CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

malware-research

malware-research General malware analysis stuff...

CVE-2022-22978-demo

CVE-2022-22978-demo CVE-2022-22978 vulnerability demo code Exploitation Conditions Although rated as high severity, the exploitation conditions are quite stringent. Personally, I find this vulnerability rather underwhelming. 1. First, spring-security must be within the affected scope. 2. Second, ...

modelaudit

ModelAudit Secure your AI models before deployment. Static scanner that detects malicious code, potential backdoor indicators, and security vulnerabilities in ML model files — without ever loading or executing them. Full Documentation | Usage Examples | Supported Formats Why ModelAudit Models...

CIS GitLab Benchmark Scanner

CIS GitLab Benchmark Scanner - gitlabcis Background On April 17th 2024, GitLab™ published a blog post introducing its Center for Internet Security® CIS GitLab Benchmark. With the goal to improve the security of the product and offer hardening recommendations to GitLab's customers. You can downloa...

metarget

中文 | English 1 Introduction Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically. 1.1 Why Metarget? During security researches, we might find that the...

security-portfolio

Skyler M. — Security Portfolio IT Infrastructure & Security Engineer · Offensive security · Detection engineering · Vendor risk USMC veteran · Sole IT & security owner for a 200-user firm across 23 states · Top 2% on TryHackMe LinkedIn · GitHub @Mitsu-bis · HackerOne · TryHackMe · Resume I'm a US...

vuln-list-redhat

vuln-list-redhat Red Hat security advisories...

sublime-rules

Sublime Rules by Sublime Security This repo contains open-source rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Examples HTML smuggling VIP / Executive impersonation Malicious OneNote files Malicious LNK files...

kstg

OWASP KSTG OWASP Kubernetes Security Testing Guide Our Vision Create a comprehensive manual for Kubernetes Cluster Security Assessment We are creating a comprehensive testing guide for Kubernetes cluster security assessment that covers a top down approach to assess the security of a cluster. The...

kingfisher

Detect and Validate Secrets Anywhere. Map Access. Revoke Fast. Find leaked secrets. Validate what’s live. Map the blast radius. Revoke fast. Kingfisher is a blazingly fast, completely free and open source secret scanner built in Rust. It detects leaked secrets across your entire stack with hundre...

Elkeid

Elkeid - Bytedance Cloud Workload Protection Platform English | 简体中文 Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices. With the business...

tangalanga

Tangalanga Zoom Conference scanner. This scanner will check for a random meeting id and return information if available. Install First try to see if there's any prebaked version for the date: https://github.com/elcuervo/tangalanga/releases. This versions already have a token ready to use. Either...

monkey

Monkey documentation This folder contains the Monkey Documentation site. For more information see content/development/contribute-documentation.md...

juice-shop

OWASP Juice Shop The most trustworthy online shop out there. @dschadow — The best juice shop on the whole internet! @shehackspurple — Actually the most bug-free vulnerable application in existence! @vanderaj — First you 😂😂then you 😢 @kramse — But this doesn't have anything to do with juice...

serverless-prey

Puma Security Serverless Prey Serverless Prey is a collection of serverless functions FaaS, that, once launched to a cloud environment and invoked, establish a TCP reverse shell, enabling the user to introspect the underlying container: Panther: AWS Lambda written in Node.js Cougar: Azure Functio...

vault

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

security-study-plan

A Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps, and so on with free/paid resources, tools, and concepts to excel. It will cover but not limited to: Done 1. Common Skills for Security Study Plan 2. AWS Security...

bpflock

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...

Ajar

Ajar: Measuring Open Privilege in Agent Defenses An agent-security benchmark reports two numbers, attack success and benign utility, and both are read off runs that happened. Neither says what the defense stood ready to allow on the paths no run took. Ajar asks it directly: for each benign task i...