dscanner

dScanner 🔍 Herramienta automatizada de reconocimiento web para auditorías de seguridad Descripción dScanner consolida múltiples herramientas de reconocimiento en un solo comando para la fase inicial de pentesting web. Solo usar con sistemas autorizados!!!! 🚀 Instalación Dependencias requeridas:...

mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing

A flaw was found in modauthopenidc, an OpenID Connect Relying Party module for Apache HTTP servers. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed state cookie. This can lead to an out-of-bounds read and a one-byte out-of-bounds write...

Important: Red Hat Security Advisory: mod_auth_openidc:2.3 security update

An update for the modauthopenidc:2.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Open-Source-Seal-Security

PROJET SEAL SECURITY : Tâche d'ingénieur Open Source Créer une nouvelle version du package tough-cookie V2.5.0, pour corriger la vulnérabilité critique CVE-2023-26136, projet écrit en Node.js V20 Les versions du package tough-cookie antérieures à 4.1.3 sont vulnérables à la pollution de prototype...

Exploit for Session Fixation in Zammad

CVE-2026-102489 - The Cookie in the Error Message PoC materia...

tough-cookie-2.5.0-cve-2023-26136-fix

Correction de CVE-2023-26136 pour tough-cookie 2.5.0 Aperçu de la mission Ce projet corrige CVE-2023-26136 , une vulnérabilité critique de pollution de prototype dans les versions de tough-cookie antérieures à 4.1.3. La vulnérabilité affecte l'application web de Penguin Software Inc., qui utilise...

CVE-2024-40510

CVE-2024-40510 Vulnérabilité de Cross Site Scripting dans openPetra v.2023.02 via la fonction serverMCommon.asmx. Description : Un utilisateur non authentifié peut voler les cookies d'un utilisateur authentifié en exploitant une XSS dans openPetra v.2023.02 via la fonction serverMCommon.asmx...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300 : Vulnérabilité de script intersite XSS persistante dans la plateforme SaaS Coohom Date de divulgation : 2025-10-28 Dernière mise à jour : 2025-10-28 Signalé par : Phisit Pupiw Fournisseur : Coohom CWE : CWE-79 – Cross-Site Scripting Résumé Une...

PT-2026-107679

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

Rocky Linux 10.2 [CIQ] Security Update: mod_auth_openidc / mod_auth_openidc-debuginfo / etc (crlsa-2026_75581)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675581 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 Tenable has extracted the preceding description block direct...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2026:77369)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77369 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an...

PT-2026-107684

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.13 AsyncHttpClient versions prior to 2.16.1 Description The ThreadSafeCookieStore component validates Domain attributes using domain matching but fails to reject public suffixes. This allows a host located...

PT-2026-107678

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.1.0 through 3.0.13 Description The enabled-by-default cookie store in the AsyncHttpClient library replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contributes any cookie...

CVE-2026-49975

CVE-2026-49975 Bombe HTTP/2 ★ CVE-2026-49975 PoC de la Bombe HTTP/2 ★ Aperçu CVE-2026-49975 est une vulnérabilité Denial of Service DoS dans Apache HTTP Server. La vulnérabilité se produit dans le chemin de traitement des requêtes HTTP/2, où plusieurs champs d'en-tête cookie peuvent être fusionné...

CVE-2026-100725

A flaw was found in http4k-core. The client-side cookie storage mechanism fails to enforce standard scoping rules for domain, path, and secure transmission attributes. When an application communicates with multiple destinations using a single cookie store, cookies intended for one server can be...

CVE-2023-26136

Recherche sur la vulnérabilité CVE-2023-26136 Description Les versions du paquet tough-cookie antérieures à 4.1.3 sont vulnérables à la pollution des prototypes en raison d'une gestion incorrecte des cookies lors de l'utilisation de CookieJar en mode rejectPublicSuffixes=false. Ce problème provie...