210 matches found
backcookie
backcookie Small backdoor using cookie. ========== Example one: python backcookie.py -u http://target.com/shell.php -c namecookie Example two: python backcookie.py --url http://target.com/shell.php --cookie namecookie Custom command binfo, You get objective information @pwned:$ binfo Custom comma...
TendaSpill
TendaSpill An exploitation tool to extract passwords using CVE-2015-5995. CVE-2015-5995 Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header...
EUVD-2026-125515
PLANET GS-5220-8P2T2S hardware version 3.0 firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstaxauth HTTP Cookie value that is copied into a fixed-size stack buff...
CVE-2026-109445
The PLANET GS-5220-8P2T2S (hardware version 3.0) is affected by a stack-based buffer overflow in firmware versions prior to 3.2412b261008 . The vulnerability exists because the system copies an oversized webstax_auth HTTP Cookie value into a fixed-size stack buffer without performing proper lengt...
PT-2026-146866
Name of the Vulnerable Software and Affected Versions PLANET GS-5220-8P2T2S hardware version 3.0 versions prior to 3.2412b261008 Description A stack-based buffer overflow occurs when the device processes an oversized webstax auth HTTP Cookie value. This happens because the value is copied into a...
Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2025_2872)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20252872 advisory. python-tornado: Tornado has HTTP cookie parsing DoS vulnerability CVE-2024-52804 Tenable has extracted the preceding description block directly from the CIQ securit...
Rocky Linux 9 [CIQ] Security Update: python3-tornado / python3-tornado-debuginfo (crlsa-2024_10590)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202410590 advisory. python-tornado: Tornado has HTTP cookie parsing DoS vulnerability CVE-2024-52804 Tenable has extracted the preceding description block directly from the CIQ securi...
Rocky Linux 9 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2025_2471)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20252471 advisory. python-tornado: Tornado has HTTP cookie parsing DoS vulnerability CVE-2024-52804 Tenable has extracted the preceding description block directly from the CIQ securit...
CVE-2026-18607 Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow
A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation o...
CVE-2026-18607 Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow
A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation o...
CVE-2026-18607
The CVE-2026-18607 affects Wavlink devices including WN572, WN570H, WN573, WN529, WN530, WN531, WN535, WN536, WN551, WN557, and NU516 (firmware up to 20260609). The vulnerability targets the strcpy function in lighttpd’s file upload.cgi, where manipulating the HTTP_COOKIE argument triggers a stac...
Apache Struts2 S2-008 RCE Detection
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. !/usr/bin/env python3 -- coding: utf-8...
USN-8018-3: Python 2.7 vulnerabilities
USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672, CVE-2026-0865 for python3. This update provides the corresponding updates for python2.7. Original advisory details: Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly use this iss...
OPENSUSE-SU-2026:10349-1 ruby4.0-rubygem-http-cookie-1.0.8-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-http-cookie-1.0.8-1.3 package on the GA media of openSUSE Tumbleweed...
USN-8018-1 python3.14, python3.13, python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly use this issue to inject arbitrary headers into email messages. This issue only affected python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and...
CVE-2019-11668
HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51,...
CVE-2019-25278: Cleartext Transmission of Sensitive Information
FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform man-in-the-middle attacks to capture HTTP cookie authentication information during network communication...
Amazon Linux 2023 : oci-add-hooks (ALAS2023-2025-1273)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1273 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...