Lucene search
+L

162 matches found

Kitploit
Kitploit
added 2026/09/15 3:36 a.m.7 views

rapid-reset-check

Rapid Reset Check rapid-reset-check は、HTTP/2 を公開しているため CVE-2023-44487 の緩和策レビューが必要な HTTPS エンドポイントを迅速に棚卸しするための小さな Go CLI です。 このスキャナは意図的に非悪用型です。各ターゲットを解決し、証明書を検証した TLS 接続を開き、ALPN を通じて h2 と http/1.1 を提示し、ピアが選択したものを記録して接続を閉じます。HTTP リクエスト、HTTP/2 接続プリアンブル、ストリーム、RSTSTREAM フレーム、フラッドトラフィックは一切送信しません。...

7.5CVSS7AI score0.99999EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/11 7:05 a.m.8 views

quicmap

quicmap かなり高速なQUICサービススキャナー quicmapは、QUICサービス、使用中のプロトコルバージョン、サポートされているALPNを識別するために複数のツールを使う必要をなくす、比較的高速なQUICサービススキャナーです。 主な機能 任意のホスト、IPアドレス、ネットワーク、ポートをスキャンし、QUICサービスを識別します 任意の数のスレッドで実行できます(デフォルトは50) プロセスを高速化するためのALPNのバイナリサーチに対応 素敵なプログレスバー! インストール root@kitploit: git clone...

6AI score
SaveExploits0
RedHat Linux
RedHat Linux
added 2026/09/11 5:08 a.m.8 views

openssl: SSL_select_next_proto buffer overread

A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSLselectnextproto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called...

9.1CVSS0.05582EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/09/10 7:13 a.m.10 views

CVE-2026-23918-Passive-Audit

CVE-2026-23918 감사 스크립트 대안으로 curl을 사용해 헤더를 가져와서 살짝 들여다볼 수도 있지만, 여기에 더 나은 방법이 있습니다: Apache HTTP Server를 위한 비침습적 HTTP 메타데이터 감사 도구 CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19 노출 분류. 이 도구는 일반 HTTP HEAD/GET 요청을 보내고 TLS ALPN 협상을 수행하여 HTTP/2 지원 여부를 관찰합니다. 요구 사항 Python 3.13 이상...

8.8CVSS8.1AI score0.49727EPSS
SaveExploits18
RedHat Linux
RedHat Linux
added 2026/08/26 1:58 p.m.8 views

openssl: SSL_select_next_proto buffer overread

A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSLselectnextproto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called...

9.1CVSS7.1AI score0.05582EPSS
SaveExploits1References5
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.6 views

Astra Linux – Vulnerability in Thunderbird, Firefox

When using Alt-Svc, ALPN failed to properly validate certificates when the original server was redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6...

4CVSS6.6AI score0.00226EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/24 3:05 a.m.14 views

openssl: SSL_select_next_proto buffer overread

A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSLselectnextproto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called...

9.1CVSS7.1AI score0.05582EPSS
SaveExploits1References5
OSV
OSV
added 2026/07/06 11:11 a.m.15 views

OESA-2026-2821 nodejs security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

7.5CVSS6.6AI score0.03762EPSS
SaveExploits0References4
F5 Networks
F5 Networks
added 2026/06/30 3:45 p.m.17 views

K000161969: Go vulnerability CVE-2025-58189

Security Advisory Description When Conn.Handshake fails during Application-Layer Protocol Negotiation ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped. CVE-2025-58189 Impact An attacker may be able to inject controlled...

5.3CVSS6.5AI score0.00436EPSS
SaveExploits0Affected Software3
UbuntuCve
UbuntuCve
added 2026/06/25 10:17 p.m.12 views

CVE-2026-11703

Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...

7.5CVSS6.1AI score0.00359EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/25 9:15 p.m.10 views

CVE-2026-11703 Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption

Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...

6CVSS6.1AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.25 views

PT-2026-52591

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue exists where SNI Server Name Indication and ALPN Application-Layer Protocol Negotiation bindings are missing during stateful session-ID resumption. This...

7.5CVSS5.7AI score0.00359EPSS
SaveExploits0References7
AstraLinux
AstraLinux
added 2026/06/24 3:11 p.m.16 views

Astra Linux – Vulnerability in Node.js

A flaw in Node.js’ TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback is used. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling mechanisms such as tlsClientError and error, causing either...

7.5CVSS7.1AI score0.01097EPSS
SaveExploits0References3
GithubExploit
GithubExploit
added 2026/05/05 9:52 a.m.336 views

Exploit for Double Free in Apache Http_Server

☣️ CVE-2026-23918-Elite-Auditor ☣️ Professional Intelligenc...

8.8CVSS5.8AI score0.49727EPSS
SaveExploits18
OSV
OSV
added 2026/04/17 6:31 a.m.73 views

GHSA-8R5M-3F66-QPR3 HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0,...

5.3CVSS5.7AI score0.00345EPSS
SaveExploits0References4
NVD
NVD
added 2026/04/17 4:16 a.m.37 views

CVE-2026-5052

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0,...

8.6CVSS0.00345EPSS
SaveExploits0References1
CVE
CVE
added 2026/04/17 2:55 a.m.316 views

CVE-2026-5052

Vault’s PKI engine ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges, creating potential SSRF and information disclosure against internal targets. The issue affects Vault Community Edition up to 2.0.0 and Vault Enterprise up to 2.0.0, as well as 1.21.5, ...

8.6CVSS5.8AI score0.00345EPSS
SaveExploits0References1Affected Software1
Vulnrichment
Vulnrichment
added 2026/04/17 2:55 a.m.16 views

CVE-2026-5052 Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0,...

5.3CVSS5.8AI score0.00345EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/04/14 5:14 p.m.7 views

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security bypass in Golang Go - crypto/tls (CVE-2025-58189)

Summary IBM Watson Speech Services Cartridge is vulnerable to a security bypass in Golang Go - crypto/tls, due to Conn.Handshake fails during ALPN negotiation CVE-2025-58189. Golang Go - crypto/tls is used in our speech-utilities. This vulnerabilitiy has been addressed. Please read the details fo...

5.3CVSS7AI score0.00436EPSS
SaveExploits0Affected Software1
Microsoft CVE
Microsoft CVE
added 2026/04/14 2:00 p.m.63 views

HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers

CVE-2026-21637 is regarding a vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths tlsClientError...

7.5CVSS7.1AI score0.01097EPSS
SaveExploits0
Rows per page
Query Builder