pybatfish

Есть вопросы, отзывы или предложения? Присоединяйтесь к нашему сообществу вSlack! Pybatfish Pybatfish — это Python-клиент для Batfish. Что такое Batfish? Batfish — это инструмент для проверки сетей, который обеспечивает гарантии корректности в области безопасности, надежности и соответствия...

grr

GRR Rapid Response — это платформа реагирования на инциденты, ориентированная на удаленную живую криминалистику. GRR — это клиент на Python агент, который устанавливается на целевые системы, и серверная инфраструктура на Python, которая может управлять клиентами и взаимодействовать с ними...

tinyshell

tinyshell 작은 PHP 셸, Python 클라이언트에 의해 제어되며 프로토콜 메서드를 통해 연결합니다 기능 리버스 연결 없이 직접 세션으로 연결 가능 비밀번호 보호 지원 파일 손상 없이 모든 파일에 바인딩 가능 오류 처리를 포함한 GET/POST 요청 사용 사용법 프로젝트는 두 개의 파일로 구성됩니다: Remote shell python file : 대상과 연결하기 위한 클라이언트로 간주됨 python remote shell.py url password php shell php file : PHP 백도어로 간주됨...

ASPX_WebShell_COFFLoader

COFF 로더를 사용한 ASPX 웹 셸 TrustedSec의 CSCOFFLoader를 기반으로 함 설명 이 ASPX 웹 셸은 반-대화형 Python 클라이언트를 사용하여 대상 서버에서 Beacon Object Files BOFs 를 실행할 수 있게 합니다. TrustedSec의 CSCOFFLoader에서 파생된 COFF 로더 구현을 활용합니다. 이 프로젝트는 보안 연구 및 승인된 침투 테스트용 으로만 제공됩니다. 이 프로젝트를 사용함으로써 귀하는 모든 관련 법률 및 규정을 준수하는 데 동의합니다. 사전 요구 사항 사용 전에 다...

CVE-2026-84378

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84380

HTTPX2 , a next-generation HTTP client for Python, contains a request-smuggling vulnerability prior to version 2.11.0 . The flaw resides in Request._prepare() in _models.py, where its setdefault() logic checks Content-Length and Transfer-Encoding headers independently instead of treating them as ...

CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84378

HTTPX2 , a next-generation HTTP client for Python, is affected by a quadratic CPU denial-of-service vulnerability in its Server-Sent Events (SSE) parser. Versions from 2.5.0 through 2.10.0 are impacted. The root cause lies in _SSELineDecoder.decode() in src/httpx2/httpx2/_sse.py, which repeatedly...

vt-py

vt-py Questa è la libreria client Python ufficiale per VirusTotal. Con questa libreria puoi interagire con la VirusTotal REST API v3 e automatizzare il tuo workflow in modo rapido ed efficiente. Cose che puoi fare con vt-py Scansiona file e URL Ottieni informazioni su file, URL, domini, ecc. Eseg...

TencentOS Server 3: python3.12-urllib3 (TSSA-2026:0623)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0623 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-50271 dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES limits on the extract path. A remote, unauthenticated...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

PYSEC-2026-2323

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...

PYSEC-2026-2000 Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification

The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially serve a benign manual e.g., one defining an HTTP tool call, earning the clients’ trust, a malicious provider can later change the manual to...

PYSEC-2026-901 Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...

Malicious code in horde-python-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ae9afcd7af22c82b137c1142ae643502d82f3d1f28712b2e5c7ec412bea85e horde-python-client 99999.0.0 is a dependency-confusion lure. On import hordepythonclient, a daemon thread unconditionally POSTs a JSON payload...

MAL-2026-6734 Malicious code in horde-python-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ae9afcd7af22c82b137c1142ae643502d82f3d1f28712b2e5c7ec412bea85e horde-python-client 99999.0.0 is a dependency-confusion lure. On import hordepythonclient, a daemon thread unconditionally POSTs a JSON payload...

PYSEC-2026-289 Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network...