CVE-2020-26732

CVE-2020-26732 SKYWORTH GN542VF 硬件版本 2.0 和软件版本 2.0.0.16 在 HTTPS 会话中未为会话 cookie 设置 Secure 标志 描述 SKYWORTH GN542VF 硬件版本 2.0 和软件版本 2.0.0.16 在 HTTPS 会话中未为会话 cookie 设置 Secure 标志，这使得远程攻击者更容易通过在 HTTP 会话中拦截其传输来捕获此 cookie。 附加信息 应仔细审查每个 cookie，以确定它是否包含敏感数据或是否用于安全决策。如果可能，请确保所有通信都通过加密信道进行，并为所有会话 cookie...

CVE-2026-107290

A flaw was found in pydantic-ai. An inefficient content parsing mechanism in the web fetching component allows a remote attacker serving a crafted web page to trigger a Denial of Service DoS. By providing specially structured or deeply nested content, the attacker can block the application's even...

CVE-2026-107287

A flaw was found in pydantic-ai. When local web fetching processes attacker-controlled web content, converting HTML containing deeply nested block elements into Markdown causes excessive CPU and memory consumption. A remote attacker can exploit this vulnerability to trigger a Denial of Service Do...

shadowd

Logo Shadow Daemon is a web application firewall that intercepts requests at the application level. This repository contains the main component of Shadow Daemon that handles the analysis and storage of requests. Documentation For the full documentation please refer to shadowd.zecure.org...

shadowd

Logo Shadow Daemon 是一个 Web 应用防火墙 ，它在应用层拦截请求。 该仓库包含 Shadow Daemon 的主要组件，负责请求的分析和存储。 文档 完整文档请参考 shadowd.zecure.org。 安装 准备 使用 cmake 来配置和准备项目。建议为此创建一个单独的目录。 典型的安装过程如下所示： mkdir build cd build cmake -DCMAKEINSTALLPREFIX:PATH=/usr -DCMAKEBUILDTYPE=Release .. 编译 如果 cmake 成功运行，它将生成一个 makefile。使用它来编译和安装项目。...

0-click-RCE-Exploit-for-CVE-2024-50498

CVE-2024-50498 / 0-Click RCE 漏洞利用 作者：Joshua Provoste https://x.com/JoshuaProvoste/status/1858512517774868845 该仓库包含针对 CVE-2024-50498 的概念验证（PoC）漏洞利用代码，该漏洞是 LUBUS WP Query Console WordPress 插件中存在的一个未经身份验证的代码注入漏洞，可导致远程命令执行（RCE）。 脚本功能 该脚本向存在漏洞的 REST 端点发送精心构造的 POST 请求，以注入并执行任意 PHP 代码。它会将 Web 后门写入...

CVE-2018-17431-PoC

CVE-2018-17431-PoC CVE-2018-17431 的概念验证 漏洞标题：Comodo Firewall & Central Manager UTM 所有 2.7.0 及 1.5.0 之前版本远程命令执行（基于Web Shell） 漏洞作者：Milad Fadavvi 厂商主页：https://www.comodo.com/ 软件链接：https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276 版本：2.7.0 及 1.5.0 之前 测试环境：Windows:...

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR 嘿，在这个 LetsDefend 实验室中，我深入研究了名为 ToolShell 的 SharePoint 零日漏洞（CVE-2025-53770）。简而言之，我模拟了一次真实的攻击：恶意 POST 请求绕过认证，运行 PowerShell 窃取 MachineKeySection 密钥，编译 payload.exe，并植入 Web...

arachni-ui-web

通知 Arachni 正逐步走向淘汰，试试其下一代继任者 Ecsypno SCNR 吧！ Arachni - Web 用户界面 版本 | 0.6.1.1 ---|--- 主页 | http://arachni-scanner.com 博客 | http://arachni-scanner.com/blog Github | http://github.com/Arachni/arachni-ui-web 文档 | https://github.com/Arachni/arachni-ui-web/wiki 支持 | http://support.arachni-scanner.com 作...

CVE-2023-20198-Fix

CVE-2023-20198-Fix 该仓库包含一个 Ansible playbook，用于修复某些 Cisco 设备中发现的 CVE-2023-20198 漏洞。 它执行以下操作： 1. 通过检查运行配置中的相关命令，检查 Web 服务是否正在路由器上运行 2. 如果 Web 服务正在运行，则禁用它 3. 如果配置发生更改，则保存配置 4. 检查日志中是否存在先前被利用的迹象 目录结构： CVE-2023-20198-Fix/ │ ├── ansible.cfg Ansible configuration file ├── groupvars/ Directory for...

CVE-2026-78407

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...

CVE-2026-17189

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-11936

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...

CVE-2026-11930

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers...

AutoRepeater

AutoRepeater：使用 Burp Suite 自动重放 HTTP 请求 摘要 在 Extender 中导入 AutoRepeater.jar 简要说明 AutoRepeater 只会重发被已定义替换修改过的请求。当 AutoRepeater 收到与某个标签页所设条件匹配的请求时，它会先将所有已定义的基础替换应用到该请求，然后针对每个已定义的替换，复制已执行基础替换的请求，并将给定的替换应用于该请求。 简介 Burp Suite 是一个拦截型 HTTP 代理，也是执行 Web 应用安全测试的事实标准工具。虽然 Burp Suite...

creep-web-app-scanner

creep-web-app-scanner 一个（非常）简陋的网站扫描器，目前由一名 NCC Group 员工兼大学毕业生利用 20% 的研究时间开发。creep 目前会爬取网站，并在每个页面中搜索潜在有价值的信息。 creep 将爬取你的（仅 HTTP）目标，并提取网站上有趣的信息，包括： 源代码注释 错误（MySQL 错误、警告、致命错误等） Linux 文件路径 creep 还将在现有已知位置执行文件/目录爆破，以尝试定位可能有趣的文件/目录（例如 test.php、admin/ 等）。 creep...

CVE-2026-17189 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-17189

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to reflected cross-site scripting . This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI, which could alter intend...

EUVD-2026-95279

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...

CVE-2026-11936 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...