CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913

The CVE-2026-66913 vulnerability affects Lookyloo when processing uploaded captures and API submissions containing gzip/zlib-compressed HAR data. The root cause is unbounded decompressed size during in-memory processing of ZIP/gzip/zlib content, enabling a zip bomb to exhaust memory and disrupt s...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

Malicious code in @zalastax/nolb-har_ (npm)

The package @zalastax/nolb-har was found to contain malicious code...

Malicious code in @zalastax/nolb-har- (npm)

The package @zalastax/nolb-har- was found to contain malicious code...

MAL-2025-11941 Malicious code in @zalastax/nolb-har_ (npm)

The package @zalastax/nolb-har was found to contain malicious code...

MAL-2025-11938 Malicious code in @zalastax/nolb-har (npm)

The package @zalastax/nolb-har was found to contain malicious code...

Malicious code in @zalastax/nolb-har (npm)

The package @zalastax/nolb-har was found to contain malicious code...

MAL-2025-11939 Malicious code in @zalastax/nolb-har- (npm)

The package @zalastax/nolb-har- was found to contain malicious code...

Malicious code in pupeteer-har (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29c5aec1082b7aaaca7ba03715be8a3319d84027ef3fff58e5d808622a6bc074 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10389 Malicious code in pupeteer-har (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29c5aec1082b7aaaca7ba03715be8a3319d84027ef3fff58e5d808622a6bc074 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

How to Export Console and HAR File

Purpose This article documents how to generate a HAR file HTTP Archive to provide additional diagnostic information when investigating issues for web-based applications e.g., Veeam Software Appliance, Veeam Backup & Replication Web UI, Veeam Service Provider Console, Veeam Recovery Orchestrator,...

Okta breach happened after employee logged into personal Google account

Okta has revealed details about a recent breach which exposed files belonging to customers. As we explained in our article about 1Password being a victim of this breach, it’s normal for Okta support to ask customers to upload a file known as an HTTP Archive HAR file. Having this file allows the...

Okta's Recent Customer Support Data Breach Impacted 134 Customers

Identity and authentication management provider Okta on Friday disclosed that the recent support case management system breach affected 134 of its 18,400 customers. It further noted that the unauthorized intruder gained access to its systems from September 28 to October 17, 2023, and ultimately...

Okta's Support System Breach Exposes Customer Data to Unidentified Threat Actors

Identity services provider Okta on Friday disclosed a new security incident that allowed unidentified threat actors to leverage stolen credentials to access its support case management system. "The threat actor was able to view files uploaded by certain Okta customers as part of recent support...

Noir - An Attack Surface Detector Form Source Code

Noir is an attack surface detector form source code. Key Features Automatically identify language and framework from source code. Find API endpoints and web pages through code analysis. Load results quickly through interactions with proxy tools such as ZAP, Burpsuite, Caido and More Proxy tools...

har-cert.com Cross Site Scripting vulnerability OBB-3212635

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Access to XMLHTTPRequest at <URL> from origin <URL>has been blocked by CORS policy

When navigating to load balanced VIP, 'Cannot Complete Your Request' is seen .HAR file will showAccess to XMLHTTPRequest at from origin has been blocked by CORS policy...

@hola.org/har-validator (=2.0.6-hola.1), @hola.org/request (>=2.67.0-hola.5 <=2.67.0-hola.6) +46 more potentially affected by CVE-2018-1107 via is-my-json-valid (>=2.10.1 <=2.17.1)

is-my-json-valid NPM version =2.10.1, =2.67.0-hola.5, =2.67.0-lum.3, =1.0.1, =1.2.0, =1.0.0, =0.4.0, =1.0.0, =0.4.1, =0.0.1, =0.0.10 - fsa-creator =0.1.1 - geojsonvalidator =0.0.1 and more Source cves: CVE-2018-1107 Source advisory: OSV:GHSA-4HPF-3WQ7-5RPR...