Corsy

Corsy Сканер неправильных конфигураций CORS Введение...

CVE-2019-17633

CVE-2019-17633 Eclipse CheのCSRFによるRCE このバグにより、リモートのウェブサイトが、ユーザーがウェブページを訪問した際に、バージョン7.3.0以前および7.4.1以前のCheを実行しているマシン上で任意のDockerコンテナを作成・起動できるようになります。 脆弱性 これはCSRFバグであり、リモートのウェブサイトが、スタンドアロンモードでEclipse...

CVE-2026-55419

Reachy Mini (an SDK by Pollen Robotics for controlling Reachy Mini robots) prior to 1.8.2 exposes the /api/media/sounds/upload endpoint without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS (allow_ori...

CVE-2019-9580

CVE-2019-9580 - CORS null origin을 악용하여 RCE를 달성하는 StackStorm 2.9.3 및 2.10.3 미만 2.10.3/2.9.3 이전에는 요청의 origin을 알 수 없는 경우 null을 반환했습니다. null은 일부 클라이언트에서 알 수 없는 origin으로부터의 요청이 성공하도록 만들 수 있습니다. 이로 인해 StackStorm API에 대한 XSS 스타일 공격이 가능해집니다. 발견자: Barak Tawily 및 Anna Tsibulskaya Firefox 사용자는 피해자, Chrome...

CORStest

CORStest Простой сканер ошибок конфигурации CORS Основано на исследованияхJames Kettle CORStest — это быстрый и грязный инструмент на Python 3 для поиска ошибок конфигурации Cross-Origin Resource Sharing CORS. В качестве входных данных принимает текстовый файл, который может содержать список...

CVE-2025-55462

CVE-2025-55462 취약점 요약 Eramba Community 및 Enterprise Edition v3.26.0에서 CORSCross-Origin Resource Sharing 설정 오류가 확인되었습니다. 애플리케이션이 /system-api/login 엔드포인트에서 Access-Control-Allow-Origin 응답 헤더에 공격자가 제어하는 Origin 헤더를 반영하면서 동시에 Access-Control-Allow-Credentials: true를 설정합니다. 이 구성은 유효한 자격 증명이 제공될 경우 교차 출처 ...

SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - バージョン 2020.7 Damstra Smart Asset 2020.7 の API/api/Version で問題が発見されました。 クロスオリジンリソースシェアリングは、任意の 'Origin: example.com' ヘッダーを受け入れ、200 OK とワイルドカードの 'Access-Control-Allow-Origin: ' ヘッダーで応答することにより、ランダムなオリジンを信頼します。 HTTP リクエスト: GET /API/api/Versi...

fast-security-scanners

Fast security scanners/checks A small contribution to community : We use all these tools in security assessments and in our vulnerability monitoring service Check your domain for DNS NS takeover Repo docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover Cach...

of-CORS

of-CORS of-CORS — это набор инструментов Truffle Security для выявления и эксплуатации некорректных настроек CORS во внутренних сетях целей программ bug bounty с помощью тайпсквоттинга. Подробнее можно прочитать здесь https://trufflesecurity.com/blog/of-CORS Как это работает?? of-CORS — это...

CVE-2025-34291_cors_security_scanner

CVE-2025-34291corssecurityscanner Легковесный инструмент на Python для оценки безопасности, предназначенный для обнаружения опасных ошибок конфигурации CORS Cross-Origin Resource Sharing — CVE-2025-34291. root@kitploit: Сканер безопасности CORS Легковесный инструмент на Python для оценки...

Astra

Astra Тестирование безопасности REST API на проникновение сложно из-за постоянных изменений существующих API и добавления новых. Astra может использоваться инженерами по безопасности или разработчиками как неотъемлемая часть их процесса, чтобы они могли обнаруживать и устранять уязвимости на ранн...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

CVE-2026-53656

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-53656

FiftyOne (open-source visual AI dataset platform) versions prior to 1.17.0 unconditionally set Access-Control-Allow-Origin: * on its locally running, unauthenticated App/API server. Because the /media endpoint accepts a filesystem path parameter, a malicious website can issue cross-origin request...

EUVD-2026-64145

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

langflow-cors-scanner

CVE-2025-34291 — Langflow オリジン検証 / CORS 概要 過度に寛容なCORS設定と、リフレッシュトークンのCookie設定が組み合わさることで、資格情報の窃取が可能になります。...

halo-cve-2026-67919

URL을 통한 halo 플러그인 RCE halo 콘솔을 사용하면 관리자가 URL을 붙여넣어 플러그인을 설치하거나 업그레이드할 수 있습니다. 임의의 URL을 가져와 jar를 설치하며, jar의 코드가 서버에서 실행됩니다. 스킴 검사도, 호스트 검사도 없고 리디렉션을 따라가며, 플러그인 관리자는 jar에서 확장 클래스를 직접 로드합니다. 이것은 cve-2026-67919install-from-uri / upgrade-from-uri, cve-2026-67920migration restore, cve-2026-67921csrf/co...

CVE-2026-63407

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin c...

CVE-2026-75482

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...