ALFA

ALFA Análisis Forense Automatizado de Registros de Auditoría para Google Workspace Copyright c 2026 Invictus Incident Response Autores originales Greg Charitonos & BertJanCyber mantenido por Invictus Incident Response Antes de empezar Nota sobre sistemas operativos compatibles: ALFA ha sido proba...

DFIR-O365RC

Tabla de contenidos: 1. Descripción del módulo 2. Instalación y requisitos 1. Usando Docker 2. Instalación manual 3. Gestión de la aplicación DFIR-O365RC 1. Creación de la aplicación 2. Actualización de la aplicación 3. Eliminación de la aplicación 4. Requisitos de permisos y licencias 5. Funcion...

CVE-2024-10793

CVE-2024-10793 PoC Añade estas líneas a tu archivo hosts: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com Lanza WordPress usando docker: $ sudo systemctl start docker $ sudo docker-compose up -d Abre http://goodcms.lab:2121 y sigue los pasos de instalación de WordPress. Instala...

CVE-2026-11939

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery...

CVE-2026-11939

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to audit log forgery . The root cause is identified as CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') . This vulnera...

EUVD-2026-95283

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery...

CVE-2026-11939 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery...

Elkeid

Elkeid - Plataforma de protección de cargas de trabajo en la nube de Bytedance Inglés | 简体中文 Elkeid es una solución de código abierto que puede satisfacer los requisitos de seguridad de diversas cargas de trabajo, como hosts, contenedores y K8s, y serverless. Se deriva de las mejores prácticas...

cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - Control de Acceso Roto en el Parámetro Nick de EditUser en FacturaScripts Descripción Resumen La aplicación no valida el parámetro nick durante una solicitud POST al controlador EditUser. Aunque la interfaz de usuario impide editar este campo, un usuario puede omitir esta...

CVE-2026-3494_Verfication

CVE-2026-3494 - Verificación de Registro de Auditoría del Plugin serveraudit de MariaDB PoC Este proyecto proporciona un entorno especializado para verificar y analizar una posible omisión del registro de auditoría en el plugin serveraudit de MariaDB cuando se utilizan comentarios en línea...

GHSA-PRPW-WWV7-XJJR Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping \r or \n: go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte'\n'...

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping \r or \n: go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte'\n'...

PT-2026-107375

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping r or : go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte' ' res.WriteString...

VulnCheck KEV: CVE-2026-56005

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1...

Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / galera / etc Multiple Vulnerabilities (crlsa-2022_1557)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221557 advisory. mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2154 mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2166 mysql: Inno...

Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / galera / etc Multiple Vulnerabilities (crlsa-2022_1556)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221556 advisory. mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2154 mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2166 mysql: Inno...

PT-2026-103544

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description An authenticated administrator can set a configurable security-policy setting to a value exceeding the maximum permitted limit. This allows the associated security control to be rendered...

BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-84718

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-84718

A flaw exists in the Ansible Automation Platform automation-controller where the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying it originated from a trusted proxy. By selecting the leftmost (attacker-controlled) header value, an attacker ...