2423 matches found
xencrypt
Xencrypt PowerShell crypter v 1.0 Authors Xentropy @SamuelAnttila SecForce @SECFORCELTD If you want to read about the design behind this tool and how to make your own crypter, there's an article I wrote about it here: Write a crypter in any language Note Don't be a script kiddie, I made this GPLv...
CVE-2026-20660
CVE-2026-20660 PoC Bundle This folder packages a standalone proof-of-concept for: CVE-2026-20660 CFNetwork NSGZipDecoder path traversal via gzip FNAME Impact on vulnerable macOS Safari with auto-open enabled 1. Directory Layout server.py: Main PoC server with configurable traversal depth and...
Swego
Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...
Imperva_gzip_bypass
Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...
dnsteal
dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...
Powshell-decode-payload
decode powershell gzip code sal a New-Object;a IO.StreamReadera IO.Compression.GZipStreamIO.MemoryStreamConvert::FromBase64String'xxxx',IO.Compression.CompressionMode::Decompress,Text.Encoding::ASCII.ReadToEnd sal a New-Object;a IO.StreamReadera...
decoder-plus-plus
Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...
Imperva_gzip_WAF_Bypass
Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...
pdfminer.six CVE-2025-64512 polyglot RCE
CVE-2025-64512: malicious gzip+PDF polyglot deserializes pickle when a service runs pdf2txt/pdfminer on attacker-uploaded files. !/usr/bin/env python3 -- coding: utf-8 -- """pdfminer.six CVE-2025-64512 pickle polyglot PDF gzip RCE.""" from future import annotations import gzip import pickle from...
SUSE CVE-2026-111181
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...
Echo: Decompress permits unbounded gzip expansion in v4
Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or...
DEBIAN-CVE-2026-115638
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...
CVE-2026-115638
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...
CVE-2026-115638
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...
CVE-2026-115638
OpenStack Ironic versions through 39.0.1 are vulnerable to a denial of service (DoS) attack. The root cause is the improper handling of highly compressed data (CWE-409), specifically allowing a gzip bomb via a configdrive that expands into an excessive amount of uncompressed data. No specific rem...
CVE-2026-115638
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...
EUVD-2026-108570
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...
UBUNTU-CVE-2026-90797
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3...
