61 matches found
Aker
Aker SSH 网关 什么是 Aker？ Aker 是一款安全工具，可帮助您配置自己的 Linux SSH 跳板/堡垒主机。Aker 以埃及神话中守卫边境的神祇命名，将作为所有系统管理员和支持人员访问 Linux 生产服务器的唯一瓶颈。Aker SSH 网关包含众多安全功能，可帮助您轻松管理和运维数千台 Linux 服务器。详细说明请查阅我们的 Wiki 动机 我找不到类似 CryptoAuditor 和 fudo 的开源工具。这类工具对于需要满足 PCI-DSS 或 HIPAA...
the-bastion
🔒 The Bastion 概要 Bastion（バスティオン）は、運用チーム（システム管理者、開発者、データベース管理者など）が、通常 ssh を使用して、デバイス（サーバー、仮想マシン、クラウドインスタンス、ネットワーク機器など）に安全に接続するための唯一のエントリポイントとして使用されるマシンのクラスターです。 The Bastion は、インフラストラクチャ全体に対する認証、認可、トレーサビリティ、および監査可能性のメカニズムを提供します。 ユーザーとインフラストラクチャの間に位置することで、The Bastion...
jumpserver
An open-source PAM platform Bastion Host English · 中文简体 · 中文繁體 · 日本語 · Português Brasil · Español · Русский · 한국어 What is JumpServer? JumpServer is an open-source Privileged Access Management PAM platform that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes,...
jumpserver
オープンソースの PAM プラットフォーム バスティオン ホスト JumpServer とは？ JumpServer は、DevOps および IT チームに対して、SSH、RDP、Kubernetes、データベースおよび RemoteApp エンドポイントへのオンデマンドで安全なアクセスを提供するオープンソースの特権アクセス管理 PAM プラットフォームです。 クイックスタート クリーンな Linux サーバーを準備します 64 ビット, = 4c8g root@kitploit: curl -sSL...
warpgate
Warpgate 是一个智能且完全透明的 SSH、HTTPS、Kubernetes、MySQL、PostgreSQL、RDP 和 VNC 堡垒主机，不需要客户端应用或 SSH 包装器。 将其部署在您的 DMZ 中，添加用户账户，并轻松地将他们分配到网络内的特定主机和 URL。 Warpgate 将记录每个会话，供您通过内置的管理 Web UI（实时）查看和稍后回放。 内置基于浏览器的 SSH、RDP 和 VNC 访问；原生客户端继续正常工作。 不是跳板主机——以对客户端完全透明的方式将连接直接转发到目标。 原生 2FA 和 SSO 支持（TOTP 和 OpenID Connect）...
JumpServer > 3.6.4 - Information Disclosure
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...
warpgate v0.28.0-beta.1
Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...
CVE-2026-44347 Warpgate: SSO CSRF -- State Token Not Validated on Return
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on t...
EUVD-2026-29882
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on t...
PT-2026-40469
Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.23.3 Description The SSO flow fails to validate the state parameter. This allows an attacker to trick a user into logging into an account controlled by the attacker, which could lead the user to perform sensitive...
CVE-2026-31798
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and...
CVE-2023-43660
Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the...
CVE-2023-7325
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery SSRF vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix...
CVE-2023-7325
CVE-2023-7325 affects Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10. The vulnerability is a server-side request forgery (SSRF) in the xmlrpc.sock handler that accepts crafted XML-RPC requests to reach internal unix socket RPC endpoints and execute privileg...
CVE-2023-7325 Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery SSRF vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix...
EUVD-2025-37046
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket...
CVE-2025-62712
JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve connection tokens belonging to other users via the super-connection API endpoint...
VulnCheck KEV: CVE-2023-7325
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery SSRF vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix...