29 matches found
PurpleKeep
설명 공격 기술의 다양성이 급격히 증가하고 EDREndpoint Detection and Response에서 제공하는 탐지 규칙과 사용자 정의 규칙이 동시에 증가함에 따라 탐지 규칙의 지속적인 기능 테스트 필요성이 명확해졌습니다. 그러나 이러한 공격을 수동으로 재실행하고 탐지 규칙과 대조하는 것은 노동 집약적인 작업이므로 자동화할 가치가 있습니다. 이 문제를 해결하기 위해 저는 "PurpleKeep"을 개발했습니다. 이는 탐지 규칙의 자동화된 테스트를 용이하게 하기 위해 설계된 오픈 소스 이니셔티브입니다. Atomic Red...
EUVD-2026-75184
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch...
GHSA-34R3-9M95-VQ73 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999
Open WebUI (a self-hosted AI platform) had a server-side request forgery (SSRF) vulnerability in backend/open_webui/retrieval/web/utils.py, affecting the POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search endpoints. The root cause was that Python's globally routable ...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999: Server-Side Request Forgery (SSRF)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
Server-Side Request Forgery SSRF in Azure MCP Server allows an authorized attacker to elevate privileges over a network...
EUVD-2026-29578
Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network...
GHSA-PRGG-RGFW-VR94 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-aws, linux-gcp, linux-vmware, linux-qemu...
hays-london-azure-platform-2-poc
Hays London Azure Platform Engineer POC — AKS Operations & Pla...
Microsoft Azure DevOps 安全漏洞
Microsoft Azure DevOps is a team collaboration platform provided by the American company Microsoft. There is a security vulnerability in Microsoft Azure DevOps, which stems from insufficient credential protection. This vulnerability could allow unauthorized attackers to gain elevated privileges...
Microsoft Azure Arc Access Control Error Vulnerability
Microsoft Azure Arc is a storage system from Microsoft USA. that extends the Azure platform into your environment. Microsoft Azure Arc has an Access Control Error vulnerability that can be exploited by an attacker to elevate privileges...
CVE-2025-55697 Azure Local Elevation of Privilege Vulnerability
...
Microsoft raises the bar: A smarter way to measure AI for cybersecurity
ExCyTIn-Bench is Microsoft’s newest open-source benchmarking tool designed to evaluate how well AI systems perform real-world cybersecurity investigations.1 It helps business leaders assess language models by simulating realistic cyberthreat scenarios and providing clear, actionable insights into...
EUVD-2020-12768
Malware in sbrugna...
