SqliSniper

Features • Installation • Usage • Running SqliSniper • Contributing • SqliSniper is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers. It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using...

cve-2021-44228

CVE-2021-44228 This repository represents a simplified simulation of infamous CVE-2021-44228 issue. Aside from system properties and other dictionary structures lookups, Apache Log4j also implements JNDI lookup feature for various reasons. The JNDI can obtain services from a number of service...

AOSP-DownloadProviderHeadersDumper

AOSP-DownloadProviderHeadersDumper PoC Exploiting Headers Disclosure in Android's Download Provider CVE-2018-9546 Security Advisory https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-Request-Headers-Disclosure-CVE-2018-9546.pdf More Information...

log4j2burpscanner

log4j2burpscanner CVE-2021-44228, log4j2 Burp plugin Java version. DNSlog uses non-dnslog.cn domain names. Effect demonstration: Target range the range is relatively slow, but internet assets are fine. The reason might be that the range handles other request headers poorly, or the headers are too...

EUVD-2026-117894

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the...

SUSE CVE-2019-11250

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

CVE-2026-73100

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie,...

EUVD-2026-117409

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie,...

CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie,...

CVE-2026-73100

The Apache Juneau REST server call logger (versions through 9.2.0 ) is vulnerable to an Insertion of Sensitive Information into Log File vulnerability. The logger records request headers for requests resulting in server errors without redacting sensitive data. This allows headers including Author...

PT-2026-137439

Name of the Vulnerable Software and Affected Versions Apache Juneau versions prior to 9.2.1 Description The default REST server call logger records request headers in cleartext when a request results in a server error. This behavior allows sensitive information contained in headers such as...

CVE-2026-111812

A flaw was found in Apache Traffic Server's originserverauth plugin. An unauthenticated remote attacker can exploit this vulnerability to force the proxy into signing attacker-controlled Amazon Web Services AWS request headers using the proxy server's own credentials. This allows the attacker to...

CLEANSTART-2026-KK27304 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-hive package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CVE-2026-111115

A flaw was found in Apache Kafka. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request containing a large declared count of tagged fields in flexible request headers. Because the server does not adequately validate or limit this count against th...

CVE-2026-115817

A flaw was found in Starman. A remote attacker can cause a Denial of Service DoS by sending complete HTTP request headers and then stalling or slowly transmitting the request body. Because request bodies are read without enforcing an active timeout deadline, worker processes remain blocked...

CVE-2026-118647

The n8n workflow automation tool is vulnerable in versions before 1.123.85 , 2.x before 2.43.5 , and 2.44.x before 2.44.1 . The SeaTable Trigger node saves the API token in error execution data because failed poll requests store raw request headers. An attacker who can view workflow executions bu...

CVE-2026-118647 n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the...

Improperly Controlled Sequential Memory Allocation

Overview Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation via generated flexible-protocol message readers that parse request headers. An attacker can send a request whose flexible header declares millions of unknown tagged fields, causing the...

EUVD-2026-112170

Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size socket.request.max.bytes; it was not checked against the...

CVE-2026-111115

Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size socket.request.max.bytes; it was not checked against the...