Mini_httpd-CVE-2018-18778

minihttpd 임의 파일 읽기 취약점 CVE-2018-18778 Minihttpd는 소형 HTTP 서버로, 시스템 리소스를 적게 사용하면서도 일정 수준의 성능Apache의 약 90%을 유지할 수 있어 다양한 IoT라우터, 스위치, 카메라 등 기기에서 임베디드 서버로 널리 사용됩니다. Huawei, Zyxel, Hikvision, Raspberry Pi 등 제조업체의 장치에서도 Minihttpd 구성 요소를 채택한 바 있습니다. minihttpd에서 가상 호스트 모드가 활성화된 경우, 사용자가 http://HOST/FILE을...

gobuster

Gobuster 💻 Введение Быстрый и гибкий инструмент для брутфорса, написанный на Go Gobuster — это высокопроизводительный инструмент для перебора директорий/файлов, DNS и виртуальных хостов, написанный на Go. Он спроектирован для быстрой, надёжной и простой работы специалистов по безопасности и...

vhostawesome

FunWithVhosts Инструмент для эффективной проверки виртуальных хостов на нескольких IP-адресах. Описание FunWithVhosts автоматизирует процесс идентификации виртуальных хостов на заданных IP-адресах. Скрипт проверяет открытые порты, в первую очередь веб-серверные, а затем пытается получить...

VHostScan

VHostScan Сканер виртуальных хостов, который можно использовать с инструментами для пивота, обнаруживает сценарии catch-all, псевдонимы и динамические страницы по умолчанию. Впервые представлен на SecTalks BNE в сентябре 2017 года слайды. Это улучшенная версия оригинального VHostScan отCodingo с...

dnsresolver

dnsresolver 초고속 DNS 리졸버 목차 설치 사용법 기본 사용법 포트로 호스트 확인 가상 호스트 열거 미해결 도메인 사용 로컬호스트 사용 데모 피드백 라이선스 설치 Rust가 설치되어 있는지 확인한 후, 다음 명령을 실행하여 dnsresolver를 설치하세요. root@kitploit: git clone https://github.com/ethicalhackingplayground/dnsresolver ; cd dnsresolver ; cargo install --path . 사용법 root@kitploit: cat...

jfscan

!CAUTION ⚠️ Project Deprecated This project has been rewritten in Go for better performance and features. Please use the new version here: nullt3r/massmap Description Killing features Unleash the power of Nmap with Masscan for large-scale scans Scan targets using domain names and other formats...

EUVD-2026-70850

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Cloud Pak for Data System 1x to provide web application server functionality. CVE-2026-10051 affects Jetty's HTTP/1.1 request handling when trailers are retained across multiple requests on the same connection, potentially exposing sensitive information from...

CVE-2026-6790

A flaw was found in Eclipse Jetty. The server does not strictly validate that the request authority host and port matches the Host header provided in HTTP/1, HTTP/2, and HTTP/3 requests. This improper validation can lead to various issues, including incorrect handling of URI constructions for...

[SECURITY] Fedora 43 Update: nginx-mod-vts-0.2.4-13.fc43

Nginx virtual host traffic status module...

CVE-2026-67178

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...

[SECURITY] Fedora 44 Update: nginx-mod-vts-0.2.4-13.fc44

Nginx virtual host traffic status module...

tomcat9 update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

tomcat9 security update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

RabbitMQ 3.7.x < 4.0.13 / 4.1.x < 4.1.2 XSS via Virtual Host Names

The version of RabbitMQ installed on the remote host is affected by a cross-site scripting vulnerability: - Unsanitized virtual host names allow for XSS in the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart. CVE-2026-44839 Note...

Linux Distros Unpatched Vulnerability : CVE-2026-6790

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host...

CVE-2026-6790

In Eclipse Jetty, HTTP/1 requests to HTTP/1.3 (HTTP/2/3 included) do not enforce that the request authority (host and port) matches the Host header when present. This mismatch can affect URI redirects, virtual host selection, reverse proxying, and logs. The issue is described across CVE sources (...

CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

CVE-2026-57221

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and...