CVE-2021-31166

CVE-2021-31166 Perché Recentemente ho scritto un exploit per CVE-2021-31166, sfrutta CVE-2021-31166 e CVE-2021-31166. Un pentester dovrebbe usare https://github.com/mauricelambert/CVE-2021-31166, ma nei team SOC abbiamo bisogno di conoscere la vulnerabilità specifica per correggerla adeguatamente...

CVE-2021-31166

CVE-2021-31166 Rilevamento dei tentativi di sfruttare la vulnerabilità CVE-2021-31166 vulnerabilità dello stack di protocolli HTTP Regola Suricata Pacchetto Zeek Riferimenti https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/...

CVE-2021-31166-Exploit

CVE-2021-31166-Exploit Exploit für die RCE-Schwachstelle im MS-HTTP-Protokollstapel CVE-2021-31166 Eine speziell präparierte HTTP-Anfrage, die auf eine verwundbare Windows-Version abzielt, führt zu einem DoS-Angriff. Der Server wird mit einem Blue Screen neu gestartet. Http.sys ist ein...

Accept Donations with PayPal <= 1.5.2 - Open Redirect

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially...

LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free nel driver http.sys CVE-2022-21907 - Double Free nel driver http.sys Sommario Un attaccante non autenticato può inviare una richiesta HTTP con un header di richiesta HTTP "Accept-Encoding" che innesca un double free nella lista di codifiche sconosciuta all'interno del...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install root@kitploit: $ pip install hsecscan Usage root@kitploit: $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D...

CVE-2019-5418

CVE-2019-5418 Caso di test Esegui: root@kitploit: $ rails s PoC: root@kitploit: Accept: ../../../../../../../../etc/passwd Richiesta 1 - root@kitploit: GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept:...

CVE-2019-5418

CVE-2019-5418 - Divulgazione del contenuto di file su Rails EDIT : questa CVE può portare a un'esecuzione remota di codice, maggiori info: https://github.com/mpgn/Rails-doubletap-RCE Esiste una possibile vulnerabilità di divulgazione del contenuto di file in Action View. Header Accept appositamen...

CVE-2020-27223

CVE-2020-27223 Uso root@kitploit: $ mvn spring-boot:run 9.4.36.v20210114 root@kitploit: $ ./poc/cve-2020-27223-poc1.sh "timens":"58,557","acceptlanguage":"aab" real 0m0.093s 🐇 user 0m0.006s sys 0m0.007s "timens":"18,461,763,438","acceptlanguage":"ahn" real 0m35.339s 🐢 user 0m0.006s sys 0m0.006s...

CVE-2019-5418

CVE-2019-5418 sandbox https://groups.google.com/forum/!msg/rubyonrails-security/zRNVOUhKHrg/GmmcVXcmAAAJ Inizializzazione root@kitploit: $ git clone https://github.com/takeokunn/CVE-2019-5418 $ cd https://github.com/takeokunn/CVE-2019-5418 $ docker-compose up Utilizzo root@kitploit: $ curl...

Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

cve-2022-21907

CVE-2022-21907 Applicazione Golang di 1vere$k CVE-2022-21907 - Double Free nel driver http.sys. Riepilogo Questa è un'applicazione Golang multithreading che consente di effettuare richieste su più target contemporaneamente. Non è molto produttiva con le richieste POST, ma fornisce quasi il 30% di...

CVE-2019-5418

CVE-2019-5418: Ruby on Rails Path Traversal & beliebiges Dateilesen Dieses Projekt ist eine Umgebung zum Üben und Reproduzieren der Local File Inclusion-Schwachstelle CVE-2019-5418 in Ruby on Rails. Die Schwachstelle ermöglicht es, durch Path Traversal über den Accept-Header beliebige Dateien im...

cve-2017-8890-msf

Modulo: Phoenix Talon CVE 2017-8890 Questo potrebbe risolvere il problema 8571, che richiede moduli Phoenix Talon. Panoramica di 2017-8890 Questo CVE: è il membro più grave della classe di vulnerabilità Phoenix Talon del kernel Linux. Nessun POC di questo CVE esiste nell'Exploit DB. Ma altri POC...

CVE-2026-79658

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

CVE-2026-79658

Ech0 versions before 5.0.1 are vulnerable to a denial-of-service attack via the Accept-Language header. The i18n middleware, which runs on every HTTP request, passes the header unfiltered to golang.org/x/text/language.ParseAcceptLanguage. A gap in the CVE-2022-32149 mitigation caps - characters b...

CVE-2026-79658 Ech0 before 5.0.1 Denial of Service via Accept-Language

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

EUVD-2026-65456

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

cve-2022-21907-http.sys

cve-2022-21907-http.sys di 1vere$k CVE-2022-21907 - Doppio Free nel driver http.sys. Sommario Un attaccante non autenticato può inviare una richiesta HTTP con un'intestazione "Accept-Encoding" innescando un doppio free nell'elenco di codifica sconosciuto all'interno dello stack del protocollo HTT...