scrying

NCC Group Scrying A new tool for collecting RDP, web and VNC screenshots all in one place This tool is still a work-in-progress and should be mostly usable but is not yet complete. Please file any bugs or feature requests as GitHub issues Motivation Since Eyewitness recently dropped support for R...

squid

SQUID 웹 프록시 캐시 http://www.squid-cache.org/ 저작권 C 1996-2026 Squid 소프트웨어 재단 및 기여자들 Squid 소프트웨어는 GPLv2+ 라이선스 하에 배포되며, 수많은 개인 및 단체의 기여를 포함합니다. 자세한 내용은 COPYING 및 CONTRIBUTORS 파일을 참조하십시오. 지원을 위해 다음 리소스를 사용하십시오: 일반 도움말 및 지원: [email protected] 공개 버그 리포트: https://bugs.squid-cache.org/ 보안 버그 리포트:...

HTTPLeaks

HTTPLeaks 이게 뭐야? 이 프로젝트는 웹사이트가 HTTP 요청을 유출할 수 있는 모든 가능한 방법을 나열하는 것을 목표로 합니다. 단 하나의 HTML 파일 안에 포함되어 있습니다. 이 저장소의 루트에 있는 leak.html 파일원문 텍스트 버전을 참조하세요. 용도는? 이것을 사용하여 브라우저의 CSP 누출 , 웹 메일러의 HTTP 누출 및 태양이 비치지 않는 곳으로 HTTP 요청을 보내서는 안 되는 모든 것을 테스트할 수 있습니다. "HTTP 누출"이란, 특정 HTML 요소와 속성의 조합이 외부 리소스에 대한 요청을...

stegowiper

stegoWiper: A powerful and flexible active attack for disrupting stegomalware Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Pand...

WebFEET

Web フィルタ外部列挙ツール WebFEET WebFEET NCC Group Plc によりオープンソースとして公開 - http://www.nccgroup.com/ 開発者: Ben Williams https://github.com/nccgroup/webfeet AGPL のもとで公開されています。詳細は LICENSE を参照してください WebFEET は、Web セキュリティプロキシとポリシーのドライブバイ列挙（drive-by enumeration）を行う Web アプリケーションです。関連ホワイトペーパー:...

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

UBUNTU-CVE-2026-71310

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

Summary The shared HTTP CONNECT helper parses a proxy response with http.ReadResponse over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor...

CVE-2026-71310

The CVE affects the rclone project before version 1.75.0, where the shared HTTP CONNECT helper in lib/proxy/http.go incorrectly parses proxy CONNECT responses using http.ReadResponse over an unrestricted reader. This unbounded parsing enables a malicious or on-path proxy to send oversized headers...

CLSA-2026-1784596275 TuxCare security update for http-proxy-middleware (3 CVEs)

TuxCare rebuilt http-proxy-middleware to address 3 CVEs. Fixed in 1.3.1-tuxcare.1...

CLSA-2026-1776299658 TuxCare security update for http-proxy-middleware (1 CVE)

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.18.0-tuxcare.1...

Updated libvncserver packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Out-of-Bounds Read in HandleUltraZipBPP due to unchecked subrectangle count. CVE-2026-32853 NULL pointer dereferences in httpd proxy handlers via malformed CONNECT/GET requests. CVE-2026-32854 LibVNCClient Tight Gradient decoding allows...

UBUNTU-CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

UBUNTU-CVE-2026-67289

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

EUVD-2026-51840

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

PT-2026-64428

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists where libsoup incorrectly attaches the Proxy-Authorization header to HTTPS requests sent through a CONNECT tunnel established via an HTTP proxy. This behavior allows the...

CVE-2026-12547

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

Updated rsync package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Rsync 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write. CVE-2026-29518 Rsync 3.4.3 Authorization Bypass via Hostname Resolution. CVE-2026-43617 Rsync 3.4.3 Integer Overflow Information Disclosure. CVE-2026-43618 Rsync 3.4.3...