mitm-proxy

Go MITM Proxy Go로 작성된 가볍고 개발자 친화적인 중간자MITM HTTP/HTTPS 프록시입니다. HTTP/1.1 및 HTTP/2, CONNECT 터널링, WebSocket 터널링ws/wss, 유연한 필터를 지원하는 디스크 기반 응답 캐싱, 그리고 실시간 설정 리로드를 지원합니다. 배지 관리자 대시보드 미리보기 개요 Go MITM Proxy는 디버깅, 테스트, 학습, 그리고 HTTPS 트래픽의 통제된 가로채기를 목적으로 하는 인터셉팅 프록시입니다. MITM이 활성화되면 로컬 CA가 서명한 호스트별 리프 인증서를...

wa-tunnel

wa-tunnel - TCP Tunneling through Whatsapp This is a Baileys based piece of code that lets you tunnel TCP data through two Whatsapp accounts. This can be usable in different situations, for example network carriers that give unlimited whatsapp data or airplanes where you also get unlimited social...

wa-tunnel

wa-tunnel - Whatsapp를 통한 TCP 터널링 이는 Baileys를 기반으로 한 코드로, 두 개의 Whatsapp 계정을 통해 TCP 데이터를 터널링할 수 있습니다. 이것은 다양한 상황에서 사용할 수 있습니다. 예를 들어, 무제한 Whatsapp 데이터를 제공하는 네트워크 통신사나 무제한 소셜 네트워크 데이터를 제공하는 비행기 등에서 사용할 수 있습니다. WS 기반 멀티 디바이스 Whatsapp 라이브러리인 Baileys를 사용하므로, 예를 들어 Termux를 사용하여 향후 안드로이드에서도 사용할 수 있습니다...

galah

TL;DR: Galah /ɡəˈlɑː/ - ‘guh-laa’로 발음는 LLM 기반 웹 허니팟으로, 다양한 애플리케이션을 모방하고 임의의 HTTP 요청에 동적으로 응답하도록 설계되었습니다. Galah는 OpenAI, GoogleAI, GCP의 Vertex AI, Anthropic, Cohere, Ollama 등 주요 LLM 제공업체를 지원합니다. 기존의 웹 허니팟이 특정 웹 애플리케이션이나 취약점을 수동으로 에뮬레이션하는 반면, Galah는 모든 HTTP 요청에 대해 HTTP 헤더와 본문 내용을 포함한 관련 응답을 동적으로...

PT-2026-76751

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.137.Final Netty versions prior to 4.2.17.Final Description The io.netty.handler.codec.http.cors.CorsHandler contains an issue where the setVaryHeader function replaces existing application Vary headers, such as...

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Impact A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issu...

CVE-2026-61836: Use of Cache Containing Sensitive Information

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role...

CVE-2026-50170 Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled. The...

CVE-2026-47330 Use of uninitialized value in Ubuntu Linux AppArmor notification handling

Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses...

GHSA-83HF-93M4-RGWQ Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

Summary The Hickory DNS project's experimental hickory-recursor crate's record cache DnsLru stores records from DNS responses keyed by each record's own name, type, not by the query that triggered the response. cacheresponse in crates/recursor/src/lib.rs chains ANSWER, AUTHORITY, and ADDITIONAL...

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

Summary The Hickory DNS project's experimental hickory-recursor crate's record cache DnsLru stores records from DNS responses keyed by each record's own name, type, not by the query that triggered the response. cacheresponse in crates/recursor/src/lib.rs chains ANSWER, AUTHORITY, and ADDITIONAL...

RUSTSEC-2026-0106 Record cache accepts AUTHORITY section NS from sibling zone via parent-pool zone-context elevation

The Hickory DNS project's experimental hickory-recursor crate's record cache DnsLru stores records from DNS responses keyed by each record's own name, type, not by the query that triggered the response. cacheresponse in crates/recursor/src/lib.rs chains ANSWER, AUTHORITY, and ADDITIONAL sections...

Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

Summary FileStore maps cache keys to filenames using Unicode NFKD normalization and ord substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one UR...

GHSA-VXQX-RH46-Q2PG Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

Summary FileStore maps cache keys to filenames using Unicode NFKD normalization and ord substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one UR...

EUVD-2020-0351

Malware in sbrugna...

EUVD-2020-29435

Malware in sbrugna...

Coredns: cd bit response is cached and served later

...

Important: squid

Issue Overview: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no know...

Improper Preservation of Consistency Between Independent Representations of Shared State

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Improper Preservation of Consistency Between Independent Representations of Shared State due to the improper handling of the X-HTTP-Method-Override...

Debian DSA-5442-1 : flask - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5442 advisory. It was discovered that in some conditions the Flask web framework may disclose a session cookie. For the oldstable distribution bullseye, this problem has been fixed in...