CVE-2021-25374_Samsung-Account-Access

CVE-2021-25374 - Script di Accesso all'Account Samsung Questo script può essere utilizzato per ottenere l'accesso all'account Samsung di una vittima, se questa ha una versione specifica di Samsung Members installata sul proprio dispositivo Samsung e se il dispositivo della vittima proviene dalla...

CVE-2024-27198-TeamCity

Metodi di mitigazione: regexp sul WAF root@kitploit: REQUESTURI Regex ^\S\?jsp=\S;\.jsp...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

cve-2019-6453-poc

CVE-2019-6453: RCE على mIRC 7.55 باستخدام حقن الوسائط عبر معالجات بروتوكول URI المخصصة وجدنا ثغرة تنفيذ تعليمات برمجية عن بُعد في mIRC عبر معالج بروتوكول URI irc://. ولأن mIRC لا يستخدم أي نوع من الرموز مثل -- لتحديد نهاية قائمة الوسائط، يمكن للمهاجم تمرير وسائط إلى mIRC عبر رابط irc:// وتنفيذ...

apkleaks

APKLeaks Scanning APK file for URIs, endpoints & secrets. Installation from Pypi from Source from Docker Usage Options Output Pattern Arguments for disassembler License Acknowledments Installation It's fairly simple to install APKLeaks : from PyPi root@kitploit: $ pip3 install apkleaks from Sourc...

apkleaks

APKLeaks Digitaliza arquivos APK em busca de URIs, endpoints e segredos. Instalação A partir do PyPi A partir do código fonte A partir do Docker Uso Opções Saída Padrão Argumentos para o desmontador Licença Agradecimentos Instalação É bastante simples instalar o APKLeaks : A partir do PyPi...

CVE-2024-38200

CVE-2024-38200 Nach dem Patch Das Erfassen des NTLMv2-Hashes über die HTTP-Methode wurde nicht behoben. Der NTLMv2-Hash-Wert kann weiterhin über HTTP erlangt und an LDAP oder ADCS weitergereicht werden. MSRC erklärte zu dieser Situation: „So wie dargestellt, scheint dies Teil des aktuellen Design...

fast-uri: fast-uri: Host confusion via skipped IDN canonicalization

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...

fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...

fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects

A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers URIs in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An...

CVE-2024-28752

Ambiente di riproduzione di Apache CXF CVE-2024-28752 Avviso di vulnerabilità: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Avvio dell'ambiente samples/javafirstjaxwsfactorybean IDEA Avviare il servizio webservice tramite ServerStarter.java Build Usare JDK8 root@kitploit: mv...

mIRC-CVE-2019-6453

CVE-2019-6453: RCE su mIRC 7.55 tramite injection di argomenti attraverso gestori di protocollo URI personalizzati Link al write-up Abbiamo trovato una vulnerabilità di Esecuzione di Codice Remota in mIRC attraverso il gestore di protocollo URI irc://. Poiché mIRC non utilizza alcun tipo di sigil...

CVE-2020-24972

Quindi CVE-2020-24972 deriva in realtà da un'altra CVE. Non ricordo la CVE a cui è stata assegnata, ma ha a che fare con l'opzione della riga di comando platformpluginpath di qt. Quindi, in sostanza, il problema deriva dall'uso di qt, di per sé l'opzione platformpluginpath. "Questo parametro...

fast-uri: fast-uri: URI authority bypass due to improper delimiter handling

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier URI that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw...

fast-uri: fast-uri: Host confusion via skipped IDN canonicalization

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...

fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...

fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects

A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers URIs in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An...

CVE-2021-34429

CVE-2021-34429 POC per CVE-2021-34429 - Divulgazione di file sensibili di Eclipse Jetty 11.0.5 Utilizzo di URI codificati per accedere ai file all'interno della directory WEB-INF Configurazione dell'ambiente di test Prerequisiti: installazione di docker e docker-compose sul proprio sistema Per le...