法 单个目标 python main.py -u https://target.com...

CVE-2017-5638

CVE-2017-5638 Este script está diseñado para validar la vulnerabilidad de Apache Struts 2 CVE-2017-5638, también conocida como Struts-Shock. Es completamente inofensivo, ya que no inyecta ninguna carga maliciosa; solo inyecta una cabecera HTTP llamada 'STRUTS2-VALIDATION' para poder validar si es...