vimana-framework

Overview Vimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to assess, fuzz, and analyze Python projects through automated and manual techniques. Core Capabilities: Vulnerability detection and...

OWASP-VWAD

OWASP-VWAD 2024-10-26 ⚠️ このリポジトリは終了に向けて縮小中です。今後の作業は www-project-vulnerable-web-applications-directory を介して行ってください。 OWASP Vulnerable Web Applications Directory Project（VWAD、https://owasp.org/www-project-vulnerable-web-applications-directory/）は、現在利用可能な既知の脆弱性を持つWebアプリケーションの包括的かつ適切にメンテナンスされたレジストリです。...

ios11-cookie-set-expire-issue

iOS 11 쿠키 설정/만료 문제 iOS 11 홈 화면 웹 앱에서 쿠키 설정 및 만료에 간헐적인 문제가 있는 것으로 보입니다. 두 가지 오류 동작이 관찰될 수 있습니다: 쿠키가 설정된 후 앱을 닫았다가 다시 열면, 앱을 다시 열었을 때 쿠키가 더 이상 존재하지 않을 수 있습니다 쿠키가 만료된 후 앱을 닫았다가 다시 열면, 앱을 다시 열었을 때 쿠키가 여전히 존재할 수 있습니다 재현 단계: 1. Mobile Safari에서...

kiterunner

Kiterunner 소개 오랫동안 콘텐츠 디스커버리는 파일과 폴더를 찾는 데 집중되어 왔습니다. 이 접근 방식은 정적 파일을 호스팅하거나 부분 경로에 대해 3xx 응답을 반환하는 레거시 웹 서버에는 효과적이지만, 최신 웹 애플리케이션, 특히 API에는 더 이상 효과적이지 않습니다. 시간이 지남에 따라 더 큰 단어 목록을 사용할 수 있도록 콘텐츠 디스커버리 도구를 더 빠르게 만드는 데 많은 시간이 투자되었지만, 콘텐츠 디스커버리의 기술 자체는 혁신되지 않았습니다. Kiterunner는 기존의 콘텐츠 디스커버리를 매우 빠른 속도로...

yasuo

YASUO @0xsauby 설명 Yasuo는 취약한 타사 웹 애플리케이션을 스캔하는 Ruby 스크립트입니다. 네트워크 보안 평가내부, 외부, 레드팀 작업 등를 하다 보면 공개된 취약점을 악용하여 원격 서버를 손상시킬 수 있는 취약한 타사 웹 애플리케이션이나 웹 프론트엔드를 자주 발견하게 됩니다. 일반적이고 인기 있는 애플리케이션으로는 Apache Tomcat 관리 인터페이스, JBoss jmx-console, Hudson Jenkins 등이 있습니다. Exploit-db을 검색해보면 수많은 웹 애플리케이션/프론트엔드에 존재하는...

atomicvulns

⚠️ Intentionally vulnerable. Run locally only. Never expose to the internet or a shared network. Read this in other languages: Português Brasil What is atomicvulns? Milestone — v1.0: the web series now covers all ten OWASP Top 10 2021 categories A01–A10 , across 38 atoms. See the v1.0 release...

web-inf-path-trav

WebXMLExp.py Java Webアプリケーションにおけるパストラバーサル脆弱性の悪用を支援するツールです。 このツールは、Invicti Securityのホワイトペーパー Java Webアプリケーションにおけるパストラバーサル脆弱性の悪用 で紹介されています。 インストール このツールにはPython3が必要です。 次のコマンドを実行してください: pip install -r requirements.txt 使用方法: インストール後、以下のようにエクスプロイトURLを指定してください: usage: python WebXMLExp.py...

Azure-App-Tools

Azure-App-Tools Azureアプリケーションで使用するツールのコレクション。 https://azure.microsoft.com/en-us/get-started/apps/ 前提条件 Azure PowerShell モジュール https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0 例: 動的デバイスコード @MrUn1k0d3r によるオリジナルPoC...

CVE-2026-83148: Improper Privilege Management

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Test Manager for Web Apps privilege with network access via HTTP to compromise Oracle Application Testing Suite. Successful...

CVE-2026-83149: Improper Access Control

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Test Manager for Web Apps privilege with network access via HTTP to compromise Oracle Application Testing Suite. While the...

ROS-20260915-73-0149

The vulnerability of Web apps for Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260915-73-0197

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

ROS-20260914-73-0047

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge is related to the use of functions with non-standard implementations. Exploiting this vulnerability can allow an attacker to cause a service failure using a malicious file...

ROS-20260911-73-0112

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge is related to the lack of data security mechanisms. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

UBUNTU-CVE-2026-88059

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge is related to the lack of data security mechanisms. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge is related to the use of functions with non-standard implementations. Exploiting this vulnerability can allow an attacker to cause a service failure using a malicious file...

The vulnerability of the Web apps components of Google Chrome and Microsoft Edge browsers allows a hacker to trigger a service failure.

The vulnerability of Web apps for Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-70866: Improper Access Control

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Load Testing for Web Apps privilege with logon to the infrastructure where Oracle Application Testing Suite executes to...