54 matches found
Detect_polyfill_CVE-2024-38537-
DetectpolyfillCVE-2024-38537 Aquí tienes un script de Python que comprueba si el dominio polyfill.io está presente en la cabecera de la Política de Seguridad del Contenido CSP de una aplicación web determinada. Pasos: 1.Guarda el script modificado checkcspfromfile.py en el mismo directorio que tu...
Clickjacking-Exploit-Detector
Clickjacking-Exploit-Detector El Clickjacking Exploit Detector utiliza técnicas de escaneo de páginas web para identificar posibles vulnerabilidades y proporcionar análisis de esos elementos. Características Escaneo de HTML: Comprueba elementos HTML y elementos iframe que pueden ser explotados pa...
domains-from-csp
domains-from-csp Un script de Python para extraer nombres de dominio de la cabecera CSP Un script para extraer nombres de dominio de cabeceras de Content Security PolicyCSP La salida se imprime en stdout por ahora Demostración Capturas de pantalla Dependencia de paquetes de terceros requests clic...
CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...
CVE-2026-52873: Improper Neutralization of Input During Web Page Generation
Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the...
CVE-2025-31983 HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header
HCL BigFix Service Management SM is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting XSS and potential exposure of sensitive information...
CVE-2025-31983
HCL BigFix Service Management SM is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting XSS and potential exposure of sensitive information...
CVE-2025-31983: Improperly Implemented Security Check for Standard
HCL BigFix Service Management SM is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting XSS and potential exposure of sensitive information...
HCL BigFix Service Management 安全特征问题漏洞
HCL BigFix Service Management is an IT service management and asset management platform developed by the Indian company HCL. HCL BigFix Service Management SM has security vulnerabilities, particularly related to incorrect security configurations of the CSP header. These vulnerabilities may allow...
PT-2026-37636
HCL BigFix Service Management SM is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting XSS and potential exposure of sensitive information...
CVE-2018-21030
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document...
EUVD-2019-0093
Malware in sbrugna...
EUVD-2022-46693
Malicious code in bioql PyPI...
EUVD-2023-38095
Malicious code in bioql PyPI...
CVE-2023-33969
Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting XSS allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP...
CVE-2024-30250
Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid integrity attributes to...
GHSA-C4GR-Q97G-PPWC In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists
Impact Versions from 1.2.0 to 1.3.1 of Astro-Shield allow to bypass the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believ...
In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists
Impact Versions from 1.2.0 to 1.3.1 of Astro-Shield allow to bypass the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believ...
Improper Neutralization Of Special Elements In Output Used By A Downstream Component ('Injection')
Astro-Shield is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection'. The vulnerability is caused due to inadequate validation of user-controlled content, potentially allowing the inclusion of malicious resources in the generated CSP heade...
