zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

browsertunnel

browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...

JSONBee

JSONBee A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...

CSPBypass

CSP 绕过 欢迎使用 CSPBypass.com ，一款旨在帮助道德黑客绕过限制性内容安全策略（CSP）并利用 XSS（跨站脚本）漏洞的工具，适用于注入被仅允许某些白名单域的 CSP 所阻止的站点。 网站 访问 CSPBypass.com 搜索现成的 CSP 绕过 gadget，帮助您实现 XSS，或贡献您自己的发现。 离线使用 构建 Docker 镜像并在本地运行，以通过捆绑的数据集提供静态 UI： root@kitploit: docker build -t cspbypass . docker run --rm -p 8080:80 cspbypass 浏览到...

cspparse

cspparse 説明 cspparse は、コンテンツセキュリティポリシー（CSP）を評価するためのツールです。Google の API を使用して CSP ヘッダーを取得し、ReconJSON 形式で出力します。Google の API によるヘッダーチェックだけでなく、対象サイトの HTML を解析して タグで指定された CSP ルールも検出します。 インストール Go Get によるインストールコマンドとソースコードのダウンロード cspparse コマンドは $GOPATH/bin にインストールされ、ソースコード（https://github.com/lc/cspparse...

CVE-2020-6519

这最初发布于 PerimeterX 公司官方 Github，经由我的 工作 Github 账号。 尽管这是我的工作成果 - 所有权利和法律问题均归 PerimeterX 公司所有。 Chromium 83 零日漏洞：跨平台完整 CSP 绕过 CVE-2020-6519 Exploit DB 技术文章 POC（报告给 chromium 项目） 演示视频!...

CVE-2020-6519

Chromium 83 零日漏洞 完整 CSP 绕过 跨平台 CVE-2020-6519 技术文章 POC（正如向 chromium 项目所报告的） 演示视频！...

CVE-2026-55630

Kiwi TCMS versions prior to 16.1 are vulnerable to stored XSS through the TestCase.extra_link and TestPlan.extra_link fields, which accepted unsanitized user input and rendered it verbatim, allowing injection of a javascript: URI. In default deployments using official Docker images or unmodified ...

CVE-2026-54477

CVE-2026-54477：管理面板缺少安全标头（点击劫持 / XSS） 公告 字段| 值 ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03（Gardyn IoT Hub） CVSS 3.1| 5.4（中危） 向量（3.1）| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 向量（4.0）| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CWE（CISA 分配）| CWE-644（HTTP 标头脚本语法中和不当）...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Content Security Policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been resolved through improved state management. This issue is fixed in Safari 17.4, iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4. Processing maliciously crafted web content may prevent the Content Security...

Astra Linux – Vulnerability in Firefox and Thunderbird

The Enhanced Tracking Protection’s Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS attacks through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames disguised as legitimate content. This...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security policy through a malicious Chrome Extension...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the content security policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been resolved through improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1, iPadOS 15.1, watchOS 8.1, and tvOS 15.1. Processing maliciously crafted web content may lead to unexpected unenforced Content Security Policies...

Astra Linux – Vulnerability in Chromium

In the Content Security Policy of Google Chrome prior to version 149.0.7827.53, a bypass of the content security policy was possible when a remote attacker used a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in jsoup

jsoup is a Java HTML parser designed for HTML editing, cleaning, scraping, and XSS Cross-Site Scripting protection. However, jsoup may incorrectly sanitize HTML containing javascript: URLs, which could allow XSS attacks when a user clicks on those links. If the non-default...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved checks. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, and watchOS 11.1. Processing maliciously crafted web content may prevent the Content Security Policy from...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been addressed through improved state management. This issue is fixed in iOS 15.3, iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, and macOS Monterey 12.2. Processing maliciously crafted web content may prevent the Content Security Policy from being enforced...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Subresource Integrity in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via malicious network traffic. Chromium security severity: Medium...