xepor

Xepor Xepor pronounced /ˈzɛfə/ , zephyr is a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style. This project is meant to be used with mitmproxy...

uefi-firmware-parser

UEFI Firmware Parser .. image:: https://travis-ci.org/theopolis/uefi-firmware-parser.svg?branch=master :target: https://travis-ci.org/theopolis/uefi-firmware-parser The UEFI firmware parser is a simple module and set of scripts for parsing, extracting, and recreating UEFI firmware volumes. This...

python-uncompyle6

|buildstatus| |Pypi Installs| |Latest Version| |Supported Python Versions| |packagestatus| .. contents:: uncompyle6 A native Python cross-version decompiler and fragment decompiler. The successor to decompyle, uncompyle, and uncompyle2. I gave a talk on this at BlackHat Asia 2024 . Introduction...

bofhound

THIS REPO IS NO LONGER ACTIVE ⛔🚧 This repo is no longer maintained. To submit an issue, pull request, or obtain the lastest version, reference https://github.com/coffeegist/bofhound 🚧⛔ | / / / | /| | | | / \ | | | | | \ | | | \ | | | | | | | | | | || | | | | | | | | | | | | | .--. | | | | | | | |...

USN-8940-1 libxs-parse-keyword-perl vulnerability

It was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs. If a user or automated system were tricked into receiving specially crafted input, an attacker could cause a denial of service...

USN-8940-1: Perl XS::Parse::Keyword module vulnerability

It was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs. If a user or automated system were tricked into receiving specially crafted input, an attacker could cause a denial of service...

Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...

CVE-2026-112768

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112769

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...

EUVD-2026-104575

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...

CVE-2026-112769

Parse Server versions prior to 8.6.98 and 9.0.0 before 9.10.3-alpha.1 are vulnerable to a Session Class-Level Permission Bypass . The application fails to enforce create and addField class-level permissions for the _Session class. Consequently, an authenticated user, or an attacker possessing the...

CVE-2026-112769 Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...

CVE-2026-112768

Parse Server versions prior to 8.6.99 and 9.0.0 before 9.10.3-alpha.2 are vulnerable to an Information Disclosure vulnerability. The root cause is that the system evaluates checks against a target account during a user update before authorizing the caller, reflecting the outcome in the response. ...

EUVD-2026-104574

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-2020-SSRF-via-URL-Parser-Differential

CVE-2026-2020 – SSRF via URL Parser Differential Program Code Python vulnerableservice.py - Validates URL with urllib.parse, fetches with requests from flask import Flask, request import requests import urllib.parse app = Flaskname def isallowedurlurl: parsed = urllib.parse.urlparseurl Only allow...

BIT-PARSE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1 protectedFields Bypass via Relation Count Query

Parse Server before 8.6.93 and 9.0.0 before 9.10.1 does not enforce identity-scoped protectedFields authenticated, role, or per-user groups on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can...

BIT-PARSE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

BIT-PARSE-2026-109301 Parse Server before 8.6.95 and 9.0.0 before 9.10.2 Denial of Service via File Pointer Without URL

Parse Server before 8.6.95 and 9.0.0 before 9.10.2 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete trigge...

PT-2026-117427

VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in parse extent start points in clpi parse.c that trusts the num point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num point to exhaust...