679 matches found
memoro
Memoro Memoro is a highly detailed heap profiler. Memoro not only shows you where and when your program makes heap allocations, but will show you how your program actually used that memory. Memoro collects detailed information on accesses to the heap, including reads and writes to memory and when...
EUVD-2026-110928
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized that allows unauthenticated visitors to read /clockwork/ profiler data via a loopback REMOTEADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting...
eos
Enemies Of Symfony EOS EOS loots information from a Symfony target in debug mode: Section| Description ---|--- General| Get general information about the target. Phpinfo| Extract Symfony environment variables from the exposed phpinfo. Routes| Get the list of registered routes. Request logs| Look...
Invisi-Shell
Invisi-Shell Hide your powershell script in plain sight! Invisi-Shell bypasses all of Powershell security features ScriptBlock logging, Module logging, Transcription, AMSI by hooking .Net assemblies. The hook is performed via CLR Profiler API. Work In Progress This is still a preliminary version...
CVE-2026-32722
CVE-2026-32722 Bloomberg Memray’s Stored XSS via Unescaped Command-Line Metadata Intro I found this issue while reviewing Memray , Bloomberg’s Python memory profiler, with a simple question in mind: Can attacker-controlled runtime metadata cross into browser-rendered report output unsafely? In th...
Ashwesker-CVE-2025-60021
🛑 CVE-2025-60021 — Apache bRPC Remote Command Injection 📌 Overview CVE-2025-60021 is a critical remote command injection vulnerability found in the heap profiler built-in service /pprof/heap of Apache bRPC versions earlier than 1.15.0 , allowing unauthenticated attackers to run arbitrary OS...
elpscrk
Elpscrk - v2.0 An Intelligent common user-password profiler that's named after the same tool in Mr.Robot series S01E01 😄 In simple words, elpscrk will ask you about all info you know about your target then will try to generate every possible password the target could think of, it all depends on t...
Symfony Profiler - Remote Access via Injected Arguments
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...
CVE-2021-21424
CVE-2021-21424 Directory Traversal and file exposure • CVE-2021-21424 • Description: WebProfiler exposes internal server paths if it is not disabled in production. • Affected versions: Symfony 2.8 to 5.x. • Typical bypass: direct access to /appdev.php/profiler/. Summary of CVE-2021-21424 • CVE:...
CVE-2026-86147
External control of file name or path and uncontrolled resource consumption in Apache bRPC version 1.18.0 on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the...
PT-2026-120567
External control of file name or path and uncontrolled resource consumption in Apache bRPC version 1.18.0 on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the...
CVE-2026-48496
A flaw was found in OpenTelemetry eBPF Profiler. An unprivileged process can exploit this vulnerability by causing the profiler to open a nonregular mapping file, such as a FIFO First-In, First-Out, which leads to the profiler blocking indefinitely. This prevents further ELF Executable and Linkab...
CVE-2026-109325
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...
CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...
CVE-2026-109325
The Grav CMS (versions 2.0.22 through 2.1.7) contains an authentication bypass vulnerability within the Clockwork profiler component. The root cause is that the profiler trusts loopback REMOTE_ADDR values, allowing unauthenticated attackers positioned behind a same-host HTTP proxy to bypass secur...
CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...
CVE-2026-109325: Exposure of Sensitive Information to an Unauthorized Actor
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...
memoro
Memoro Memoro es un perfilador de montón heap altamente detallado. Memoro no solo te muestra dónde y cuándo tu programa realiza asignaciones de montón, sino que también te mostrará cómo tu programa realmente utilizó esa memoria. Memoro recopila información detallada sobre los accesos al montón,...
EUVD-2026-89481
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...
