smuggler

/ | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to Ben Sadeghipour...

infosec-presentations

Info-sec Presentations by James Forshaw c 2019 A repository of previous info-sec presentations I've presented including supporting material...

IE11SandboxEscapes

IE11SandboxEscapes Some example source code for fixed IE11 sandbox escapes. c James Forshaw 2014 For information purposes only. All files are licensed under GPLv3. See LICENSE for more information...

CVE-2023-26269

CVE-2023-26269: Misconfigured JMX in Apache James By default Apache James opens a JMXRMI service that listens on localhost, port 9999. Because the JMX is misconfigured to allow unauthenticated access, an attacker that has local access to the machine running James can use a “MLet attack” in order ...

request_smuggler

Request smuggler Http request smuggling vulnerability scanner Based on the amazing research by James Kettle. The tool can help to find servers that may be vulnerable to request smuggling vulnerability. Archived The tool needs a lot of improvements, and I don't have enough time to support it as I...

MAL-010

MAL-010: Dangerous MBeans Accessible via JMX in Apache James By listing and inspecting the MBeans exposed by the JMX on localhost, port 9999, the following attack vectors have been identified: Arbitrary File Write using Log4J Arbitrary File Read using Log4J Note: Unlike the “MLet attack” presente...

CVE-2023-51518

CVE-2023-51518: Preauthenticated Java Deserialization via JMX in Apache James Apache James distribution prior to release 3.7.5 and 3.8.1 allow privilege escalation via JMX pre-authentication deserialization. Given a deserialization gadget, this could be leveraged as part of an exploit chain that...

asf__james-project_CVE-2022-22931_3-6-0

Apache James Project :latestjamesversion: 3.8.0 image:https://img.shields.io/badge/Join%20us-Mailing%20lists-purple.svglink="https://james.apache.org/mail.html" link:https://gitter.im/apache/james-projectimage:https://badges.gitter.im/apache/james-project.svgJoin the chat at...

CVE-2026-74010

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

A Bootiful Podcast: Redouble AI CTO and founder Andrey Santrosyan

Hi, Spring fans! In this installment, my friend James Ward and I sat down with Redouble AI CTO and founder Andrey Santrosyan This was an extra special episode because I conducted the interview with my friend, AWS' James Ward. https://www.linkedin.com/in/santrosyan/ https://redouble.ai...

The Most Dangerous AI Hacking Techniques Still Have Humans in the Loop

Security researcher James Kettle tried to push the limit of AI’s hacking abilities—and discovered how effective it can be when combined with human expertise...

WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by James Paremain in WordPress Plugin Easy Digital Downloads versions = 3.6.7...

[SECURITY] Fedora 44 Update: mingw-expat-2.8.2-1.fc44

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

org.apache.james:james-server-app (>=3.2.0, <=3.5.0), org.apache.james:james-server-spring (>=3.2.0, <=3.5.0) potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.18.release)

org.springframework:spring-jms MAVEN version 3.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.james:james-server-app =3.2.0, =3.2.0, =3.5.0 Source cves: CVE-2026-41855 Sourc...

org.apache.camel:camel-itest-spring32 (>=2.16.1, <=2.16.5), org.apache.cxf.systests:cxf-systests-uncategorized (>=3.0.7, <=3.0.11) +8 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.14.release)

org.springframework:spring-jms MAVEN version 3.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-itest-spring32 =2.16.1, =3.0.7, =3.0.0-beta5, =3.0.0-rc1, =3.1.0...

de.taimos:dvalin-interconnect-core (1.31), de.taimos:dvalin-interconnect-test (1.31) +53 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.25.release)

org.springframework:spring-jms MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - de.taimos:dvalin-interconnect-core 1.31 - de.taimos:dvalin-interconnect-test 1.31 -...

A Bootiful Podcast: A Bootiful Podcast: Dr. Venkat Subramaniam and James Ward on Intelligent Kotlin and So Much More

I am beyond thrilled that I got to co-present with two legends, Dr. Venkat Subramaniam and James Ward, at Voxxed Days Amsterdam, and even more so that they both sat down for a quick discussion with me right before that presentation. Enjoy!...

[SECURITY] Fedora 43 Update: mingw-expat-2.7.4-1.fc43

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

PT-2026-4389

Name of the Vulnerable Software and Affected Versions WP Term Order versions through 2.1.0 Description A Cross-Site Request Forgery CSRF issue exists in WP Term Order. This allows attackers to perform actions on behalf of authenticated users without their knowledge. Recommendations Update WP Term...

CVE-2026-24542: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term Order: from n/a through = 2.1.0...