2427 matches found
filebuster
Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...
gvision
GVision은 Google Cloud Vision API를 사용하여 이미지에서 랜드마크와 웹 엔터티를 감지하고, 빠르고 쉽게 유용한 정보를 수집할 수 있도록 도와주는 역방향 이미지 검색 앱입니다. https://user-images.githubusercontent.com/37483725/228700363-cc0d8131-4134-4f37-918e-1a342dd22b83.mp4 🤖 Google Cloud Vision API 소개 Google Cloud Vision API는 머신러닝 기반 이미지 분석 서비스로, 개발자에게 이미지...
msploitego
msploitego - The Pentesting suite for Maltego THIS IS A BETA RELEASE, please be nice and report any issues Whats New New Features Now supporting multiple workspaces for Metasploit via Postgres queries A bash script that runs tons of auxiliary modules against targets. Really 'fattens' up the...
Journyx - XML External Entities Injection (XXE)
The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...
Rukovoditel <= 3.2.1 - Cross Site Scripting
A stored cross-site scripting XSS vulnerability in the Global Entities feature /index.php?module=entities/entities of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity"...
EUVD-2026-92113
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString strips tags before decoding entities and runs twice via setTitle and save, attackers ca...
[SECURITY] Fedora 45 Update: sgml-common-0.6.3-70.fc45
The sgml-common package contains a collection of entities and DTDs that are useful for processing SGML, but that don't need to be included in multiple packages. Sgml-common also includes an up-to-date Open Catalog file...
MAL-007
MAL-007: WSO2 ESB의 로컬 레지스트리 항목을 통한 XML 외부 엔티티 WSO2 ESB의 “Local Entities” 도구에서 인라인 XML 외부 엔티티XXE 공격이 확인되었습니다. CVE가 없는 이유는? 공급업체는 이 취약점이 "WUM에서 수정Fixed in WUM"되었다고 답변했으며, 이에 대한 공개 공시는 이루어지지 않았습니다. 요구 사항: 이 취약점을 악용하려면 다음이 필요합니다: 유효한 사용자 자격 증명 개념 증명PoC: 자세한 내용과 악용 과정은 이 PDF에서 확인할 수 있습니다...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Expat vulnerabilities (USN-8813-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8813-1 advisory. It was discovered that Expat did not correctly handle certain integer arithmetic...
USN-8813-1 expat vulnerabilities
It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411 It was discovered that Expat did not correctly track handler cal...
CVE-2026-61570
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...
EUVD-2026-84820
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...
CVE-2026-85680
The Ultimate Member WordPress plugin (versions before 2.13.1 ) is vulnerable to an unauthenticated stored XSS flaw. The root cause is the failure to escape values derived from user-supplied profile names before they are output in the page title, combined with the decoding of HTML entities after s...
CLEANSTART-2026-DL82237 Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities
Security vulnerability affects the wildfly package. Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities...
CVE-2026-81897: Cross-Site Request Forgery (CSRF)
In Concrete CMS below CMS 9.5.3, the savecontrol action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled...
Astra Linux – Vulnerability in libxml2
A issue was discovered in libxml2 before version 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logical errors. In one case, a double-free can occur...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Mark invalid entities with id UVCINVALIDENTITYID According to UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID. Each unit and terminal within the video function is assigned a uniqu...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The striptags method and the striptags template filter are vulnerable to a potential denial-of-service attack due to certain inputs containing large sequences of nested incomplete HTML entities...
Astra Linux – Vulnerability in netcdf
A issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxmlparse functions improperly handle XML entities, resulting in an infinite loop where memory allocation occurs...