CVE-2017-12542-Exploit

HP iLO Contournement d'authentification CVE-2017-12542 Ce dépôt contient un exploit de preuve de concept pour CVE-2017-12542 , une vulnérabilité de contournement d'authentification affectant certaines versions du firmware HP Integrated Lights-Out iLO. Cette vulnérabilité permet un accès non...

GO-2026-6603 HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

GO-2026-6609 Lack of limit on size of parsed Range headers in net/http

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

GO-2026-6608 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

DEBIAN-CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

DEBIAN-CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

EUVD-2026-95321

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

CVE-2026-107715 Mechanize sends credential headers to another host after an HTTP redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

CVE-2026-107715

The Mechanize library (prior to version 2.14.1 ) is vulnerable to a credential leakage issue where caller-supplied headers are sent to an unintended host following an HTTP redirect. The root cause is that Mechanize::HTTP::Agent#request_add_headers reapplies request_headers= even after Mechanize::...

CVE-2026-107715 Mechanize sends credential headers to another host after an HTTP redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

EUVD-2026-95320

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

CrossSiteContentHijacking

PoC-проект межсайтового перехвата контента данных XSCH Лицензия Распространяется под лицензией AGPL см. LICENSE для получения дополнительной информации. Описание Этот проект можно использовать для демонстрации proof-of-concept PoC следующих видов атак: Эксплуатация веб-сайтов с небезопасными...

jwt-reauth

JWT Re-auth Плагин для Burp, который кэширует токены аутентификации с URL «auth», а затем добавляет их в качестве заголовков ко всем запросам, попадающим в заданную область scope. Возможности Плагин позволяет передавать ему настройки через контекстные меню из различных меню. Это включает...

cve-2026-22732-demo

Démo CVE-2026-22732 Reproduction minimale de CVE-2026-22732 — les en-têtes de réponse HTTP de Spring Security sont silencieusement supprimés lorsque le code du contrôleur écrit directement dans la réponse du servlet. La vulnérabilité Spring Security utilise l'écriture « paresseuse » des en-têtes...

CVE-2025-55315-Scanner-Monitor

Scanner de vulnérabilité CVE-2025-55315 et proxy TLS Ce dépôt contient des outils pour détecter et surveiller les applications ASP.NET Core vulnérables à la CVE-2025-55315, qui implique un trafic de requêtes HTTP HTTP request smuggling dû à des en-têtes HTTP conflictuels. Outils inclus 1. Scanner...

CVE-2026-21710

CVE-2026-21710 — Déni de service Node.js req.headersDistinct Résumé Champ| Valeur ---|--- ID CVE| CVE-2026-21710 Publié| 2026-03-30 CVSS v3.1| 7.5 ÉLEVÉ AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE| CWE-770 — Allocation de ressources sans limites ni limitation Versions concernées| Node.js 20.x, 22.x,...

dovecot: Dovecot: Denial of service via crafted email headers

A flaw was found in dovecot. A remote attacker can craft a malicious email with an excessive number of email addresses or MIME parameters in its headers. When a user attempts to read this message over IMAP, the parsing process consumes an inordinate amount of memory, leading to the termination of...

log4j2-CVE-2021-45046

تطبيق Log4j2 عينة قابل للاختراق CVE-2021-45046 الإصدارات المتأثرة: جميع الإصدارات من 2.0-beta9 إلى 2.15.0 يعتمد هذا التطبيق على تطبيق ويب Spring Boot قابل للاختراق بواسطة CVE-2021-45046 يستخدم Log4j 2.14.1 عبر spring-boot-starter-log4j2 2.6.1. تشغيل التطبيق قم بتشغيله: Import the project in Java...