burp-cc-bridge

CC-Bridge 一个 Burp Suite（Montoya API）扩展，通过 localhost HTTP API 暴露 Burp 最实用的原语，让代理式编码终端（Claude Code、OpenAI Codex 等）可以通过 curl 驱动 Burp。 支持 Burp Community（社区版）。 下载 获取最新版本的发布 JAR——无需克隆或构建： →cc-bridge-0.1.0.jar 381 KB · sha25610e21b82a602e43df62ffa2758ef3f51a24af8e1a04affa82ef12d02bde9192c...

CVE-2014-3120

LAB 10-CVE-2014-3120 I. システム分析 Docker環境から攻撃対象領域を特定する まず、環境内で実行されているものを確認します。アクティブなコンテナをすべてリストアップします: root@kitploit: docker ps 結果: コンテナ p1/lab10:latest が実行されており、2つのポート を外部に公開しています: ポートマッピング| プロトコル ---|--- 0.0.0.0:9200 → 9200/tcp| HTTP 要確認 0.0.0.0:9300 → 9300/tcp| 不明 初期観察: ポート 9200 と 9300...

Crimson-Cloak-ISH-wrapper-iOS-

Crimson-Cloak-ISH-wrapper-iOS iSH iOSアプリの機能をジェイルブレイクなしで最大化するラッパー。 機能 HTTP API + 組み込みダッシュボード http://127.0.0.1:8088 WebSocket リアルタイムストリーミング ws://127.0.0.1:8089 SynChan ツールの自動検出 Huginn, OmnINT, Daedalus, Argus, Neural, Ophelia, Hecate, MIDAS, SynChan, Crimson Cloud ツールごとのショートカットボタン クリップボード同期, ファイル監視...

EUVD-2026-70284

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...

CVE-2026-84886

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...

CVE-2019-20933

LAB 5-CVE-2019-20933 I. 系统分析 识别攻击面 从环境中正在运行的内容开始。我列出所有活动的容器： root@kitploit: docker ps 受害者暴露了一个端口：8086。 目前，我没有关于目标的详细信息。从 docker ps 输出中，系统仅对外暴露了一个值得注意的服务，端口为 8086，映射到容器内部的服务。这是需要分析的主要攻击面。 我们不立即通过浏览器访问它，而是使用 Nmap 对服务进行指纹识别，确定 8086 端口上运行的服务： nmap -sV -sC -p 8086 192.168.3.137 扫描结果显示，8086 端口是 InfluxD...

OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection

OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters. id: CVE-2023-25826 info: name: OpenTSDB = 2.4.1 -...

CVE-2026-84886

A resource consumption vulnerability affects the OCR HTTP API component of simular-ai Agent-S versions up to 0.3.2. The flaw resides in the ImageData function within the file gui_agents/s1/utils/ocr_server.py, where manipulation of the img_bytes argument can exhaust system resources. The attack i...

CVE-2026-84452

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

CVE-2026-84702

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84702

facefusion through 3.6.1 is vulnerable to a path traversal flaw in the get_job_file_name function (located in facefusion/jobs/job_manager.py), which fails to normalize job identifiers. An attacker can supply traversal sequences in the job identifier parameter via the unauthenticated HTTP API to w...

PT-2026-84883

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui agents/s1/utils/ocr server.py of the component OCR HTTP API. Executing a manipulation of the argument img bytes can lead to resource consumption. The attack m...

CVE-2026-8712

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious uri query parameter to the HTTP API. Attackers can pass arbitrary tcp:// or unix:// URIs...

CVE-2026-8712 Wyoming < 1.10.2 SSRF via uri Query Parameter

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious uri query parameter to the HTTP API. Attackers can pass arbitrary tcp:// or unix:// URIs...

CypherDog

CypherDog4.3 PoSh BloodHound Hundeflüsterer a.k.a. PowerShell-Cmdlets zur Interaktion mit BloodHound-Daten über die Neo4j-HTTP-API Kompatibel mit Bloodhound 4.3+ und neo4j 4.4+...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

CVE-2026-76313

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:43+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmrhqaepp2y...

BIT-CONSUL-2026-19113 Unauthenticated denial of service via unbounded request body processing

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, i...