ALFA

ALFA Google Workspace向け自動監査ログフォレンジック分析 Copyright c 2026 Invictus Incident Response 原作者: Greg Charitonos & BertJanCyber、Invictus Incident Response がメンテナンス 始める前に サポートされているオペレーティングシステムに関する注意: ALFA はいくつかの Linux ディストリビューション Debian および Ubuntu でテストされています。 Windows または macOS...

DFIR-O365RC

目录 1. 模块描述 2. 安装和先决条件 1. 使用 Docker 2. 手动安装 3. 管理 DFIR-O365RC 应用程序 1. 创建应用程序 2. 更新应用程序 3. 移除应用程序 4. 权限和许可证要求 5. 模块包含的函数 6. 生成的文件 DFIR-O365RC 在 SSTIC 2021（信息技术与通信安全研讨会）上进行了展示。演示文稿的幻灯片和录制视频（法文）可在此处获取：链接。 ⚠️ 2024年3月31日，Microsoft 弃用了 我们用于 DFIR-O365RC 的身份验证方法。因此，我们于2024年8月发布了 2.0.0 版本，其中包含关于身份验证的重大变更...

Elkeid

Elkeid - Bytedance クラウドワークロード保護プラットフォーム 英語 | 简体中文 Elkeid は、ホスト、コンテナ、K8s、サーバーレス などのさまざまなワークロードのセキュリティ要件を満たすことができるオープンソースソリューションです。これは ByteDance 社内のベストプラクティスに基づいています。 企業のビジネス発展に伴い、マルチクラウド、クラウドネイティブ、複数ワークロードの共存状況がますます顕著になっています。さまざまなワークロード下でのセキュリティ要件を満たすことができる一連のソリューションがあればと願い、Elkeid が誕生しました。 はじめに...

CVE-2024-10793

CVE-2024-10793 PoC 以下の行を hosts ファイルに設定してください: root@kitploit: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com docker を使用して Wordpress を起動します: root@kitploit: $ sudo systemctl start docker $ sudo docker-compose up -d http://goodcms.lab:2121 を開き、wordpress のインストール手順を実行してください。 wordpress に...

CVE-2026-3494_Verfication

CVE-2026-3494 - MariaDB serveraudit 日志记录验证 PoC 本项目提供了一个专用环境，用于验证和分析 MariaDB serveraudit 插件在 SQL 查询中使用特定内联注释（、--）时可能存在的审计日志绕过问题。 主要发现 v11.8.6 中的日志遗漏 ：在 MariaDB v11.8.6 中观察到某些查询（例如带注释的 SET PASSWORD 或 Error 1046 场景）未能被记录到审计日志中，而该版本此前被认为已修复此问题。 潜在的解析器差异 ：发现近期版本中审计插件解析器行为可能发生了变化，多行注释（）可能导致 DCL...

cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - FacturaScripts EditUser Nick 参数越权访问控制 描述 摘要 该应用程序在向 EditUser 控制器发送 POST 请求时，未能验证 nick 参数。尽管界面阻止了对此字段的编辑，但用户可以通过代理 绕过此限制，从而重命名任何账户（包括管理员） 。这导致了越权访问控制 和潜在的审计日志损坏 。 详细信息 该漏洞存在于用户更新逻辑中。当向 /EditUser 发送 POST 请求时，后端处理 nick 表单数据参数时未检查 ： 该值是否与原始值匹配 用户是否有权限更改本应不可变的唯一标识符 PoC 1...

CVE-2026-86759

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86769 Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the createdby column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission...

CVE-2026-86769

Snipe-IT versions before 8.7.0 contain an improper ownership management flaw in the consumables checkout API endpoint . The endpoint records the target user's ID in the created_by column instead of the authenticated caller's ID , causing misattributed audit entries in the consumables_users pivot ...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

EUVD-2026-74936

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759

Snipe-IT versions before 8.7.0 are affected by a missing authorization flaw in the POST /hardware/history endpoint. Any authenticated user can submit a CSV file to reassign arbitrary assets across companies and inject fraudulent audit trail entries , compromising inventory integrity and accountab...

halo-record v0.2.42

halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your agent takes tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only, hash-chained log; the...

CVE-2026-84479

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-82267

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

EUVD-2026-67798

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267

Komodo (through version 2.3.2) contains a logic flaw in the /execute and /execute/{variant} API handlers, where internal resource identifiers are disclosed and audit log entries are written before permission checks are evaluated. Authenticated users can exploit this by guessing resource names to ...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093269)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093269 advisory. Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Log. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and...