CVE-2016-6026

The Configuration Manager in IBM Sterling Secure Proxy SSP 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to obtain sensitive information via an HTTP method that is neither GET nor POST...

Information disclosure

The Configuration Manager in IBM Sterling Secure Proxy SSP 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to obtain sensitive information via an HTTP method that is neither GET nor POST...

Raptor Web Application Firewall

Raptor Web Application Firewall Raptor Web Application Firewall is a simple web application firewall made in C, using KISS principle , to make poll use select function, is not better than epoll or kqueue from BSD but is portable, the core of match engine using DFA to detect XSS, SQLi and path...

Cisco Web Security Appliance devices security mechanism bypass vulnerability

Cisco Web Security Appliance devices is a set of Web security appliances from the American company Cisco Cisco. The appliance provides SaaS-based access control, real-time web reporting and tracking, and development of security policies. A security mechanism bypass vulnerability exists in the Cis...

Design/Logic Flaw

The proxy engine on Cisco Web Security Appliance WSA devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to bypass intended proxy restrictions via a malformed HTTP method, aka Bug ID CSCux00848...

CVE-2016-1296

The proxy engine on Cisco Web Security Appliance WSA devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to bypass intended proxy restrictions via a malformed HTTP method, aka Bug ID CSCux00848...

Cisco Web Security Appliance Security Bypass Vulnerability

A vulnerability in the proxy engine of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass security restrictions. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CakePHP 3.2.0 CSRF Bypass

--------------------------------------------------------------- CakePHP document.forms0.submit - Solution: No official solution is curr...

Toxy - Hackable Http Proxy To Simulate Server Failure Scenarios And Network Conditions

Toxy is a fully programmatic and hackable HTTP proxy to simulate server failure scenarios and unexpected network conditions , built for node.js / io.js . It was mainly designed for fuzzing/evil testing purposes, when toxy becomes particularly useful to cover fault tolerance and resiliency...

HTTPie - a CLI, cURL-like tool for humans

HTTPie pronounced aych-tee-tee-pie is a command line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. It provides a simple http command that allows for sending arbitrary HTTP requests using a simple and natural syntax, and displays colorized output...

HTTP 'PUT' Method Detection

Binary data 8699.prm...

HTTP 'DELETE' Method Detection

Binary data 8700.prm...

CVE-2015-0628

The proxy engine on Cisco Web Security Appliance WSA devices allows remote attackers to bypass intended proxying restrictions via a malformed HTTP method, aka Bug ID CSCus79174...

Design/Logic Flaw

The proxy engine on Cisco Web Security Appliance WSA devices allows remote attackers to bypass intended proxying restrictions via a malformed HTTP method, aka Bug ID CSCus79174...

CVE-2015-0628

The CVE-2015-0628 issue affects Cisco Web Security Appliance (WSA) where the proxy engine fails to properly handle malformed HTTP methods, enabling remote attackers to bypass proxying restrictions. This is a vulnerability in the proxy component that could permit unauthorized proxy traffic if an a...

CVE-2015-0628

The proxy engine on Cisco Web Security Appliance WSA devices allows remote attackers to bypass intended proxying restrictions via a malformed HTTP method, aka Bug ID CSCus79174...

Jenkins-CI Login Utility

This module attempts to login to a Jenkins-CI instance using a specific user/pass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

Debian DSA-3031-1 : apt - security update

The Google Security Team discovered a buffer overflow vulnerability in the HTTP transport code in apt-get. An attacker able to man-in-the-middle a HTTP request to an apt repository can trigger the buffer overflow, leading to a crash of the 'http' apt method binary, or potentially to arbitrary cod...

[SECURITY] [DSA 3031-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3031-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 23, 2014 http://www.debian.org/security/faq -...

用友某没修复好可以绕过继续拿shell（HTTP Method防护绕过技巧）

简要描述： 刚上wooyun，发现有个提醒，用友一个JBOSS漏洞对我公开了。 然后就稍微看了下，还是可以继续搞进去嘛。 详细说明： 原始漏洞是这个： http://wooyun.org/bugs/wooyun-2014-065444 用/invoker/EJBInvokerServlet已经拿不到shell了，/jmx-console/也加了验证， 但是可以用HEAD方法绕过唉亲。 然后就是修改成HEAD数据包继续搞shell. 漏洞证明： 一句话shell地址：http://xiaoxi.yonyou.com/tshThSIjBouKg/XbAXCDkfoW.jsp...