automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

uc_httpd_exploit

uc httpd exploit lighthttpd Exploit simple de uc httpd hecho con py3.. este exploit fue escrito a partir de CVE-2014-2324 Descripción Múltiples vulnerabilidades de salto de directorio en 1 modevhost y 2 modsimplevhost en lighttpd anteriores a 1.4.35 permiten a atacantes remotos leer archivos...

Astra Linux – Vulnerability in exim4

Exim before version 4.95 has a heap-based buffer overflow for the alias list in hostnamelookup in host.c when senderhostname is set...

CVE-2026-100740

CVE-2026-100740 — Escritura OOB en L2TP de D-Link DIR-895L PoC en Python 3 para CVE-2026-100740 — D-Link DIR-895L firmware A1102b07. Descripción PoCbit / GitHub CVE-2026-100740 — Escritura fuera de límites CWE-787 / CWE-119 en tunnelsetparams tunnel.c, analizador del canal de control L2TP. La...

PYSEC-2026-4025 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

Astra Linux – Vulnerability in Samba

Samba does not validate the Validated-DNS-Host-Name property for the dNSHostName attribute, which may allow unprivileged users to modify it...

Astra Linux – Vulnerability in avahi

A vulnerability was discovered in Avahi. There exists a potentially exploitable assertion in the avahialternativehostname function...

Astra Linux – Vulnerability in glibc

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nssgethostbyname2r and nssgetcanonnamer hooks without...

PT-2026-89663

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

Malicious code in pilgrimage-portal-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28 On npm install, the package's postinstall hook runs node ping.js, which reads the installer's hostname via require'os'.hostname and POSTs it, along...

Malicious code in @wbnr/frontend-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username...

CVE-2026-12730 Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers

IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate...

Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in rpc-endpoint-rotator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname,...

MAL-2026-12326 Malicious code in @offa/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8 package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname, os.userInfo.username, process.cwd, and the...

Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the HostnameUtil class, whose "match CN when no dNSName SAN exists" fallback is gated on Properties.isOverrideSetJSSEHOSTNAMECHECKCNFALLBACK, true, which returns true when the...

CVE-2026-67345: Permissive List of Allowed Inputs

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirecturi whose hostname suffix matches a registered...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via the matchName function in the C++ TSSLSocket implementation, which fails to properly validate hostnames against SSL/TLS certificates according to RFC 6125. An attacker can bypass...

CVE-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...