567 matches found
Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...
Interceptor
Interceptor Autor: @Cerbersec Interceptor es un driver de kernel centrado en alterar soluciones EDR/AV en espacio de kernel mediante el parcheo de callbacks del kernel y el enganchado hooking de IRPs. Interceptor fue creado como parte de unas prácticas en el Red Team de NVISO Security. Las...
Espionage
Espionage - 一个用于Linux的网络流量拦截器 被收录于 关于 Espionage Espionage 是一个网络数据包嗅探器，用于拦截通过接口传输的大量数据。该工具允许用户运行常规和详细流量分析，实时显示流量，揭示数据包方向、协议、标志等信息。Espionage 还可以进行 ARP 欺骗，因此目标发送的所有数据都将通过攻击者（MiTM）重定向。Espionage 支持 IPv4、TCP/UDP、ICMP 和 HTTP。Espionage 使用 Python 3.8 编写，但也支持 3.6 版本。这是该工具的第一个版本，如果您想贡献代码为 Espionage...
CVE-2026-17033
Grafana OSS is vulnerable to a stored cross-site scripting (XSS) flaw in how it handles external Alertmanager alerts. An authenticated attacker with Editor access or alert.instances.external:write can submit an alert containing a crafted generatorURL field. Grafana renders this value directly as ...
EUVD-2026-64774
Micrometer-instrumented Apache HttpAsyncClient 4.x or 5.x usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response e.g. connection resets or timeouts. Tracking state for these requests remains in memory indefinitely, and...
apk-interceptor
apk-interceptor Android 深层链接、Intent 和 WebView 桥接评估辅助工具 apk-interceptor 是一个专为授权应用安全评估而设计的便携式 Android 测试 APK。它帮助安全工程师验证 Android 应用如何处理外部入口点，例如自定义 URI 方案、深层链接、导出的 Activity 和 WebView JavaScript 桥接。 该工具有意受限： 它不声明 android.permission.INTERNET 它不向外部服务器发送数据 它不执行 Shell 命令 它不需要 root、Magisk、Frida 或运行时插桩...
Important: nodejs24
Issue Overview: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant...
CVE-2026-19928 OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be...
CVE-2026-19928
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be...
PT-2026-73074
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be...
PT-2026-72883
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...
Node.js Module Undici 7.x < 7.29.0 / 8.x < 8.9.0 Information Disclosure
The nodejs module Undici detected on the host is version 7.x prior to 7.29.0 or 8.x prior to 8.9.0. It is, therefore, affected by a vulnerability: - undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, ...
Malicious code in llm-interceptor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7 On npm install, postinstall.js unconditionally runs runSetup which wires the package into the installer's AI tooling and stands up long-lived...
MAL-2026-13370 Malicious code in llm-interceptor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7 On npm install, postinstall.js unconditionally runs runSetup which wires the package into the installer's AI tooling and stands up long-lived...
MAL-2026-12830 Malicious code in bigops-activity-headers-interceptor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 276084c74a91d1e2369091a4da29068c4c3c46b3e1cc782a2fcbbf1d4261e9ec On require'bigops-activity-headers-interceptor', index.js loads helpers.js which auto-invokes start. The module fetches a platform-specific binary fr...
CVE-2026-14643
A flaw was found in undici. The cache interceptor in undici improperly handles optional whitespace around the equals sign in no-cache or private Cache-Control directives. This vulnerability allows an attacker to bypass cache restrictions, leading to cross-user information disclosure. Specifically...
CVE-2026-16728
A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to...
CVE-2026-13697
A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813...