goblob

Goblob 🫐 Goblob은 Azure Blob에 공개적으로 노출된 민감 정보를 발견하는 데 도움을 주는 가볍고 빠른 열거 도구입니다. 이는 취약점 평가, 침투 테스트, 정찰 등 다양한 연구 목적에 유용할 수 있습니다. 경고. Goblob은 각 저장소 계정에서 확인할 각 컨테이너 이름에 대해 개별 고루틴을 생성하며, -goroutines 플래그에 지정된 최대 동시 고루틴 수로만 제한됩니다. 이 구현은 기본 워드리스트를 사용할 경우 대부분의 경우 대역폭을 빠르게 소진하거나, 클라우드 환경에서 도구를 사용할 경우 많은 비용이 발...

BlobHunter

BlobHunter Azure blob storage 계정에서 공개적으로 열린 blob을 스캔하는 오픈소스 도구입니다. BlobHunter는 Azure Blob 사냥으로 수백만 개의 민감한 파일 노출 연구의 일부입니다. 개요 BlobHunter는 인터넷에 연결된 모든 사람이 공개적으로 접근할 수 있는 파일을 저장하는 Azure blob storage 컨테이너를 식별하는 데 도움을 줍니다. 이 도구는 민감한 데이터를 저장하는 잘못 구성된 컨테이너를 식별하여 위험을 완화하는 데 도움이 되며, 특히 추적하기 어려운 많은 스토리지 계...

ClickOnceBlobber

ClickOnce AppDomainManager インジェクションツールキット 署名済みの .NET ClickOnce アプリケーションを武器化し、依存 DLL のハイジャック（AppDomainManager インジェクション）を介して初期アクセスを獲得します。C に移植された ProxyBlob（すべてのトラフィックを Azure Blob Storage 経由でトンネリングする SOCKS5 プロキシ）をエージェントとして同梱。.blob.core.windows.net が許可された環境に溶け込みます。 なぜこれが機能するのか ClickOnce は .NET...

CVE-2025-10681

CVE-2025-10681: ハードコードされた Azure Blob Storage アカウントキー アドバイザリ 項目| 値 ---|--- CVE| CVE-2025-10681 ICSA| ICSA-26-055-03 CVSS 3.1| 8.6 高 ベクター| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE| CWE-798 ハードコードされた認証情報の使用 研究者| Michael Groberman — Gr0m 公開日| 2026-02-24 製品 項目| 値 ---|--- ベンダー| Gardyn 製品| Gardy...

CVE-2026-55726

CVE-2026-55726: 公開リスト可能なAzure Blob Storageコンテナ（デバイスログ） アドバイザリ フィールド| 値 ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 中 Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE| CWE-497...

BIT-PARSE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

PT-2026-99008

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625: Improper Limitation of a Pathname to a Restricted Directory

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-50173

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173

In Flow-Like before 1.0.4, the GET /api/v1/apps/{app_id}/invoke/presign route mints an Azure SAS token with sp=rwdl for any user holding only ExecuteEvents, even when they lack ReadFiles/WriteFiles. This lets low-privilege authenticated users directly write or delete blobs under the app content p...

CVE-2026-50173: Incorrect Authorization

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

PT-2026-78534

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/app id/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

[SECURITY] Fedora 43 Update: restic-0.19.1-1.fc43

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

[SECURITY] Fedora 44 Update: restic-0.19.1-1.fc44

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

PT-2026-57441

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.1 Parse Server versions 8.x through 8.6.83 Description A stored cross-site scripting XSS issue exists when the software fails to recognize an uploaded file's extension via the mime package,...

CVE-2026-61448: Unrestricted Upload of File with Dangerous Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...

PYSEC-2026-784 Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

Summary The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. Severity...