EUVD-2026-94639

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk...

discuz-ml-rce

discuz-ml-rce 영향을 받는 시스템 및 버전: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 취약점 원인: Discuz!ML 시스템이 cookie의 l로 전달되는 language 매개변수 내용을 필터링하지 않아 문자열 연결이 발생하고, 이를 통해 PHP 코드가 실행됩니다. cookie 필드에 xxxxxxxxlanguage 필드가 나타납니다. 근본 원인은 바로 이 필드에 인젝션이 존재하여 발생하는 RCE입니다. 패킷을 캡처하여 cookie의 language 값을 다음과 같이 수정합니다...

chromecookiestealer

Chrome 쿠키 도용기 및 주입기 Chrome의 원격 DevTools 프로토콜을 사용하여 Chrome에 연결하고 쿠키를 도용/주입/삭제/제거합니다. 다음에 크게 영감을 받았습니다: WhiteChocolateMacademiaNut. 쿠키는 Chrome 자체 형식을 사용하여 JSON 객체로 덤프됩니다. 로드할 쿠키에도 동일한 형식이 사용됩니다. 합법적인 용도로만 사용하십시오. 기능 Chrome의 쿠키 덤프 덤프된 쿠키를 다른 인스턴스의 Chrome에 주입 Chrome의 쿠키 삭제 컴파일 시 기본값 설정 가능 빠른 시작 피해자의 ...

CVE-2026-107280

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

DEBIAN-CVE-2026-107280

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

CVE-2026-107280

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

CVE-2026-107280

Removed by vendor...

CVE-2026-107280

The AsyncHttpClient (AHC) library for Java applications is vulnerable to a cookie injection or overwriting issue in versions prior to 3.0.13 and 2.16.1 . The root cause is that the ThreadSafeCookieStore component validates Domain attributes using domain matching but fails to reject public suffixe...

CVE-2026-107280 AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

PT-2026-107684

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 쿠키를 통한 저장형 XSS CVE-2026-5513 — Bookly ≤ 27.2 쿠키를 통한 저장형 XSS CVE CVSS 유형 인증 https://t.me/FreeToolsCpa CVE 파일 그룹 내 개요 필드| 값 ---|--- CVE ID| CVE-2026-5513 취약점 유형| 저장형 크로스 사이트 스크립팅 XSS 플러그인| Bookly — 온라인 예약 및 약속 예약 시스템 영향을 받는 버전| ≤...

CVE-2023-25292

CVE-2023-25292 Intermesh BV Group-Office 버전 6.6.145의 반사형 크로스 사이트 스크립팅XSS 취약점으로, 공격자가 GOLANGUAGE 쿠키를 통해 권한을 상승시키고 민감한 정보를 획득할 수 있습니다. 취약점 세부 정보 제품: Group Office Application 버전: 6.6.145 취약점 유형: Reflected XSS 심각도: Medium CVSS v3.1 점수: 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 취약점 설명 이 애플리케이션은...

Web-Penetration-Test

Web-Penetration-Test WordPress 취약점CVE-2025-34077 악용, 쿠키 주입을 통한 인증 우회, 루트 권한 상승. 사이버 보안 전문 과정의 일부입니다. Day 1: 첫 번째 웹사이트 해킹하기 실습 보고서: 'BigWear' 서버 악용 사이버 보안 여정의 첫 번째 세션에서 저는 신화에서 벗어났습니다. 보안 취약점을 식별하기 위해 수학 천재나 전문 프로그래머가 될 필요가 없다는 것을 배웠습니다. 필요한 것은 창의력, 논리력, 그리고 견고한 방법론 입니다. 단계별: 'BigWear' 침해 저는...

Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (crlsa-2023_5763)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235763 advisory. curl: a heap-based buffer overflow in the SOCKS5 proxy handshake CVE-2023-38545 curl: cookie injection with none file CVE-2023-38546 Tenable has extracted...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1789899690)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789899690 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2024_1601)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241601 advisory. curl: information disclosure by exploiting a mixed case flaw CVE-2023-46218 curl: more POST-after-PUT confusion CVE-2023-28322 curl: cookie injection with...

CentOS Linux 7 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS7:CLSA-2023:1697463947)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2023:1697463947 advisory. - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785564870)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785564870 advisory. - A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785847606)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785847606 advisory. - A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785564870)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785564870 advisory. - A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same...