automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

uc_httpd_exploit

uc httpd exploit lighthttpd py3で作成されたシンプルなuc httpdエクスプロイト。このエクスプロイトはCVE-2014-2324に基づいて作成されました。 説明 lighttpd 1.4.35より前のバージョンにおける、1 modevhostおよび2 modsimplevhostの複数のディレクトリトラバーサルの脆弱性により、リモートの攻撃者がホスト名内の..（ドットドット）を使用して任意のファイルを読み取ることができます。これはrequestcheckhostnameに関連しています。...

Astra Linux – Vulnerability in Samba

Samba does not validate the Validated-DNS-Host-Name property for the dNSHostName attribute, which may allow unprivileged users to modify it...

Astra Linux – Vulnerability in avahi

A vulnerability was discovered in Avahi. There exists a potentially exploitable assertion in the avahialternativehostname function...

Astra Linux – Vulnerability in exim4

Exim before version 4.95 has a heap-based buffer overflow for the alias list in hostnamelookup in host.c when senderhostname is set...

Astra Linux – Vulnerability in glibc

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nssgethostbyname2r and nssgetcanonnamer hooks without...

Malicious code in pilgrimage-portal-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28 On npm install, the package's postinstall hook runs node ping.js, which reads the installer's hostname via require'os'.hostname and POSTs it, along...

Malicious code in @wbnr/frontend-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username...

CVE-2026-12730 Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers

IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate...

Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in rpc-endpoint-rotator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname,...

MAL-2026-12326 Malicious code in @offa/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8 package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname, os.userInfo.username, process.cwd, and the...

Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the HostnameUtil class, whose "match CN when no dNSName SAN exists" fallback is gated on Properties.isOverrideSetJSSEHOSTNAMECHECKCNFALLBACK, true, which returns true when the...

CVE-2026-67345: Permissive List of Allowed Inputs

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirecturi whose hostname suffix matches a registered...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via the matchName function in the C++ TSSLSocket implementation, which fails to properly validate hostnames against SSL/TLS certificates according to RFC 6125. An attacker can bypass...

CVE-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

PT-2026-64277

Name of the Vulnerable Software and Affected Versions Apereo CAS Client version 4.1.0 Jasig CAS Client version 3.6.4 Description The software accepts any CA-trusted certificate for any hostname as long as the URL being called matches the configured allowlist or regex. A Man-in-the-Middle MITM...

CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

ALSA-2026:41947 Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...