589 matches found
aura
Dieses Repository wurde an einen neuen Ort verschoben: https://github.com/SourceCode-AI/aura Sicherheitsüberprüfung und Code-Introspection Über das Problem Der aktuelle Trend in der Entwicklung besteht darin, viele Pakete in der Entwicklungsphase zu verwenden, selbst wenn sie nur triviale...
GraphCrawler
GraphCrawler THE GraphQL automated testing tookit Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. Version 1.2 is out!! NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e'...
graphicator
Graphicator Graphicator é um "raspador" / extrator de GraphQL. A ferramenta itera sobre o documento de introspecção retornado pelo endpoint GraphQL alvo e, em seguida, reestrutura o esquema em um formato interno para poder recriar as consultas suportadas. Quando essas consultas são criadas, elas...
graphicator
Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...
CVE-2024-28397
CVE-2024-28397 Exploit per l'Escape dalla Sandbox di js2py - CodePartTwo - HTB Un codice exploit in Python per CVE-2024-28397 , una vulnerabilità critica in js2py = 0.74 che consente l'escape dalla sandbox e l'esecuzione remota di codice. 🚨 Dettagli della Vulnerabilità ID CVE : CVE-2024-28397...
icebox
IceBox Icebox is a Virtual Machine Introspection solution that enable you to stealthily trace and debug any process kernel or user. It's based on project Winbagility. Files which might be helpful: INSTALL.md: how to install icebox. BUILD.md: how to build icebox. Demo Project Organisation fdp: Fas...
icebox
IceBox Icebox è una soluzione di Virtual Machine Introspection che ti consente di tracciare e fare debug furtivamente di qualsiasi processo kernel o utente. Si basa sul progetto Winbagility. File che potrebbero essere utili: INSTALL.md: come installare icebox. BUILD.md: come compilare icebox. Dem...
CVE-2025-27407
CVE-2025-27407 GitLab Podman लैब GitLab Direct Transfer HTTP पथ कमज़ोर graphql-ruby introspection स्कीमा लोडर तक पहुँचता है, इसे साबित करने के लिए यह एक न्यूनतम केवल-स्थानीय लैब है। यह लैब एक कमज़ोर GitLab CE कंटेनर चलाती है; PoC स्क्रिप्ट परीक्षण के दौरान केवल प्रक्रिया-में in-process अपना नकली...
SuiteCRM Unauthenticated Graphql Introspection
Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...
js2py-Sandbox-Escape-CVE-2024-28397-RCE
CVE-2024-28397 Exploit di Escape della Sandbox js2py Una raccolta di script di exploit che mirano alla vulnerabilità di escape della sandbox js2py CVE-2024-28397 che consente l'esecuzione arbitraria di codice tramite introspezione di oggetti Python. 🔍 Panoramica della Vulnerabilità La libreria...
applepie
applepie, un'implementazione di hypervisor per Bochs Ciao! Benvenuto in applepie! Questo è uno strumento progettato per fuzzing, introspezione e ricerca di bug! È un hypervisor che utilizza l'API Windows Hypervisor Platform presente nelle versioni recenti di Windows in particolare è stato...
batchql
BatchQL BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet,...
pe-sieve
Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...
CVE-2024-40094
CVE-2024-40094 ENF ExecutableNormalizedFields Denial-of-Service-Exploit Dieses Skript nutzt die Schwachstelle CVE-2024-40094 in graphql-java aus, indem es einen ExecutableNormalizedFields ENF -basierten Denial-of-Service auslöst. Es erstellt eine manipulierte GraphQL-Introspection-Abfrage mit tie...
BIT-KEYCLOAK-2026-37979 Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect OIDC token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other...
graphql-threat-matrix
GraphQL Threat Matrix Why graphql-threat-matrix? graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the...
graphql-cop
GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...
Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to IBM WebSphere Application Server Liberty (CVE-2024-40094)
Summary IBM WebSphere Application Server Liberty is vulnerable to denial of service attack. These vulnerabilities affect IBM Spectrum Control Vulnerability Details CVEID:CVE-2024-40094 DESCRIPTION: GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENF...
Authentication Bypass
org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...
