ABPTTS

A Black Path Toward The Sun TCP tunneling over HTTP for web application servers https://www.blackhat.com/us-16/arsenal.htmla-black-path-toward-the-sun Ben Lincoln, NCC Group, 2016 ABPTTS uses a Python client script and a web application server page/package1 to tunnel TCP traffic over an HTTP/HTTP...

CVE-2025-27558_Patching

CVE-2025-27558Patching 修补影响我 Linux 镜像的 CVE-2025-27558 漏洞。 Atlas 事件：意外的出站连接 197.155.77.1 该文件夹记录了在 Atlas 机器（一个由 Wazuh 监控的 Ubuntu 系统）上检测到的真实网络异常。 在修补 CVE-2025-27558 的例行系统更新期间，Atlas 意外尝试从一个配置错误的 HTTP 镜像 197.155.77.1:80 获取软件包。该服务器公开暴露了目录列表 CPAN/，并返回 404 错误——触发了全面的事件调查。 包含内容...

CVE-2026-48282-coldfusion-rds-detection

CVE-2026-48282 — Adobe ColdFusion RDS 验证与检测 针对 Adobe ColdFusion 远程开发服务（RDS）中 CVE-2026-48282 的实验室验证，重点关注技术证据、事件重建和防御性检测机会。 本仓库记录了一次受控测试，其中利用存在漏洞的 RDS FILEIO 功能向 ColdFusion 应用程序目录写入了一个 CFM 文件。通过 HTTP 调用该文件后，ColdFusion 启动了系统 Shell 并建立了出站连接。由此产生的进程和网络活动已通过 Linux auditd、tcpdump、Docker 遥测、ColdFusion 日志...

CVE-2026-8712 Wyoming < 1.10.2 SSRF via uri Query Parameter

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious uri query parameter to the HTTP API. Attackers can pass arbitrary tcp:// or unix:// URIs...

EUVD-2026-67820

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-78205

BentoML versions 1.4.19 through 1.4.39 are affected by a Server-Side Request Forgery (SSRF) vulnerability. The outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP ranges but fails to reject the RFC 6598 shared address space (100....

CVE-2026-76361

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

PT-2026-63474

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description A MongoDB server may terminate abnormally during the TLS handshake when initiating an outbound TLS connection if it processes a malformed OCSP response from a remote peer. OCSP stapling, a...

EUVD-2026-45494

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg/sendto with MSGFASTOPEN is a combination of connect2 and write2: it opens the connection in the SYN. apparmorsocketsendmsg only checks AAMAYSEND, so a profil...

CVE-2026-55599 phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access

phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature reads a URL out of that certificate's Authority Information Access AIA extension and connects to it...

MAL-2026-4698 Malicious code in use-context-selector-tony (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dde262b1fecc08fe5853c4ec7ada6c3c3746a6e7afb5bd18c33d5adfa03843c This package is a name-squat of the popular use-context-selector library and ships a postinstall script dist/postinstall.js / src/postinstall.js that...

CVE-2026-35036

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview editor fetches a page title through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts ...

Linux Distros Unpatched Vulnerability : CVE-2026-27446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Authentication for Critical Function CWE-306 vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Co...

CVE-2026-26322

OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Gateway tool accepted a tool-supplied gatewayUrl without sufficient restrictions, which could cause the OpenClaw host to attempt outbound WebSocket connections to user-specified targets. This requires the ability to...

Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 in Real-World Attacks

CrowdStrike on Monday said it's attributing the exploitation of a recently disclosed security flaw in Oracle E-Business Suite with moderate confidence to a threat actor it tracks as Graceful Spider aka Cl0p, and that the first known exploitation occurred on August 9, 2025. The malicious activity...

EUVD-2025-20335

Malicious code in bioql PyPI...

📄 Microsoft Windows XRM-MS NTLM Hash Disclosure

Microsoft Windows suffers from another NTLM hash disclosure vulnerability. This time it is related to the xrm-ms file type. + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: https://hyp3rlinx.altervista.org/advisories/MicrosoftWindowsxrm-msFileNTLM-HashDisclosure.tx...

SUSE CVE-2024-32475

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when settin...

CVE-2024-32475 Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when settin...

Cloudflare Tunnel increasingly abused by cybercriminals

Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. Cybercriminals are increasingly using this service to keep their activities from being detected. Cloudflare Tunnel, also known by its executable name, Cloudflared,...