EUVD-2026-87689

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export DataDump cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir contains an off-by-one in its path-component walk that skips the first segment...

EUVD-2026-87686

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

EUVD-2026-87657

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validatin...

The vulnerability of the “REDAAM” IT-infrastructure centralized management system, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the “REDAAM” IT-infrastructure centralized management system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management related to the lack of authentication for critical functions, allowing attackers to compromise the integrity and accessibility of protected information

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...

The vulnerability of the FOQUZ platform, related to incorrect restrictions on the name of the path to the catalog, allows attackers to compromise the integrity of the protected information.

The vulnerability of the FOQUZ platform is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of the FOQUZ platform, related to the incorrect duration of a session, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the FOQUZ platform is related to an incorrect session duration. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

The vulnerability of the FOQUZ platform, related to synchronization errors when using a shared resource, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the FOQUZ platform is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

investigations

調査 このリポジトリには、アムネスティ・インターナショナルが人権活動家に対する標的型脅威について実施した技術調査の一部から抽出された侵害指標（IOC）が含まれています。 これらの指標は、CC-BY ライセンスの下で共有されています。...

APT-Hunter

APT-Hunter 퍼플팀 관점으로 개발된 Windows 이벤트 로그 위협 헌팅. APT-Hunter는 Windows 이벤트 로그를 위한 위협 헌팅 도구입니다. 사전 정의된 탐지 규칙과 로그 통계를 사용하여 대량의 이벤트 속에 숨겨진 APT 활동을 드러내고, 의심스러운 행위를 찾아내는 데 필요한 시간을 단축합니다. 침해 평가compromise assessment에 특히 효과적입니다. 결과는 Excel, Timeline Explorer, Timesketch 및 유사한 도구에서 직접 분석할 수 있는 타임라인으로 작성되며, 선택적 ...

oauthseeker

OAuthSeeker OAuthSeeker は、Microsoft Azure および Office365 内でのユーザー ID を侵害するために、悪意のある OAuth アプリケーションを使用してフィッシング攻撃を実行するレッドチームツールです。 🚀 主な機能 OAuthSeeker には以下の主要な機能があります: Azure アプリ OAuth フィッシング: Microsoft Azure および Office365 ユーザーを標的とした OAuth フィッシング攻撃を実行し、Microsoft Graph API および Microsoft Azure...

active_c2_ioc_public

+OPTIONS: ^: +TITLE: アクティブなC2 IOC 注意 各エントリのfirstseen/lastseenの日付に注意してください。IPアドレスだけで判断しないでください。...

Azure-AD-Incident-Response-PowerShell-Module

Azure AD インシデントレスポンス PowerShell モジュール Azure Active Directory インシデントレスポンス PowerShell モジュールは、Azure Active Directory プロダクトグループが Microsoft Detection and Response Team DART と協力して開発した、侵害対応を支援するための多数のツールを提供します。 モジュールを使用する理由 このモジュールは以下の開発目標を満たしています: 迅速かつ簡単にインストールして使用できるツールを提供: 侵害時には複雑な設定手順は望ましくない...

IoCs

侵害指標（IoCs） Sophosが公開したレポート由来の侵害指標（IoC） root@kitploit: /@&&@ . @ @ %@%, ./&@@&@@@@ @@ @%&@@& .@, @. @ @% @ && %@ .@@@@. &@&@//@& @/ @ @@ @ %@. ,%@@@@@@@@@&/ ., @% @@ @@,&@@ ,@ .@. @ , @& ,@@@@& .@ @ .@. @ .@ @& @@. %@@% ./. @,...

CVE-2019-1040

CVE-2019-1040 훌륭한 글입니다! CVE-2019-1040 악용 - 릴레이 취약점을 결합한 RCE 및 도메인 관리자 권한 획득 . 그래서, 저는 쉽게 사용할 수 있도록 CVE-2019-1040.py를 작성했습니다. 또한 제 exchange2domain 저장소를 확인해보세요: https://github.com/ridter/exchange2domain, Exchange를 사용하여 DC를 획득하는 또 다른 방법입니다. 요구사항 이 도구는 impacket이 필요합니다. pip를 사용하여 pip install impacket으...

EUVD-2026-87455

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host...

CVE-2019-19781

CVE-2019-19781 CVE-2019-19781 攻撃トリアージスクリプト このスクリプトは、影響を受けたCitrix ADCデバイス上で実行し、侵害が発生したかどうかを判断するのに役立ちます。攻撃の一部として使用された関連コマンドやファイルを迅速にキャプチャします（クリーンアップが行われていない場合）。 $ ./CVE-2019-19781-Triage.sh 免責事項：提供されたスクリプトのテストには最善の努力が払われていますが、Redscanはスクリプトが実行されたアプライアンスに生じたいかなる影響に対しても責任を負いかねます。 クレジット...

Redash Setup Configuration - Default Secrets Disclosure

Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...

FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution

Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval, letting unauthenticated attackers execute arbitrary PHP code on the server. id: CVE-2026-6433 info: name: FlipperCode Custom CSS, JS & PHP = 2.0.7 -...

Traggo Server - Local File Inclusion

traggo/server version 0.3.0 is vulnerable to directory traversal. id: CVE-2023-34843 info: name: Traggo Server - Local File Inclusion author: DhiyaneshDk severity: high description: | traggo/server version 0.3.0 is vulnerable to directory traversal. impact: | Successful exploitation of this...