CVE-2026-42533-nginx

CVE-2026-42533 nginx このリポジトリには、CVE-2026-42533 で説明されている complexvalue の2パスキャプチャ破壊（capture-clobbering）問題に関連する nginx 設定パターンを特定するための Go 製スキャナが含まれています。 概要 このツールは nginx 設定ファイルとディレクトリを解析し、正規表現キャプチャと正規表現マップ変数が同じリクエストバッファを共有する危険な設定を検出します。このような場合、パーサーが長さと値の不一致を生じさせ、ヒープ領域外書き込みや情報漏えいにつながる可能性があります。 機能 nginx...

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter は、クライアントサイドJavaScriptにハードコードされた秘密情報の検出を自動化するために、セキュリティ研究者向けに設計された高度なPythonツールです。 単純なスキャナとは異なり、V2 には動的クローラが搭載されており、対象WebサイトのHTMLを解析して読み込まれたすべてのJavaScriptファイルを自動的に抽出するため、包括的なカバレッジを確保します。 機能 🕷️ 動的クローリング: HTMLを解析して、すべてのタグを自動的に検出します。 🔍 正規表現ベースの検出:...

CVE-2019-19204

CVE-2019-19204 An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier formerly known as fetchrangequantifier in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read. Researcher: ManhND of The Tarantula Team,...

CVE-2022-45729

This repository does not have a README...

CVE-2026-77421

A flaw was found in the JLine built-in nano editor's regular expression regex search mode. A remote attacker could exploit this by providing a specially crafted search term. This could lead to excessive central processing unit CPU consumption, causing the editor session to become unresponsive and...

CVE-2026-77423

The JLine Java library (versions 3.0.0 to 3.30.15 and 4.3.1 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins...

CVE-2026-77421

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

EUVD-2026-85522

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

CVE-2026-77421 JLine: ReDoS in Nano Editor Regex Search Mode

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

cloudformation-waf-acl

cloudformation-waf-acl Una plantilla de AWS CloudFormation utilizada para aprovisionar y gestionar recursos de AWS WAFv2, incluyendo una Web ACL, grupos de reglas administradas, un conjunto de patrones de expresiones regulares personalizadas y un conjunto de IPs. Componentes La plantilla...

Linux Distros Unpatched Vulnerability : CVE-2026-89407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates stringified numbers with two regular expressions: PATTERNFLOAT +-?0-9.?0-9+eE+-?0-9+?,...

GitMiner3

作者: UnkL4b サイト: bravul.com ブログ: unkl4b.github.io Github: UnkL4b X: @UnkL4b 警告 root@kitploit: +---------------------------------------------------+ | DEVELOPERS ASSUME NO LIABILITY AND ARE NOT | | RESPONSIBLE FOR ANY MISUSE OR DAMAGE CAUSED BY | | THIS PROGRAM |...

CVE-2022-22978

CVE 2022-22978: RegexRequestMatcher의 인증 우회 🥶 개요 내가 조사한 정보에 따르면, 이 취약점은 Spring Security 프레임워크의 RegexRequestMatcher 클래스와 관련이 있습니다. 구체적으로, 정규 표현식에 점.이 포함된 RegexRequestMatcher를 사용하는 애플리케이션은 \r%0a , \n%0d 문자를 사용하여 우회될 수 있으며, 이를 통해 공격자는 인증 없이 허용되지 않은 경로에 접근할 수 있습니다. Spring Security 프레임워크의 취약한 버전: 5.5.x...

CVE-2026-23813

CVE-2026-23813 — AOS-CX Pre-Auth Authentication Bypass Unauthenticated remote attackers can reach the AOS-CX management REST API by smuggling a login token through nginx's over-permissive version regex, exposing the OVSDB-backed configuration surface including the hashed admin credential. CVE:...

CVE-2026-46650

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

struts1filter

struts1filter A request parameter filter solution for Apache Struts 1 CVE-2014-0114 based on the work of Alvaro Munoz and the HP Fortify team. To use this filter, add the following filter declaration along with appropriate mapping to the web.xml descriptor of the Apache Struts 1 application to...

CVE-2026-84642

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain...

CVE-2026-78122-POC

CVE-2026-78122 — Proof of Concept Tecnativadocker-socket-proxy ≤ 0.5.0 — Insufficient Access-Control Granularity CWE-1220 CVSS 4.0: 8.3 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Attack Vector is Adjacent AV:A: the attacker needs local/adjacent network reach to the pro...

CVE-2022-22978-demo

CVE-2022-22978-demo CVE-2022-22978 vulnerability demo code Exploitation Conditions Although rated as high severity, the exploitation conditions are quite stringent. Personally, I find this vulnerability rather underwhelming. 1. First, spring-security must be within the affected scope. 2. Second, ...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...