82 matches found
CVE-2000-0649
CVE-2000-0649 CVE-2000-0649 是一个低风险漏洞，可能泄露服务器的内部 IP 地址。官方详情在这里： Rapid7 CVE NIST 这个漏洞特别引起我的兴趣，因为它似乎也影响当前的 NGINX 和一些 Apache 配置。该工具在给定的 IP 或域名上测试该漏洞，并有意减少输出，以便可以与其他脚本一起使用。当起作用时，它应该看起来像这样： 否则，将没有任何输出。我们通过在 /etc/nginx/nginx.conf 中添加以下行来在 NGINX 中修复此问题： root@kitploit: servernameinredirect on 谢谢！...
Remote-Integer-Overflow-Vulnerability
Nginx：远程整数溢出漏洞 该仓库包含一个较老但仍存在的Nginx漏洞，名为“远程整数溢出漏洞（CVE-2017-7529）”。该漏洞针对较旧的Nginx服务器（1.13）。（例外：Nginx 1.12） 设置： 下载sys库和requests库。 如果同时拥有os库会更好。 可利用的漏洞包括： root@kitploit: 1 Reading Sensitive Headers during an Intercept of Requests. 2 Revealing Sensitive Informatino containing real IP Addresses. 此仓库包含：...
CVE-2026-76203
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
CVE-2026-76203 CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
EUVD-2026-62416
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
EUVD-2026-45194
Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers ca...
CVE-2026-42447
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...
CVE-2026-33357
CVE-2026-33357 affects Meari client applications that embed com.meari.sdk, including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label
CVE-2026-45182
GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let systemserver transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" a...
CVE-2025-55276
HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout...
CVE-2025-55276 HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability
HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout...
EUVD-2018-18355
Malware in sbrugna...
EUVD-2019-17552
Malware in sbrugna...
EUVD-2018-5309
Malware in sbrugna...
EUVD-2022-7407
Malicious code in bioql PyPI...
EUVD-2022-41723
Malicious code in bioql PyPI...
EUVD-2025-28984
Malicious code in bioql PyPI...
CVE-2025-59055
InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery SSRF vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS...
CVE-2025-59055
CVE-2025-59055 concerns InstantCMS up to version 2.17.3, where a blind SSRF vulnerability exists in the installer’s package parameter. The underlying issue allows an authenticated attacker to make arbitrary HTTP/HTTPS requests, enabling actions such as scanning internal networks, invoking local s...