sudowp-adminer

SudoWP Adminer（安全分支） 贡献者： SudoWP、WP Republic 原作者： Frank Bültge、Inpsyde 标签： adminer、database、security、cve-2021-21311、ssrf-patch 最低要求版本： 5.8 最高测试版本： 6.7 稳定版： 1.5.0 许可证： GPLv2 或更高版本 安全公告（CVE-2021-21311） 这是“Adminer”WordPress 插件的一个安全加固分支 。 威胁： 标准 Adminer 安装通常允许服务器端请求伪造（SSRF） 。攻击者可以利用登录表单强制服务器连接到内部服务（例...

proxy2

proxy2 HTTP/HTTPS 代理，单个 Python 脚本即可实现 功能 易于定制 无需外部模块 同时支持 IPv4 和 IPv6 支持 HTTP/1.1 持久连接 支持为 HTTPS 拦截动态生成证书 此脚本适用于 Python 2.7。 你需要安装 OpenSSL 才能拦截 HTTPS 连接。 用法 只需作为脚本运行： root@kitploit: $ python proxy2.py 上述命令将在 localhost:8080 上运行代理。 在同一台主机的另一个终端中输入以下命令来验证其是否正常工作。 root@kitploit: $...

Origin Validation Error

Overview @grackle-ai/server is a Grackle server orchestrator — spawns and wires core gRPC, web-server HTTP, MCP, and PowerLine Affected versions of this package are vulnerable to Origin Validation Error via the connection handler process. An attacker can gain unauthorized access to real-time...

GHSA-9449-RPHM-MJQR AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE

An API endpoint that is intended for internal use by the SFTP software sftpgo was mistakenly exposed to the public-facing HTTP API for AzuraCast installations. This would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the...

AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE

An API endpoint that is intended for internal use by the SFTP software sftpgo was mistakenly exposed to the public-facing HTTP API for AzuraCast installations. This would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the...

PT-2023-32863 · Miniflare · Miniflare

Name of the Vulnerable Software and Affected Versions: Miniflare versions prior to 3.20231030.2 Description: Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on...

PYSEC-2023-22

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attacke...

SUSE CVE-2018-12120

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate...

DEBIAN-CVE-2020-7943

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types which may contain sensitive information as well as function names...

UBUNTU-CVE-2018-12120

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate...