apk-interceptor

apk-interceptor Android 深层链接、Intent 和 WebView 桥接评估辅助工具 apk-interceptor 是一个专为授权应用安全评估而设计的便携式 Android 测试 APK。它帮助安全工程师验证 Android 应用如何处理外部入口点，例如自定义 URI 方案、深层链接、导出的 Activity 和 WebView JavaScript 桥接。 该工具有意受限： 它不声明 android.permission.INTERNET 它不向外部服务器发送数据 它不执行 Shell 命令 它不需要 root、Magisk、Frida 或运行时插桩...

Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...

Espionage

Espionage - 一个用于Linux的网络流量拦截器 被收录于 关于 Espionage Espionage 是一个网络数据包嗅探器，用于拦截通过接口传输的大量数据。该工具允许用户运行常规和详细流量分析，实时显示流量，揭示数据包方向、协议、标志等信息。Espionage 还可以进行 ARP 欺骗，因此目标发送的所有数据都将通过攻击者（MiTM）重定向。Espionage 支持 IPv4、TCP/UDP、ICMP 和 HTTP。Espionage 使用 Python 3.8 编写，但也支持 3.6 版本。这是该工具的第一个版本，如果您想贡献代码为 Espionage...

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor vulnerability discovered by ? in WordPress Npm axios versions = 1.0.0, 1.20.0...

Axios: Header Injection via Inherited headers After Minimal Interceptor

Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability...

GHSA-J8RH-479H-CP32 Axios: Header Injection via Inherited headers After Minimal Interceptor

Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability...

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...

NPM: undici vulnerable to downstream response splitting via retry interceptor

NPM: undici vulnerable to downstream response splitting via retry interceptor vulnerability discovered by ? in WordPress Npm undici versions 6.28.1...

EUVD-2026-71661

undici vulnerable to downstream response splitting via retry interceptor...

EUVD-2026-71634

undici vulnerable to Denial of Service via unbounded decompression of compressed responses...

EUVD-2026-71518

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches...

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor vulnerability discovered by ? in WordPress Npm undici versions = 7.1.0, 7.29.1...

EUVD-2026-71517

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor...

EUVD-2026-71489

undici vulnerable to caching and replay of unsafe HTTP method responses...

EUVD-2026-71474

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors...

Exposure Of Data Element To The Wrong Session

Apache Struts is vulnerable to an exposure of data element to the wrong session. The vulnerability is due to per-response serialization state being shared across concurrent requests in the SMD/JSON-RPC handling of the JSON interceptor, which allows an attacker to potentially observe response...

cve-2026-34486-tomcat_encrypt_bypass_reproduction

CVE-2026-34486：Apache Tomcat EncryptInterceptor 绕过漏洞 字段| 值 ---|--- CVE| CVE-2026-34486 CVSS| 7.5 高危 类型| 敏感数据加密缺失 组件| Apache Tomcat 集群 EncryptInterceptor 发布时间| 2026 概述 CVE-2026-34486 是由于修复 CVE-2026-29146 时引入的不完全回归缺陷。在 Apache Tomcat 的集群复制机制中，EncryptInterceptor 负责加密和认证集群消息。修复 CVE-2026-29146 时的重构意外地将...

Interceptor

Interceptor 作者：@Cerbersec Interceptor 是一个内核驱动程序，专注于通过修补内核回调和挂钩 IRP，在内核空间中篡改 EDR/AV 解决方案。 Interceptor 是 NVISO Security 红队实习期间的作品。相关博客文章可以在此处（kernel karnage）找到。 2022 年，Kernel Karnage 在 SANS Pen Test HackFest 上进行了展示，促使本仓库向公众发布，并附带以下演示： https://www.youtube.com/watch?v=QHEzyCGz-rk...

undici: undici: HTTP response splitting via retry interceptor

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an...

EUVD-2026-84986

A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The...