SqliSniper

機能 • インストール • 使い方 • SqliSniperの実行 • 貢献 • SqliSniper は、HTTPリクエストヘッダー内の時間ベースのブラインドSQLインジェクションを検出するために設計された堅牢なPythonツールです。マルチスレッドを使用して迅速にスキャンし、潜在的な脆弱性を特定することで、セキュリティ評価プロセスを強化し、速度と効率を確保します。他のスキャナとは異なり、SqliSniperは誤検出を排除し、検出時にアラートを送信するように設計されており、内蔵のDiscord通知機能を備えています。...

cve-2021-44228

CVE-2021-44228 이 저장소는 악명 높은 CVE-2021-44228 문제를 단순화하여 시뮬레이션한 것입니다. 시스템 속성 및 기타 사전 구조 조회 외에도 Apache Log4j는 다양한 이유로 JNDI 조회 기능을 구현합니다. JNDI는 LDAP, DNS, Java RMI 레지스트리 등 여러 서비스 제공자로부터 서비스를 획득할 수 있습니다. JNDI 자체는 단순하고 안전하지 않은 API로, 제3자가 제어하는 서비스 제공자에 대한 보호 기능이 없습니다. 공격자가 악성 URL을 통해 공개적으로 접근 가능한 서버를 제어하고...

log4j2burpscanner

log4j2burpscanner CVE-2021-44228, log4j2 Burp 플러그인 Java 버전, dnslog은 dnslog.cn이 아닌 도메인을 선택했습니다. 효과는 다음과 같습니다: 실습 환경의 실습 환경은 비교적 느리지만 인터넷 자산은 문제가 없습니다. 이유는 실습 환경이 다른 요청 헤더를 잘 처리하지 못하거나 요청 헤더가 너무 커서 실습 환경의 반응이 느려지는 것이므로, 조금 더 기다리시면 됩니다 SRC 사이트 두 곳을 테스트했습니다 로드 후 URL이 제공되며, 접속하면 DNS 기록을 확인할 수 있습니다. 물론...

AOSP-DownloadProviderHeadersDumper

AOSP-DownloadProviderHeadersDumper Android 다운로드 제공자의 헤더 노출을 악용하는 PoC CVE-2018-9546 보안 권고 https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-Request-Headers-Disclosure-CVE-2018-9546.pdf 추가 정보...

Linux Distros Unpatched Vulnerability : CVE-2026-47893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception...

CVE-2026-47893

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

CVE-2026-47893

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

EUVD-2026-66861

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

CVE-2026-47893 Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

CVE-2026-47893

CVE-2026-47893 affects the HandshakeWebsocketService component in Spring WebFlux . A Spring WebFlux application supporting WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason during the handshake process. An attacker can trigg...

PT-2026-82411

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

EUVD-2026-65613

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, requestInternal recursively calls...

CVE-2026-54625

django CMS prior to 5.0.8 and in 5.1.0a1 contains a page cache vulnerability in cms/cache/page.py. The _page_cache_key function omits request header values declared by plugins through get_vary_cache_on() from the cache key, even though set_page_cache correctly adds those header names to the respo...

cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService

cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService...

Information Exposure

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

CVE-2026-73286 RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS getconditionvalues folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowin...

CVE-2026-73286

Summary: The CVE-2026-73286 issue affects RustFS prior to 1.0.0-beta.12. The vulnerability arises because get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived identity keys (userid, username, principaltype, groups, versionid, signatureversion, jwt:, ld...

EUVD-2026-57230

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS getconditionvalues folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowin...

PT-2026-71089

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get condition values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys,...

CVE-2026-69207

Hono’s built-in CORS middleware (hono/cors) is vulnerable to a ReDoS in the Access-Control-Request-Headers parsing during preflight requests when allowHeaders is unset/empty. The regex-based parser can backtrack quadratically with long whitespace, potentially causing seconds of CPU usage per pref...