16039 matches found
Progress-MOVEit-Transfer-2020.1-Stored-XSS-CVE-2020-28647
Progress MOVEit Transfer 2020.1 XSS Memorizzato CVE-2020-28647 Durante un recente test di applicazione web, una delle applicazioni in esame era un'applicazione web MOVEit Transfer 2020. Durante la valutazione è stata identificata una vulnerabilità di Cross-Site Scripting XSS memorizzato. Questo...
CVE-2025-27407
CVE-2025-27407 GitLab Podman Lab Laboratorio minimale solo locale per dimostrare che il percorso HTTP Direct Transfer di GitLab raggiunge il caricatore di schema di introspezione vulnerabile di graphql-ruby. Il laboratorio esegue un singolo container GitLab CE vulnerabile; lo script PoC avvia il...
OSCP
OSCP Guida allo Studio OSCP Indice Enumerazione e Ricognizione Enumerazione Web Scansione con Nikto: nikto -h http://10.10.10.1 Individuazione delle directory con diversi strumenti: DIRB dirb http://10.10.10.1 Gobuster gobuster dir -u http://10.129.155.74:3000 -w...
dns-zone-transfer-test
Test di Trasferimento di Zona DNS Automatizza i test di trasferimento di zona del Domain Name System DNS. Trova automaticamente i nameserver di un dato dominio e verifica i trasferimenti di zona; in caso di successo, i record A identificati vengono stampati sull'output standard. Utilizzo dztt...
MOVEit-Transfer-Data-Breach-Analysis.
MOVEit-Transfer-Data-Breach-Analysis. Analisi dettagliata della violazione dei dati di MOVEit Transfer del 2023 CVE-2023-34362 per CS50 Cybersecurity. Questo progetto esplora l'impatto tecnico della SQL Injection non autenticata e le sue conseguenze per la privacy globale dei dati, coinvolgendo...
MOVEit Transfer - SQL Injection
In Progress MOVEit Transfer before 2020.1.11 12.1.11, 2021.0.9 13.0.9, 2021.1.7 13.1.7, 2022.0.7 14.0.7, 2022.1.8 14.1.8, and 2023.0.4 15.0.4, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized...
EUVD-2026-91849
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...
CVE-2026-104433
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...
CVE-2026-104433: Out-of-bounds Read
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...
CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...
CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...
CVE-2026-104433
The Mooncake transfer engine (versions before 0.3.12 ) is vulnerable to an out-of-bounds read in the readString function located in include/common.h. This flaw allows unauthenticated attackers to crash the service, such as an SGLang inference server , by connecting to the handshake port listening...
CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...
GHSA-2HW9-MC66-JC2Q Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...
httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi
A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...
CVE-2026-63718
A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...
EUVD-2026-91136
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...
EUVD-2026-91134
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...
CVE-2026-103764
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...