38 matches found
hammer
概要 Dow Jones Hammerは、AWS向けのマルチアカウントクラウドセキュリティツールです。主要なAWSリソースにおいて、すべてのリージョンとアカウントにわたる設定ミスや安全でないデータ露出を特定します。ほぼリアルタイムのレポート機能（例：JIRA、Slack）を備え、エンジニアに迅速なフィードバックを提供し、一部の設定ミスについては自動修復を実行できます。これにより、セキュアなガードレールを構築し、クラウド上にデプロイされた製品を保護します。 ドキュメント Dow Jones Hammerのドキュメントは、GitHub...
CyberRange
概要: このCyberRangeプロジェクトは、世界初のオープンソースのサイバーレンジ設計図です。 このプロジェクトは、AWSクラウドを使用したプライベートリサーチラボで、攻撃、防御、リバースエンジニアリング、セキュリティインテリジェンスのツールを完全に備えたブートストラップフレームワークを提供します。 このプロジェクトには、脆弱なシステムと、ペネトレーションテスター、開発者、マルウェアアナリスト、フォレンジック/リバースエンジニア、スレットハンターなどに知られている最も強力なオープンソース/コミュニティエディションのツールキットが含まれています。 はじめよう...
CloudPulse
CloudPulse - AWS クラウドランドスケープ検索エンジン 偵察フェーズでは、攻撃者は標的に関するあらゆる情報を検索し、プロファイルを作成します。これにより、後で組織に侵入する可能性のある方法を特定するのに役立ちます。 CloudPulse は、SSL 証明書データの分析を簡素化および強化する強力なツールです。Trickest Cloud で入手可能な AWS EC2 マシンから取得した膨大な SSL 証明書リポジトリを活用します。CloudPulse を用いて、セキュリティ研究者は SSL...
CVE-2026-11417
OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 2.246.0 on Windows might allow an actor who controls the value of one or more bundling properties externalModules, define, loader, inject, or esbuildArgs to execute arbitrary commands on the host...
CVE-2025-23206
The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...
EUVD-2025-0113
Malicious code in bioql PyPI...
EUVD-2024-2637
Malicious code in bioql PyPI...
EUVD-2024-43173
Malicious code in bioql PyPI...
EUVD-2025-7239
Malicious code in bioql PyPI...
EUVD-2023-1884
Malicious code in bioql PyPI...
CVE-2024-45037
The AWS Cloud Development Kit CDK is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called...
GHSA-QC59-CXJ2-C2W4 aws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role
Summary The AWS Cloud Development Kit AWS CDK is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. In the CDK, developers organize their applications into reusable components called "constructs," which are...
PT-2025-19363 · Npm · Aws-Cdk-Lib
Summary The AWS Cloud Development Kit AWS CDK is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. In the CDK, developers organize their applications into reusable components called "constructs," which are...
CVE-2025-2598
When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...
CVE-2025-23206
The CVE-2025-23206 issue affects AWS CDK (IAM OIDC custom resource workflow). The tls.connect call sets rejectUnauthorized: false, enabling potential MITM risk when downloading CA thumbprints. A patch is in progress; remediation guidance in the connected docs recommends upgrading to CDK v2.177.0 ...
CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk
The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...
CVE-2024-48874
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Using this, attackers could access internal services used by Ruijie and their internal cloud infrastructure via AWS cloud...
CVE-2024-48874
CVE-2024-48874 affects Ruijie Reyee OS, specifically versions 2.206.x up to but not including 2.320.x. The root cause is a server-side request forgery (SSRF) in Ruijie’s proxy handling that could be leveraged to force proxy servers to perform arbitrary requests, enabling access to internal servic...
CVE-2024-48874 Ruijie Reyee OS Server-Side Request Forgery
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Using this, attackers could access internal services used by Ruijie and their internal cloud infrastructure via AWS cloud...