toxssin

toxssin Назначение toxssin — это инструмент тестирования на проникновение с открытым исходным кодом, который автоматизирует процесс эксплуатации уязвимостей межсайтового скриптинга XSS. Он состоит из HTTPS-сервера, который работает как интерпретатор трафика, генерируемого вредоносной...

burpsuite-copy-as-xmlhttprequest

Расширение Copy as XMLHttpRequest для BurpSuite Расширение добавляет контекстное меню в BurpSuite, позволяющее копировать несколько запросов в виде Javascript's XmlHttpRequest, что упрощает разработку PoC при эксплуатации XSS. Установка загрузите последний JAR из релизов или соберите вручную...

CVE-2017-7038

CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 문서 구현 XSS 취약점 root@kitploit: var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayload, 'text/html'; var xhr = ne...

cve-2016-1764

Эксплойт PoC для CVE-2016-1764 Восстановление данных iMessage в открытом виде без взлома криптографии Авторы Shubham Shah из Bishop Fox Joe DeMesy из Bishop Fox Matthew Bryant CVE-2016-1764 Производитель: Apple Дата публикации: 8 апреля 2016 Дата исправления: 21 марта 2016 Затронутые системы:...

CVE-2020-28502

CVE-2020-28502 node-XMLHttpRequest RCE NVD 설명 이는 xmlhttprequest 패키지 1.7.0 이전 버전 및 xmlhttprequest-ssl 패키지의 모든 버전에 영향을 미칩니다. 요청이 동기적으로 전송될 경우xhr.open에서 async=False, xhr.send로 유입되는 악의적인 사용자 입력은 임의의 코드가 삽입되어 실행될 수 있습니다. 데모 설정 1. Dockerfile에서 이미지 빌드 root@kitploit: $ docker build -t cve-2020-28502 . 2....

burpsuite-copy-as-xmlhttprequest

Copy as XMLHttpRequest BurpSuite extension The extension adds a context menu to BurpSuite that allows you to copy multiple requests as Javascript's XmlHttpRequest, which simplifies PoC development when exploiting XSS. Installation download the latest JAR from releases or build manually add JAR to...

Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

CVE-2017-5638

CVE-2017-5638 CVE: 2017-5638 다양한 형식으로 대부분은 URL을 입력해야 하며 명령어를 변경하고 싶을 수도 있습니다. URL과 명령어를 입력할 수 있게 만들 수 있다면 풀 리퀘스트를 보내 주세요! PHP - 예시: http://localhost/2017-5638.php?url=TARGET&cmd=command XMLHttpRequest - CVE-2017-5638.js -- 대상 서버에 Access-Control-Allow-Origin이 설정되고 호스트 페이지가 허용되어야 합니다. 그 외의 항목들은 추가...

DRUPAL-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

Astra Linux – Vulnerability in Firefox and Thunderbird

Cross-Site Tracing occurs when a server echoes a request back using the Trace method, allowing an XSS attack to access authorization headers and cookies that are inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitigate this attack, browsers imposed restrictions on fetch and...

CLSA-2026-1785204344 TuxCare security update for xmlhttprequest-ssl (11 CVEs)

TuxCare rebuilt xmlhttprequest-ssl to address 11 CVEs. Fixed in 1.5.1-tuxcare.1...

CLSA-2026-1777336760 TuxCare security update for xmlhttprequest (9 CVEs)

TuxCare rebuilt xmlhttprequest to address 9 CVEs. Fixed in 1.4.2-tuxcare.1...

CLSA-2026-1772064638 TuxCare security update for xmlhttprequest-ssl (3 CVEs)

TuxCare rebuilt xmlhttprequest-ssl to address 3 CVEs. Fixed in 1.5.5-tuxcare.1...

PYSEC-2026-1997 urllib3 does not control redirects in browsers and Node.js

urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects. However, the retries...

MITM (Man-in-the-Middle) xmlhttprequest Dependency in Jira Service Management Data Center

This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity MITM Man-in-the-Middle vulnerability was introduced in versions 11.1.0, 11.2.0, and 11.3.0 of Jira Service...

PT-2026-5151

Name of the Vulnerable Software and Affected Versions ILIAS Learning Management System version 4.3 Description The ILIAS Learning Management System contains a server-side request forgery issue. This allows attackers to read local files through the portfolio PDF export functionality. Attackers can...

MiracleLinux 7 : firefox-60.7.0-1.0.1.el7.AXS7 (AXSA:2019-3895:02)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-3895:02 advisory. Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 CVE-2019-9800 Mozilla: Cross-origin theft of images with createImageBitmap...

Mozilla Thunderbird < 3.0.7

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 3.0.7. It is, therefore, affected by a vulnerability as referenced in the mfsa2010-63 advisory. - Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and...

Mozilla Firefox < 3.6.9

The version of Firefox installed on the remote Windows host is prior to 3.6.9. It is, therefore, affected by a vulnerability as referenced in the mfsa2010-63 advisory. - Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0...

Mozilla Firefox < 3.5.12

The version of Firefox installed on the remote Windows host is prior to 3.5.12. It is, therefore, affected by a vulnerability as referenced in the mfsa2010-63 advisory. - Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before...