924 matches found
hsecscan
hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...
CVE-2026-122233
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling httpgetlastresponseheaders can read...
EUVD-2026-117119
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling httpgetlastresponseheaders can read...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
Cloudflare PHP CTF — php2shell WAF-bypass research Target:...
CVE-2026-120644
A flaw was found in perl-cgi. This vulnerability allows a remote attacker to inject arbitrary cookie attributes into HTTP Hypertext Transfer Protocol Set-Cookie response headers. The issue occurs because the module fails to properly validate semicolons or control characters in path, domain, and...
DEBIAN-CVE-2026-120644
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...
PT-2026-137176
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http get last response headers can read...
CVE-2026-120644
The CGI::Cookie module for Perl (versions before 5.00 ) is vulnerable to cookie attribute injection. The root cause is a failure to validate semicolons or control characters in path , domain , and expires values when writing to the Set-Cookie header. If an application uses untrusted user input to...
CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...
CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...
CVE-2026-115779
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...
EUVD-2026-116496
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...
CVE-2026-115779
The Effect TypeScript framework is vulnerable to cookie attribute injection in the @effect/platform package. Specifically, versions 0.1.0 through 0.97.1 (and effect versions 4.0.0-beta.0 through 4.0.0-beta.103 ) fail to sanitize semicolon delimiters in the name, domain, and path fields passed to ...
CVE-2026-115779 Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...
CVE-2026-115779 Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...
CVE-2026-119346
Next.js applications that set cookies through NextResponse on Edge runtime routes — App Router route handlers and Pages Router Edge API routes — send an internal x-middleware-set-cookie header in the public response, duplicating the cookie value and its attributes. This makes HttpOnly cookies, su...
SUSE CVE-2026-118777
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name proto so that the...
CVE-2024-26144-test
CVE-2024-26144-test Requirement: Docker compose Deno $ deno run --allow-run --allow-net check.ts If you want to test CDN, please set the URL in argument. Make sure all caches are purged before run! $ deno run --allow-run --allow-net check.ts https://example.com/ Results If HTTP response contains...
CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-
Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values rouille Assigned CVE ID: CVE-2026-66746 Summary rouille writes response header values to the client without checking them for carriage return or line feed. An application that places attacker-influenced text into a...
Linux Distros Unpatched Vulnerability : CVE-2026-118777
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and...