321 matches found
browser-pwn
Browser-Pwn 브라우저 세계는 4개의 주요 플레이어가 지배하고 있습니다: Chromium/Chrome Blink 엔진 Firefox Gecko 엔진 Safari WebKit 엔진 Edge Blink 엔진 구 EdgeHTML 엔진 다음 내용은 두 부분으로 나뉩니다: 아키텍처와 구현을 이해하고 소스에서 빌드하는 데 도움이 되는 정보 계산기 실행 기능을 찾는 데 도움이 되는 정보 목차 1. 엔진 개요 Chromium Firefox Safari Edge 2. 익스플로잇 개요 Chromium Firefox Safari Edge ...
beef
Copyright c 2006-2026 Wade Alcorn - [email protected] Browser Exploitation Framework BeEF - https://beefproject.com Vedi il file 'doc/COPYING' per i permessi di copia =============================================================================== Cos'è BeEF? BeEF è l'acronimo di The Browser...
CVE-2019-0567-MS-Edge
CVE-2019-0567-MS-Edge POC Una prova di concetto per MS Edge come esercizio per imparare lo sfruttamento del browser e le migrazioni presentate sulla macchina Windows 10. Tutto il codice è stato creato da Connor McGarr e modificato per funzionare su Windows 10 build 15063.483. shell2js.py Il mio...
beef
=============================================================================== root@kitploit: Copyright c 2006-2026 Wade Alcorn - [email protected] Browser Exploitation Framework BeEF - https://beefproject.com See the file 'doc/COPYING' for copying permission...
CVE-2026-81092
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...
CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...
CVE-2026-81099
Timescale's tiger-slack failed to enable the DNS-rebinding-protection option when starting its MCP HTTP transport in mcp/src/httpServer.ts, leaving the host allow-list disabled. This allowed a malicious web page to use DNS rebinding to steer requests to the locally bound Slack MCP server through ...
ServiceNow-CVE-2025-11449-CVE-2025-11450-Mitigation-Script
Script de Mitigação ServiceNow CVE-2025-11449 e CVE-2025-11450 Visão Geral Este script detecta e corrige automaticamente as vulnerabilidades de segurança CVE-2025-11449 e CVE-2025-11450 em UI Macros do ServiceNow. Essas vulnerabilidades podem permitir a execução arbitrária de código nos navegador...
JShell
JShell JShell - Ottieni una shell JavaScript con XSS. Utilizzo Esegui shell.py e JShell tenterà automaticamente di rilevare il tuo indirizzo IP, la LPORT predefinita è 33. Come puoi vedere, il payload è stato generato e ora tutto ciò che devi fare è consegnare questo payload alla vittima. Non...
CVE-2018-5146
CVE-2018-5146 的 exploit 和 PoC poc.ogg ：file PoC creato da noi cve-test2.html ：file exploit crctest.exe：calcola il crc32 dei file ogg...
Browser-Pwning-
Browser-Pwning Una documentazione adeguata e ben strutturata per iniziare con il chrome pwning & il v8 pwning Struttura del documento Come è organizzato questo documento 1. Motivazione 2. Materiale di Studio Reale Motivazione I browser sono una delle tecnologie più utilizzate oggi. Su ogni comput...
CVE-2026-76252 Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user...
Hacking Safari with GPT 5.4
When Anthropic unveiled Mythos and Project Glasswing, the reaction was immediate and polarized. Some dismissed it as fear-driven marketing, while others treated it as a credible shift in the threat landscape. Like with many things, the truth is probably somewhere in the middle. I wanted to test...
Smoothwall Express Cross-Site Scripting Vulnerability (CNVD-2026-14349)
Smoothwall Express is Smoothwall open source a GNU/Linux-based firewall operating system . Smoothwall Express cross-site scripting vulnerability , the vulnerability stems from the portfw.cgi script multiple parameters of the user-supplied data lack of effective filtering and escaping , an attacke...
Esri ArcGIS Server 跨站脚本漏洞
Esri ArcGIS Server is a web-oriented enterprise software platform available for providing geolocation services from Esri. A cross-site scripting vulnerability exists in Esri ArcGIS Server version 11.4 and earlier, which stems from a stored cross-site scripting issue that could lead to malicious...
CVE-2025-34399
MailEnable versions prior to 10.54 are affected by a reflected XSS in the AddressesCc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesCc value is not properly sanitized for GET requests and is echoed inside a [removed] block in the JavaScript variable sAddrCc, enabling an attack...
Docker MCP Gateway 安全漏洞
Docker MCP Gateway is a gateway service from Docker Inc. in the United States. A security vulnerability exists in Docker MCP Gateway version 0.27.0 and earlier, which stems from vulnerability to DNS rebinding attacks when running in sse or streaming transport mode, and could lead to browser-based...
EUVD-2025-34748
Stored cross-site scripting XSS vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser...
CVE-2025-10552
The CVE-2025-10552 entry describes a stored Cross‑site Scripting (XSS) vulnerability in 3DSwym on the 3DEXPERIENCE platform (R2025x). The vulnerability affects 3DSwym prior to Release R2025x and allows an attacker to execute arbitrary script in a user’s browser session. The PT-2025-41765 advisory...