75 matches found
pe_to_shellcode
petoshellcode 将PE转换为可以像普通Shellcode一样注入的格式。 （同时，输出文件仍然是一个有效的PE）。 支持32位和64位PE文件 作者：@hasherezade 和 @hh86 目标 本项目的目标是提供一种生成PE文件的方法，使其能够以最小的努力进行注入。 它的灵感来自Stephen Fewer的ReflectiveDLLInjection - 但不同之处在于，使用pe2shc可以在编译后添加反射加载存根。 此外，PE文件的头部被修改，使得您可以从头开始执行注入的缓冲区 - 就像处理Shellcode一样。 它将自动找到存根，并继续加载完整的PE。 项目范围 🟢...
CVE-2023-35813
CVE-2023-35813 CVE-2023-35813 是一个概念验证（PoC），用于通过分析服务器响应头的修改来判断 Sitecore 实例是否存在漏洞。 用爱制作 by heretic 3...
CVE-2025-29927-Sigma-Rule
CVE-2025-29927 报告 概述 CVE-2025-29927 是 Next.js 中间件中的一个安全漏洞，允许攻击者通过修改特定的 HTTP 请求头来绕过身份验证。 漏洞利用 攻击者可以发送带有 x-middleware-subrequest: middleware 请求头的请求来绕过身份验证。 检测 检测策略包括： 监控 HTTP 请求头中可疑的 x-middleware-subrequest 值。 实施 Sigma 规则以检测未经授权的请求。 在 Next.js 应用程序中为中间件操作启用日志记录。 缓解措施 将 Next.js 升级到最新的已修复版本。 实施严格的请求头验...
CVE-2026-81680
opensslencrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silent...
EUVD-2026-67036
opensslencrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silent...
CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal
opensslencrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silent...
CVE-2026-81680
openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files. An attacker with write access to the file header can delete recovery-slot fields and bypass authentication without re-encrypting the payload, silently removing recovery paths the ...
Security Bulletin: IBM Event Streams is vulnerable to unintended response header modification
Summary IBM Event Streams is vulnerable to unintended response header modification due to a flaw in the on-headers module CVE-2025-7339 Vulnerability Details CVEID:CVE-2025-7339 DESCRIPTION: on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers...
CVE-2026-22779
BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests e.g. insert a new...
CVE-2025-23191
Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the atom:link values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacke...
Security Bulletin: IBM DataPower Gateway vulnerable to Denial of Service.
Summary The CVE may result in headers being modified in internal NodeJS traffic which could lead to a denial of service. Vulnerability Details CVEID:CVE-2025-7339 DESCRIPTION: on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions 1.1.0 ma...
EUVD-2021-10786
Malware in sbrugna...
EUVD-2007-6470
Malware in sbrugna...
EUVD-2021-15624
Malware in sbrugna...
EUVD-2006-0638
Malware in sbrugna...
EUVD-2008-2002
Malware in sbrugna...
EUVD-2018-3184
Malware in sbrugna...
EUVD-2013-1916
Malware in sbrugna...