CVE-2025-23167

CVE-2025-23167 – Exploit de contrabando de solicitudes HTTP en Node.js Exploit funcional para CVE-2025-23167, una vulnerabilidad de contrabando de solicitudes que afecta a las versiones de Node.js 20.x anteriores a v20.19.2. Este error permite una terminación incorrecta de cabeceras HTTP, lo que...

h2csmuggler

h2cSmuggler 描述 h2cSmuggler 通过建立与支持 h2c 的后端服务器的 HTTP/2 明文（h2c）通信，将 HTTP 流量偷偷绕过不安全的边缘服务器 proxypass 配置，从而允许绕过代理规则和访问控制。 请参阅下面详细的技术文章，了解： 漏洞的技术分析 默认不安全的服务 修复指导 此处：https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c 如何测试？ 任何转发 h2c 升级头的代理端点都可能受到影响。由于 h2c...

vCenter Server - Improper Access Control

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. id: CVE-2021-22017 info: name:...

wotop

Web-On-Top-Of-Protocol WOTOP ======================== ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ 简介 WOTOP...

CVE-2023-20887

CVE-2023-20887 POC para CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight RCE no autenticado Análisis Técnico Se puede encontrar un análisis de causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/...

CTT-Enhanced-CVE-2026-46339-Exploit-Engine

CTT-Enhanced-CVE-2026-46339-Exploit-Engine Un framework especializado en Python que ejecuta ejecución remota de código no autenticada a través del puente del Model Context Protocol MCP de 9Router, implementando una cascada de fases temporales de 33 capas, dispersión de Riemann-Hadamard y un filtr...

CVE-2025-55315

CVE-2025-55315 CVE-2025-55315 的概念验证漏洞利用程序（.NET HTTP 请求走私）。展示了错误解析的分块编码如何让攻击者绕过易受攻击的 ASP.NET Core/Kestrel 服务器中的代理和负载均衡器进行请求走私。 📊 演示 查看交互式 Prezi 演示 🎥 点击上方徽章以查看完整的交互式 Prezi 演示 项目结构 Api - 整合的 ASP.NET Core API，包含两个 Dockerfile： Dockerfile.vulnerable - 使用 .NET 10.0.100-rc.1（易受 CVE-2025-55315 影响）...

Security Bulletin: Multiple Vulnerabilities in Axios affect IBM Cloud Pak System

Summary Due to the use of Axios, multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config...

CVE-2023-20887

CVE-2023-20887 POC para CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight RCE no autenticado Análisis Técnico Un análisis de la causa raíz de la vulnerabilidad se puede encontrar en mi blog:...

CVE-2025-22870

PoC – CVE-2025-22870 – 通过 Go 中的 IPv6 区域 ID 绕过 HTTP 代理 摘要 此概念验证展示了 CVE-2025-22870 的利用方式，该漏洞存在于 golang.org/x/net/http/httpproxy 包中（版本低于 v0.36.0），可通过滥用 IPv6 区域标识符与 NOPROXY 模式匹配的方式绕过 HTTP 代理限制。 受影响组件 包名 ：golang.org/x/net/http/httpproxy 受影响版本 ： 0.36.0 修复版本 ：0.36.0 发现者 ：Juho Forsén Mattermost Go 问题...

axios: axios: Denial of Service via crafted redirect hostname

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

axios: axios: Denial of Service via crafted redirect hostname

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

axios: axios: Denial of Service via crafted redirect hostname

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

EUVD-2026-88367

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls...

SUSE CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

Fedora 44 : python-streamlink / python-urllib3 (2026-700dc0d93d)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-700dc0d93d advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and related helpers...

DEBIAN-CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...