cve-2016-1764

CVE-2016-1764 PoC 익스플로잇 코드 암호화를 깨지 않고 iMessage 평문 데이터 복구 저자 Shubham Shah Bishop Fox 소속 Joe DeMesy Bishop Fox 소속 Matthew Bryant CVE-2016-1764 공급업체: Apple 공개 날짜: 2016년 4월 8일 패치 날짜: 2016년 3월 21일 영향을 받는 시스템: OS X Mountain Yosemite, El Capitan의 Messages 최근 Apple에 대한 논쟁의 대부분이 암호화에 집중되어 있는 동안, 업계와 법 집행...

scripthunter

scripthunter Scripthunter는 주어진 웹사이트에서 JavaScript 파일을 찾는 도구입니다. Google을 스캔하려면 ./scripthunter.sh https://google.com을 실행하면 됩니다. 시간이 다소 걸릴 수 있으므로, scripthunter는 Telegram API를 통해 스캔 완료 시 알림을 보내는 기능도 구현하고 있습니다. 블로그 게시물 설치 scripthunter를 설치하려면 이 저장소를 클론하세요. scripthunter는 몇 가지 도구에 의존하므로 다음 도구들이 설치되어 있는지...

CVE-2024-4367-PoC

CVE-2024-4367 & CVE-2024-34342: PDF.js에서의 임의 JavaScript 실행 PDF.js에서 폰트를 처리할 때 타입 검사가 누락되어, PDF.js 컨텍스트 내에서 임의 JavaScript 실행이 가능했습니다. 이 취약점은 Firefox 126, Firefox ESR 115.11, Thunderbird 115.11에 영향을 미칩니다. pdf.js가 악성 PDF를 로드하는 데 사용되고, PDF.js가 isEvalSupported를 true로 설정한 경우기본값, 제한 없이 공격자가 제어하는...

FlowName

FlowName Name quality shows the ratio of names exclusively preferred by an automated, uncalibrated Jev evaluation.Animated chart → · Exact counts, method and limitations → Try FlowName in your browser → — enter your JavaScript, API key and model; no installation required. CLI: npx --yes...

Jbin-website-secret-scraper

🎖️ JbinはウェブサイトからすべてのURLを収集し、そこから秘密のデータを露出しようと試みます。URLとJSリンクの両方を収集して、そこから秘密情報をスクレイピングします。また、ページ内の特定の文字列を探している場合や、カスタム正規表現を実行したい場合も、新しいリリースではそれが可能になりました。さらに、有益なレポートも提供します。 どのように動作しますか？ サードパーティコンポーネント Wayback API インストール 必要要件: Python-3.8.5, Flask 1. flaskをインストール pip install Flask 2. 要件をインストール pip...

CVE-2025-45960

CVE-2025-45960 - tawk.to Live chat - 1.6.1 - Cross-Site Scripting XSS 취약점 1.6.1에서 확인됨 이전 버전도 영향을 받을 가능성이 있음 설명: 웹 애플리케이션이 사용자 입력을 적절한 입력 검증이나 인코딩 없이 저장하고 표시하는 것이 발견되었습니다. 이로 인해 악성 코드가 서버에 저장되고, 적절한 살균 처리 없이 사용자의 웹 브라우저에 렌더링됩니다. 예를 들어, 테스터가 라이브 채팅에 악성 JavaScript를 저장할 수 있으며, 이는 웹사이트에서 실행될 수 있습니다. 영...

XWiki Platform - Cross-Site Scripting

XWiki Platform versions = 4.2-milestone-3 and = 16.5.0-rc-1 and = 17.0.0-rc-1 and = 4.2-milestone-3 and = 16.5.0-rc-1 and = 17.0.0-rc-1 and 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the...

WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting

The WordPress File Upload plugin before version 4.24.8 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'dir' parameter in the file browser page before outputting it back, which could allow attackers to execute arbitrary JavaScript code...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...

KodExplorer - Cross-Site Scripting

KodExplorer is susceptible to a reflected cross-site scripting XSS vulnerability in the file view functionality.The vulnerability exists in app/template/api/view.html where user-supplied input in the 'path' parameter is directly echoed without proper sanitization.This allows attackers to inject...

Cacti - Cross-Site Scripting

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. id: CVE-2021-26247 info: name: Cacti - Cross-Site Scripting author: dhiyaneshDK severity: medium descriptio...

WordPress Loco Translate < 2.6.1 - Cross-Site Scripting

Loco Translate WordPress plugin before 2.6.1 contains a stored cross-site scripting vulnerability caused by improper removal of inline events from source translation strings, allowing authenticated users to inject arbitrary JavaScript payloads. id: CVE-2022-0765 info: name: WordPress Loco Transla...

Spotweb <= 1.5.1 - Cross Site Scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. id: CVE-2021-40970 info: name: Spotweb = 1.5.1 - Cross Site Scripting author: theamanrawat severity:...

Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter. id: CVE-2018-20824 info: name: Atlassian Jira WallboardServlet 7.13.1 - Cross-Site Scripting author:...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

123Solar 1.8.4.5 - Cross-Site Scripting

123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting XSS via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2024-9007 info: name: 123Solar 1.8.4.5 - Cross-Site Scripting author: ritikchaddha...

Admidio - Cross-Site Scripting

A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The reflected cross-site scripting vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious...