VHostScan

VHostScan ماسح مضيف افتراضي يمكن استخدامه مع أدوات المحور pivot tools، لكشف سيناريوهات catch-all، والأسماء المستعارة، والصفحات الافتراضية الديناميكية. تم تقديمه لأول مرة في SecTalks BNE في سبتمبر 2017 عرض الشرائح. هذه نسخة محسنة من أداة VHostScan الأصلية بواسطةCodingo مع تحسينات إضافية، تحديث قاع...

gobuster

Gobuster 💻 مقدمة أداة تخمين Brute-forcing سريعة ومرنة مكتوبة بلغة Go Gobuster هي أداة تخمين عالية الأداء للأدلة/الملفات، DNS والمضيفات الافتراضية، مكتوبة بلغة Go. صُممت لتكون سريعة وموثوقة وسهلة الاستخدام لمحترفي الأمن واختبار الاختراق. ✨ الميزات 🚀 أداء عالي : مسح متعدد الخيوط مع تزامن قابل للتكو...

Mini_httpd-CVE-2018-18778

minihttpd任意ファイル読み取り脆弱性（CVE-2018-18778） Minihttpdは小型のHTTPサーバーであり、システムリソースの消費が少ない状態でも一定の性能（Apacheの約90%）を維持できるため、さまざまなIoT機器（ルーター、スイッチ、カメラなど）の組み込みサーバーとして広く使用されています。また、ファーウェイ、Zyxel、海康威視（Hikvision）、ラズベリーパイなどのベンダーのデバイスでもMinihttpdコンポーネントが採用されていました。...

vhostawesome

FunWithVhosts أداة مصممة للتحقق بكفاءة من المضيفات الافتراضية عبر عناوين IP متعددة. الوصف تقوم FunWithVhosts بأتمتة عملية تحديد المضيفات الافتراضية على عناوين IP معينة. يتحقق السكربت من المنافذ المفتوحة، خاصة منافذ خادم الويب، ثم يحاول استرداد المحتوى باستخدام قائمة بالنطاقات الفرعية المحتملة لنط...

dnsresolver

dnsresolver Un Résolveur DNS Ultra-Rapide Table des matières Installation Utilisation Utilisation de base Résolution d'hôtes avec ports Énumération des hôtes virtuels Utilisation de domaines non résolus Utilisation de localhost Démonstrations Commentaires Licence Installation Assurez-vous que Rus...

jfscan

!CAUTION ⚠️ Project Deprecated This project has been rewritten in Go for better performance and features. Please use the new version here: nullt3r/massmap Description Killing features Unleash the power of Nmap with Masscan for large-scale scans Scan targets using domain names and other formats...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: vhost: The bound check for the vdpa group has been moved to vhostvdpa. Duplication has been eliminated by consolidating these changes. This reduces the possibility that a parent driver may miss these checks. Additionally, we...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Cloud Pak for Data System 1x to provide web application server functionality. CVE-2026-10051 affects Jetty's HTTP/1.1 request handling when trailers are retained across multiple requests on the same connection, potentially exposing sensitive information from...

CVE-2026-6790

A flaw was found in Eclipse Jetty. The server does not strictly validate that the request authority host and port matches the Host header provided in HTTP/1, HTTP/2, and HTTP/3 requests. This improper validation can lead to various issues, including incorrect handling of URI constructions for...

[SECURITY] Fedora 43 Update: nginx-mod-vts-0.2.4-13.fc43

Nginx virtual host traffic status module...

CVE-2026-67178

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...

[SECURITY] Fedora 44 Update: nginx-mod-vts-0.2.4-13.fc44

Nginx virtual host traffic status module...

tomcat9 update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

tomcat9 security update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

RabbitMQ 3.7.x < 4.0.13 / 4.1.x < 4.1.2 XSS via Virtual Host Names

The version of RabbitMQ installed on the remote host is affected by a cross-site scripting vulnerability: - Unsanitized virtual host names allow for XSS in the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart. CVE-2026-44839 Note...

Linux Distros Unpatched Vulnerability : CVE-2026-6790

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host...

CVE-2026-6790

In Eclipse Jetty, HTTP/1 requests to HTTP/1.3 (HTTP/2/3 included) do not enforce that the request authority (host and port) matches the Host header when present. This mismatch can affect URI redirects, virtual host selection, reverse proxying, and logs. The issue is described across CVE sources (...

CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

CVE-2026-57221

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and...