Mini_httpd-CVE-2018-18778

Vulnerabilidade de leitura arbitrária de arquivos no minihttpd CVE-2018-18778 Minihttpd é um servidor HTTP mínimo que, consumindo poucos recursos do sistema, consegue manter um certo nível de desempenho cerca de 90% do Apache; por isso, é amplamente utilizado por diversos dispositivos IoT...

VHostScan

VHostScan ماسح مضيف افتراضي يمكن استخدامه مع أدوات المحور pivot tools، لكشف سيناريوهات catch-all، والأسماء المستعارة، والصفحات الافتراضية الديناميكية. تم تقديمه لأول مرة في SecTalks BNE في سبتمبر 2017 عرض الشرائح. هذه نسخة محسنة من أداة VHostScan الأصلية بواسطةCodingo مع تحسينات إضافية، تحديث قاع...

gobuster

Gobuster 💻 Einleitung Ein schnelles und flexibles Brute-Force-Werkzeug, geschrieben in Go Gobuster ist ein leistungsstarkes Tool zur Verzeichnis-/Datei-, DNS- und virtuellen Host-Brute-Force, geschrieben in Go. Es wurde entwickelt, um schnell, zuverlässig und einfach für Sicherheitsexperten und...

vhostawesome

FunWithVhosts أداة مصممة للتحقق بكفاءة من المضيفات الافتراضية عبر عناوين IP متعددة. الوصف تقوم FunWithVhosts بأتمتة عملية تحديد المضيفات الافتراضية على عناوين IP معينة. يتحقق السكربت من المنافذ المفتوحة، خاصة منافذ خادم الويب، ثم يحاول استرداد المحتوى باستخدام قائمة بالنطاقات الفرعية المحتملة لنط...

dnsresolver

dnsresolver Um resolvedor de DNS ultrarrápido Índice Instalação Uso Uso Básico Resolvendo Hosts com Portas Enumeração de Hosts Virtuais Usando Domínios Não Resolvidos Usando Localhost Demonstrações Feedback Licença Instalação Certifique-se de ter o Rust instalado e execute o seguinte comando para...

jfscan

!CAUTION ⚠️ Project Deprecated This project has been rewritten in Go for better performance and features. Please use the new version here: nullt3r/massmap Description Killing features Unleash the power of Nmap with Masscan for large-scale scans Scan targets using domain names and other formats...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: vhost: The bound check for the vdpa group has been moved to vhostvdpa. Duplication has been eliminated by consolidating these changes. This reduces the possibility that a parent driver may miss these checks. Additionally, we...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Cloud Pak for Data System 1x to provide web application server functionality. CVE-2026-10051 affects Jetty's HTTP/1.1 request handling when trailers are retained across multiple requests on the same connection, potentially exposing sensitive information from...

CVE-2026-6790

A flaw was found in Eclipse Jetty. The server does not strictly validate that the request authority host and port matches the Host header provided in HTTP/1, HTTP/2, and HTTP/3 requests. This improper validation can lead to various issues, including incorrect handling of URI constructions for...

[SECURITY] Fedora 43 Update: nginx-mod-vts-0.2.4-13.fc43

Nginx virtual host traffic status module...

CVE-2026-67178

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...

[SECURITY] Fedora 44 Update: nginx-mod-vts-0.2.4-13.fc44

Nginx virtual host traffic status module...

tomcat9 update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

tomcat9 security update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

RabbitMQ 3.7.x < 4.0.13 / 4.1.x < 4.1.2 XSS via Virtual Host Names

The version of RabbitMQ installed on the remote host is affected by a cross-site scripting vulnerability: - Unsanitized virtual host names allow for XSS in the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart. CVE-2026-44839 Note...

Linux Distros Unpatched Vulnerability : CVE-2026-6790

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host...

CVE-2026-6790

In Eclipse Jetty, HTTP/1 requests to HTTP/1.3 (HTTP/2/3 included) do not enforce that the request authority (host and port) matches the Host header when present. This mismatch can affect URI redirects, virtual host selection, reverse proxying, and logs. The issue is described across CVE sources (...

CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

CVE-2026-57221

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and...