51 matches found
gitjacker
gitjacker Gitjacker 能够从误上传了 .git 目录的站点下载 git 仓库并提取其内容。即使禁用了目录列表，它仍能恢复仓库的很大一部分。 仅用于教育/渗透测试用途。 更多信息请访问 https://liam-galvin.co.uk/security/2020/09/26/leaking-git-repos-from-misconfigured-sites.html 安装 root@kitploit: curl -s "https://raw.githubusercontent.com/liamg/gitjacker/master/scripts/install.sh...
CVE-2021-41773
CVE-2021-41773 Se encontró una falla en un cambio realizado a la normalización de rutas en Apache HTTP Server 2.4.49-2.4.50. Un atacante podría usar un ataque de recorrido de rutas para mapear URLs a archivos fuera del directorio raíz esperado. Si los archivos fuera del directorio raíz no están...
React2P4IM0Nshell
React2P4IM0Nshell 💥Extension Tool para Auditoría y Explotación avanzada RCE/Source Leak/Dos CVE-2025-55182/83/84 para entornos Next.js y React Server Components RSC directamente desde tu navegador, con terminal linux incorporada en la propia extension para resibir cualquier reverse shell ❌ ⚡...
eos
Enemigos de Symfony EOS EOS saquea información de un objetivo Symfony en modo depuración: Sección| Descripción ---|--- General| Obtener información general sobre el objetivo. Phpinfo| Extraer las variables de entorno de Symfony del phpinfo expuesto. Routes| Obtener la lista de rutas registradas...
Information Exposure
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure via the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints. An attacker can access sensitive source code and potentially embedded secrets by making...
EUVD-2026-36421
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent incomplete fix for GHSA-6m52-m754-pw2g...
CVE-2026-49993
Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack /...
CVE-2026-49993
Nuxt (Vue.js) users using the @nuxt/rspack-builder and @nuxt/webpack-builder are affected. The CVE concerns an incomplete fix for GHSA-6m52-m754-pw2g in versions 3.15.4–3.21.6 and 4.0.0–4.4.6, where the dev server could leak source code if bound to a non-loopback address and a malicious site is o...
PT-2026-48868
Name of the Vulnerable Software and Affected Versions @nuxt/rspack-builder versions 3.15.4 through 3.21.6 @nuxt/rspack-builder versions 4.0.0 through 4.4.6 @nuxt/webpack-builder versions 3.15.4 through 3.21.6 @nuxt/webpack-builder versions 4.0.0 through 4.4.6 Description An incomplete fix in the...
Exposed Dangerous Method or Function
Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Exposed Dangerous Method or Function in Server.js, when handling non-HTTPS responses. An attacker can...
Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms
Anthropic on Tuesday confirmed that internal code for its popular artificial intelligence AI coding assistant, Claude Code, had been inadvertently released due to a human error. "No sensitive customer data or credentials were involved or exposed," an Anthropic spokesperson said in a statement...
Security Bug in StealC Malware Panel Let Researchers Spy on Threat Actor Operations
Cybersecurity researchers have disclosed a cross-site scripting XSS vulnerability in the web-based control panel used by operators of the StealC information stealer, allowing them to gather crucial insights on one of the threat actors using the malware in their operations. "By exploiting it, we...
CVE-2025-55183
A flaw was found in React Server Components RSC. This vulnerability allows an information leak, where a specifically crafted HTTP Hypertext Transfer Protocol request to a vulnerable Server Function can unsafely return its source code. Exploitation requires a Server Function that explicitly or...
EUVD-2019-8562
Malware in sbrugna...
EUVD-2023-39050
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2023-3413
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions...
ERMAC V3.0 Banking Trojan Source Code Leak Exposes Full Malware Infrastructure
Cybersecurity researchers have detailed the inner workings of an Android banking trojan called ERMAC 3.0, uncovering serious shortcomings in the operators' infrastructure. "The newly uncovered version 3.0 reveals a significant evolution of the malware, expanding its form injection and data theft...
Next.js 安全漏洞
Next.js is a React framework open-sourced by Vercel. A security vulnerability exists in versions of Next.js prior to 13.0 through 15.2.2, which stems from a possible source code leak when the App Router is enabled on the development server...
CVE-2020-29041
A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension code review. Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contai...
