100 matches found
CVE-2000-0649
CVE-2000-0649 CVE-2000-0649 is a low risk vulnerability that can potentially disclose the internal IP addresses of the server. Official details are here: Rapid7 CVE NIST This particular vulnerability became of interest to me because it seems to affect current NGINX and some Apache setups as well...
Remote-Integer-Overflow-Vulnerability
Nginx : Remote-Integer-Overflow-Vulnerability This Repository consists of an older yet existing Nginx vulnerability named "Remote Integer Overflow Vulnerability CVE-2017-7529". The Vulnerability is for Older Nginx servers 1.13. Exception is for Nginx 1.12 Set-up : Download sys library and request...
CVE-2026-114729
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes "to", "from" and values for URIs, but not "by"; so markup such as in an HTML message caused remote content to be loaded without the user...
Linux Distros Unpatched Vulnerability : CVE-2026-114729
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes...
MAL-2026-17896 Malicious code in xapi-lib (npm)
[email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which i...
MAL-2026-17437 Malicious code in @bluewin/utils (npm)
@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...
CVE-2026-76203
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
CVE-2026-76203 CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
EUVD-2026-62416
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
HTTP Internal IP Disclosure
Looks for private RFC1918 / link-local addresses in HTTP headers and body NSE http-internal-ip-disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Internal IP disclosure in HTTP responses NSE http-internal-ip-disclosure.""" from kittysploit import from lib.protocols.http.httpclient import...
BSPHP - Information Disclosure Detection
Information disclosure in BSPHP Pro causing user and unauth IP disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Information disclosure in BSPHP Pro causing user and unauth IP disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...
EUVD-2026-45194
Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers ca...
CVE-2026-35142
HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal...
CVE-2026-42447
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...
CVE-2026-33357
CVE-2026-33357 affects Meari client applications that embed com.meari.sdk, including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label
CVE-2026-45182
GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let systemserver transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" a...
CVE-2025-55276
HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout...
CVE-2025-55276 HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability
HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout...
CVE-2025-55276: Exposure of Sensitive Information to an Unauthorized Actor
HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout...