111 matches found
log4py
log4py pythonic pure python RCE exploit for CVE-2021-44228 log4shell 1. run a vulnerable service like https://github.com/zzzz0317/log4j2-vulnerable-spring-app 2. change settings in exploit.py 3. pwn This is for educational use only mostly for my own lol This might only be useful after some...
paramiko
|version| |python| |license| |ci| |coverage| .. |version| image:: https://img.shields.io/pypi/v/paramiko :target: https://pypi.org/project/paramiko/ :alt: PyPI - Package Version .. |python| image:: https://img.shields.io/pypi/pyversions/paramiko :target: https://pypi.org/project/paramiko/ :alt:...
python-ecdsa
Pure-Python ECDSA and ECDH This is an easy-to-use implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman, implemented purely in Python, released und...
flopz
Flopz - Firmware Liberation on Python Flopz is an assembler toolkit written in pure python. Use it to: Create shellcode for embedded systems Dynamically patch large collections of binaries Instrument firmware images, for debugging and fuzzing Currently, Flopz supports: ARM: Thumb Mode PPC: VLE,...
machofile
machofile machofile is a module to parse Mach-O binary files, with a focus on malware analysis and reverse engineering. Inspired by Ero Carrera's pefile, this module aims to provide similar capabilities but for Mach-O binaries instead. Reference material and documentation used to gain the file...
kerberoast
🚩 Sponsors If you like this project, consider sponsoring it on GitHub! Sponsors kerberoast Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are th...
python-ecdsa
ECDSA ed ECDH in puro Python Questa è un'implementazione facile da usare di ECC Elliptic Curve Cryptography con supporto per ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm ed ECDH Elliptic Curve Diffie-Hellman, implementata interamente in Python,...
EulerOS Virtualization 2.11.1 : protobuf (EulerOS-SA-2026-3454)
According to the versions of the protobuf packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Any project that uses Protobuf Pure-Python backendto parse untrusted Protocol Buffers data containing an arbitrary number of...
EUVD-2026-54177
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...
CVE-2026-71554
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...
CVE-2026-71554
CVE-2026-71554 affects the Python HTTP/2 stack in the h2 package. Versions up to and including 4.4.0 accept header blocks containing more than one Host header and forward all Host headers to the application. When a client downgrades HTTP/2 to HTTP/1.1, this can yield two Host header lines, enabli...
Production ML-DSA Verification in 350 Lines of Python
I don’t do a lot of Python, at least not in my most recent life.1 However, I happen to have just written a production ML-DSA verifier in pure Python. It’s 350 lines of code plus many more of tests, it supports all parameter sets, and I am pretty satisfied with it. You can fetch it as mldsa from...
UBUNTU-CVE-2026-47180
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming.decodelabelsatoffset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.init, causing...
AIOHTTP's unicode processing of header values could cause parsing discrepancies
SummaryThe Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. ImpactIf a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling...
PYSEC-2026-1099 AIOHTTP's unicode processing of header values could cause parsing discrepancies
Summary The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling...
PYSEC-2026-1104 AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
Summary The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execu...
protobuf-python has a potential Denial of Service issue
SummaryAny project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit.Reporter: Alexis Challande, Trail of Bits...
PYSEC-2026-1806 protobuf-python has a potential Denial of Service issue
Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits...
PYSEC-2026-1103 aiohttp allows request smuggling due to incorrect parsing of chunk extensions
Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker m...
