flash-xdomain-xploit

著者: Gursev Singh Kalra [email protected] Flash と安全でない crossdomain.xml による同一オリジンポリシー（Same Origin Policy）の回避 概念実証用 ActionScript コードのコンパイルとデプロイ 1. Apache Flex SDK をダウンロードしてインストールします。これには ActionScript コンパイラが含まれています。 2. ActionScript コードをローカルディレクトリにコピーし、XDomainXploit.as という名前を付けます。 3. readFrom...

flash-xdomain-xploit

著者: Gursev Singh Kalra [email protected] Flash と安全でない crossdomain.xml による同一オリジンポリシーのバイパス Proof of Concept の ActionScript コードのコンパイルとデプロイ 1. Apache Flex SDK をダウンロードしてインストールします。これには ActionScript コンパイラが付属しています。 2. ActionScript コードをローカルディレクトリにコピーし、XDomainXploit.as という名前を付けます。 3. readFrom パラメータと...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — クロスポート傍受による同一オリジンポリシー（SOP）バイパス（CVE-2026-20643） | ---|--- CVE| CVE-2026-20643 発見者| Thomas Espach（WebKit Bugzilla 306050） 対象コンポーネント| WebKit — WebCore::Navigation::innerDispatchNavigateEvent 影響を受けるバージョン| iOS 26.3.1 ビルド 23D8133（iPhone18,2） 分類|...

singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and then 192.168.1...

whonow

Whonow DNS Server DNS Rebinding攻撃をその場で実行するための悪意のあるDNSサーバーです。whonowを使用すると、DNS応答とリバウンドルールを動的に指定できます。 ドメインリクエスト自体を使用して 。 respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and then 192.168.1.1 every time after that...

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...

the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss

CVE-2026-78997 — UC Browser for Android 通用 XSS UXSS CVE-2026-78997 的 PoC 材料 — UC Browser for Android（com.UCMobile.intl，版本 13.7.8.1314）中的通用跨站脚本漏洞，由 Omri Inbar Novee 披露。 在桥接白名单域名 mtmsg.uc.cn 上的反射型 XSS 可获取特权 ucapi JavaScript 桥接的访问权限。account.openLoginWindow 桥接 API 将攻击者控制的 JavaScript...

dref

DNSリバインディングエクスプロイトフレームワーク このプロジェクトはメンテナンスされていません。 drefはDNSリバインディングの重労働を行います。以下は、組み込みペイロードの一つからのスニペットで、フックされたブラウザからローカルサブネットをスキャンするためにフレームワークが使用される様子を示しています。ライブWebサービスを特定した後、Same-Originポリシーを簡単に突破してGETレスポンスを流出させます。 // mainFrame runs first async function mainFrame // We use some tricks to derive the...

Rocky Linux 10.0 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_14844)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514844 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape du...

Rocky Linux 9 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_9692)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20269692 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43213 webkitgtk: Processing maliciously crafted web...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_14640)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514640 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape due t...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_14442)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514442 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape due t...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2025_14416)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514416 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape due t...

Rocky Linux 10.1 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_23035)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523035 advisory. firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 CVE-2025-14333 firefox: Use-after-free i...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_21881)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202521881 advisory. firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefox:...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_14743)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514743 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape due t...

Rocky Linux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779956120)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779956120 advisory. - A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_22363)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202522363 advisory. firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefox:...

Rocky Linux 10.0 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_14417)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514417 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape du...