SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

High Package gomod github.com/siyuan-note/siyuan/kernel Affected versions 3.7.3 Patched versions none yet — leave blank until a fix is released Description Summary /ws/network/proxy is an admin-only WebSocket forward-proxy endpoint target URL and headers fully attacker-specifiable via query...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2020-5258 DESCRIPTION: In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject...

Security Bulletin: User Entity Behavior Analytics App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. User Entity Behavior Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2011-4969 DESCRIPTION:...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in September 2026. Vulnerability Details CVEID:CVE-2025-71329 DESCRIPTION: image-size through 2.0.2 contains a denial of...

acltoolkit

acltoolkit acltoolkit は、ACL 悪用のためのスイスアーミーナイフ的なツールです。複数の ACL 悪用を実装しています。 目次 acltoolkit 目次 インストール 使い方 コマンド get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript インストール pip install acltoolkit-ad または git clone https://github.com/zblurx/acltoolkit.git cd acltoolkit...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation pip install acltoolkit-ad or...

EDRSandblast

EDRSandBlast EDRSandBlast は、C で書かれたツールであり、脆弱性のある署名済みドライバを悪用して、EDR の検出（Notify Routine コールバック、Object Callbacks、ETW TI プロバイダー）や LSASS の保護をバイパスします。また、ユーザーランド監視を回避するための複数のユーザーランドアンフック技術も実装されています。 リリース時点では、ユーザーランド（--usermode）とカーネルランド（--kernelmode）の技術を組み合わせて、EDR の監視下で LSASS...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

sisu

sisu ⚡ AWS をファイルシステムとして使う。 このように: grep -l "AdministratorAccess" iam/users//policies.json この代わりに: aws iam list-users --query 'Users.UserName' --output text | \ xargs -I sh -c 'aws iam list-attached-user-policies --user-name --query "AttachedPolicies.PolicyArn" --output text' | \ grep...

netattack

NETATTACK The netattack.py is a python script that allows you to scan your local area for WiFi Networks and perform deauthentification attacks. The effectiveness and power of this script highly depends on your wireless card. NETATTACK 2 RELEASED https://github.com/chrizator/netattack2/ USAGE EASY...

pySigma-backend-opensearch

pySigma OpenSearch 后端 这是 pySigma 的 OpenSearch 后端。它提供 sigma.backends.opensearch 包，包含两个后端类： OpensearchLuceneBackend - 将 Sigma 规则转换为 Lucene 查询语法 OpenSearchPPLBackend - 将 Sigma 规则转换为 PPL（管道处理语言）查询 Lucene 后端 Lucene 后端支持以下输出格式： default：纯 Lucene 语法的 OpenSearch 查询 提示： 在 Dashboard 中，您需要从 DQL 切换为 Lucene...

Security Bulletin: Multiple secuirty vulnerabilities addressed with IBM Business Automation Workflow traditional and containers September 2026

Summary In addition to updating many operating system level packages, IBM Business Automation Workflow traditional and container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-53668 DESCRIPTION: React Router is a router for React. In versions 6.30.2 through 6.30...

second-order

Second Order Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs and other data that match certain rules, or respond in a certain way. Installation From binary Download a prebuilt binary from the releases page and unzip it. From source Go version 1....

Security Bulletin: Vulnerability in axios bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the axios library, which is affected by multiple vulnerabilities, including server-side request forgery, prototype pollution, and denial of service vulnerabilities. CVE-2026-44486, CVE-2026-44487, CVE-2026-44488,...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

CVE-2026-58635-PoC

CVE-2026-58635: Windows Narrator Braille ローカル権限昇格 CVE-2026-58635 の概念実証コードです。Windows Narrator Braille におけるコマンドインジェクションの脆弱性を悪用します。ローカルの認証済みユーザーが書き込み可能な BrlAPI パラメータを悪用し、特権を持つ BRLTTY サービスに任意のプログラムを実行させることができます。 Microsoft はこの問題を 重要 と評価し、CVSS 3.1 スコア 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H...

PyPsPipeJack

PyPsPipeJack 此工具是我另一个工具 OpenPsPipeJack 的延续。此版本基于 Python，主要依靠 Impacket 在 Linux 上运行。 简而言之，如果你在远程主机上拥有本地管理员权限，就可以连接到该主机上的远程 PowerShell 会话，并在这些 PowerShell 会话中执行命令。这不仅提供了横向移动的机会，也提供了权限提升的机会。例如，如果你通过 RBCD、Shadow Credentials 等方式获得了本地管理员访问权限，并且远程主机上有一位开着 PowerShell 会话的域管理员，你就可以以该域管理员的身份运行命令，并将你控制的用户添加到...

Spring4Shell-CTF

Spring4Shell CVE-2022-22965 脆弱性環境構築と CTF 問題設計 プロジェクト概要 本プロジェクトは、2 トラック方式のセキュリティ研究実装を含みます： 1. 従来の Vulhub 環境構築 ：オープンソースの Vulhub 脆弱性データベースを利用して、旧バージョンの Spring フレームワークのオブジェクトバインディング欠陥を迅速に再現します。 2. 全新カスタム環境開発 ：チームメンバーが手書きで Java ソースコードを作成し、自主的に「学生期末プロジェクト成果発表システム」を脆弱性ターゲットとして構築し、標準的なネットワーク侵入テストの流れと組み合わ...

Parth

Parth Heuristic Vulnerable Parameter Scanner Introduction Some HTTP parameter names are more commonly associated with one functionality than the others. For example, the parameter ?url= usually contains URLs as the value and hence often falls victim to file inclusion, open redirect and SSRF...

owasp-java-encoder

OWASP Java Encoder Contextual output encoding for Java 8+. Choose an encoder for the parser context receiving untrusted text: HTML, JavaScript, CSS, XML or a URL component. The core has no runtime dependencies; optional JSP and Jakarta adapters provide view-layer bindings. Encoding is one part of...