ALFA

ALFA Автоматизированный криминалистический анализ журналов аудита для Google Workspace Авторские права c 2026 Invictus Incident Response Исходные авторы Greg Charitonos и BertJanCyber, поддерживается Invictus Incident Response Перед началом работы Замечание о поддерживаемых операционных системах:...

CVE-2024-10793

CVE-2024-10793 PoC 이 줄들을 hosts 파일에 추가하세요: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com Docker를 사용하여 Wordpress 실행: $ sudo systemctl start docker $ sudo docker-compose up -d http://goodcms.lab:2121을 열고 워드프레스 설치 단계를 진행합니다. wordpress에 wp-security-audit-log.5.2.1 또는 이전 버전을 설치합니다. 공격자 서버 실행: $ php -S...

Elkeid

Elkeid - Платформа защиты рабочих нагрузок в облаке от ByteDance Английский | 简体中文 Elkeid — это решение с открытым исходным кодом, которое может удовлетворять требованиям безопасности различных рабочих нагрузок, таких как хосты, контейнеры, K8s и serverless. Оно основано на лучших внутренних...

DFIR-O365RC

Содержание: 1. Описание модуля 2. Установка и предварительные требования 1. Использование Docker 2. Ручная установка 3. Управление приложением DFIR-O365RC 1. Создание приложения 2. Обновление приложения 3. Удаление приложения 4. Требования к разрешениям и лицензиям 5. Функции, включённые в модуль...

cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - FacturaScripts EditUser Nick 매개변수 취약한 접근 제어 설명 요약 이 애플리케이션은 EditUser 컨트롤러로 전송되는 POST 요청 중 nick 매개변수를 검증하지 않습니다. UI에서는 이 필드의 편집을 차단하지만, 사용자는 프록시를 사용하여 이 제한을 우회 하고 관리자 계정을 포함한 모든 계정의 이름을 변경 할 수 있습니다. 이로 인해 취약한 접근 제어Broken Access Control 및 잠재적인 감사 로그 손상Audit Log Corruption 이 발생합니다. ...

CVE-2026-3494_Verfication

CVE-2026-3494 - MariaDB serveraudit 로깅 검증 PoC 이 프로젝트는 MariaDB serveraudit 플러그인에서 SQL 쿼리 내 특정 인라인 주석, --이 사용될 때 발생할 수 있는 감사 로깅 우회를 검증하고 분석하기 위한 특수 환경을 제공합니다. 주요 발견 사항 v11.8.6의 로깅 누락 : MariaDB v11.8.6에서 특정 쿼리예: 주석이 포함된 SET PASSWORD 또는 Error 1046 케이스가 감사 로그에 기록되지 않는 현상이 관찰되었습니다. 해당 버전은 이전에 패치된 버전으로...

Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / galera / etc Multiple Vulnerabilities (crlsa-2022_1556)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221556 advisory. mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2154 mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2166 mysql: Inno...

Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / galera / etc Multiple Vulnerabilities (crlsa-2022_1557)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221557 advisory. mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2154 mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2166 mysql: Inno...

BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-84718

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

EUVD-2026-85613

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-84718

A flaw exists in the Ansible Automation Platform automation-controller where the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying it originated from a trusted proxy. By selecting the leftmost (attacker-controlled) header value, an attacker ...

EUVD-2026-84942

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

PT-2026-97546

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description In the production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying if it...

CVE-2026-84718: Use of Less Trusted Source

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-18161

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

CVE-2026-18161 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

CVE-2026-18161 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

CVE-2026-18161

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to an issue where a remote authenticated attacker can falsify transaction audit logs . The root cause is the improper validation of a client-supplied HTTP header . No specific patch versions or exploit details are provided...

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment cross-project integrity write, bypassing project RBAC and the audit log vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...