Arkhota

Arkhota, веб-брутфорсер для Android Что? Arkhota — это веб-брутфорсер HTTP/S для ОС Android. Зачем? Веб-брутфорсер всегда есть на компьютере хакера по очевидным причинам. Иногда атаки требуют быстроты и/или минимальной подготовки устройства. Кроме того, телефон привлекает меньше внимания, чем...

HTTP-revshell

Powershell HTTP/S Reverse Shell HTTP-revshell — это инструмент, ориентированный на упражнения Red Team и пентестеров. Данный инструмент обеспечивает обратное соединение через протокол http/s. Он использует скрытый канал для получения контроля над машиной жертвы посредством веб-запросов, обходя...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect

A flaw was found in curl. When an OAuth2 bearer token is used for an HTTPS transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the .netrc file, allowing the bearer token intended for the first host to be sent to the...

UBUNTU-CVE-2026-62987

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

EUVD-2026-79944

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...

EUVD-2026-78581

Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTPS content. A remote unauthenticated attacker can send a specially crafted HTTPS request to a specific endpoint that is processed incorrectly, causing the...

CVE-2026-89025: Improper Handling of Exceptional Conditions

Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTPS content. A remote unauthenticated attacker can send a specially crafted HTTPS request to a specific endpoint that is processed incorrectly, causing the...

Linux Distros Unpatched Vulnerability : CVE-2026-90461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-90461: Improper Restriction of Communication Channel to Intended Endpoints

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

PT-2026-49898

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. A low privileged attacker with network access via HTTPS can...

CVE-2018-25236: Improper Authentication

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTPS management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests...

CVE-2024-14034: Improper Authentication

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTPS management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTPS requests. Attackers can exploit improper authentication...

DNSdist -- vulnerabilities

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html reports: CVE-2026-0396: HTML injection in the web dashboard CVE-2026-0397: Information disclosure via CORS misconfiguration CVE-2026-24028: Out-of-bounds read when parsing DNS packets via Lua CVE-2026-24029: DN...

CVE-2026-3783: Insufficiently Protected Credentials

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...

EUVD-2024-54079

Malicious code in bioql PyPI...

CVE-2025-50200: Insertion of Sensitive Information into Log File

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which...

CVE-2025-48865: Insufficient Verification of Data Authenticity

Fabio is an HTTPS and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and...

CrushFTP 11.3.1 - Authentication Bypass

Exploit Title: CrushFTP 11.3.1 - Authentication Bypass Date: 2025-05-15 Exploit Author: @İbrahimsql Exploit Author's github: https://github.com/ibrahimsql Vendor Homepage: https://www.crushftp.com Software Link: https://www.crushftp.com/download.html Version: =2.28.1 , colorama=0.4.6 ,...