xepor

Xepor Xepor pronounced /ˈzɛfə/ , zephyr is a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style. This project is meant to be used with mitmproxy...

CVE-2019-13498

CVE-2019-13498 Exploit Title: MITM - Missing HSTS causing credential theft and content manipulation Date: 07/10/2019 Exploit Author: Furqan Khan Vendor Homepage: https://www.oneidentity.com/ Software Link: https://www.oneidentity.com/products/cloud-access-manager/ Version: 8.1.3 Tested on: Kali...

mysslstrip

mysslstrip mysslstrip is a Python-based proof of concept showing how to MITM MySQL traffic and strip SSL/TLS, as per CVE-2015-3152. Usage mysslstrip.py -h -p LISTENPORT -i LISTENINTERFACE dest Example Output root@kitploit: root@duo1 python2.7 mysslstrip.py -p 3307 127.0.0.1:3306 2015-04-29...

CVE-2026-56586

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data...

CVE-2026-56586 HCL IEM was affected with X-Content-Type-Options Header Missing

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data...

CVE-2026-56586

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data...

CVE-2026-56587

CVE-2026-56587 (HCL IEM) : The issue arises from HTTPS Strict-Transport-Security not being enforced, potentially enabling SSL stripping or man-in-the-middle attacks and compromising secure communications. Documented impact: confidentiality at LOW, with no integrity/availability impact. CVSSv3.1 m...

PT-2026-61959

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data...

MiracleLinux 4 : rh-postgresql94-postgresql-9.4.12-1.AXS4 (AXSA:2017-1728:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1728:01 advisory. PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll ne...

EUVD-2020-26152

Malware in sbrugna...

EUVD-2016-7554

Malware in sbrugna...

EUVD-2024-17257

Malicious code in bioql PyPI...

EUVD-2021-2915

Malicious code in bioql PyPI...

mitmf

This is a Python-based framework for Man-In-The-Middle MITM attacks, called MITMf. It is designed to provide a one-stop-shop for various network attacks and techniques. The framework contains a built-in SMB, HTTP, and DNS server that can be controlled and used by various plugins. It also includes...

CVE-2024-1509

CVE-2024-1509 affects Brocade ASCG prior to version 3.2.0, where the web interface does not enforce HTTP Strict Transport Security (HSTS) for ports 8030 and 8100. Root cause: missing HSTS enforcement increases susceptibility to downgrade and SSL-stripping MITM attacks and weakens cookie-hijacking...

CVE-2024-1509 Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100

Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks...

CVE-2024-1509 Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100

Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks...

Design/Logic Flaw

The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security HSTS. HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade...

CVE-2021-0296

The CVE-2021-0296 entry concerns Juniper Networks CTPView server not enforcing HTTP Strict Transport Security (HSTS). Affected versions are Juniper CTPView 7.3 before 7.3R7 and 9.1 before 9.1R3. Root cause: lack of HSTS header enforcement, which can enable downgrade attacks, SSL-stripping MITM, a...

Over 25% Of Tor Exit Relays Spied On Users' Dark Web Activities

An unknown threat actor managed to control more than 27% of the entire Tor network exit capacity in early February 2021, a new study on the dark web infrastructure revealed. "The entity attacking Tor users is actively exploiting tor users since over a year and expanded the scale of their attacks ...