94 matches found
ConditionalAccessDocumentation
PowerShell을 사용한 조건부 액세스 문서화 이 PowerShell 스크립트는 Microsoft Entra 조건부 액세스 정책을 문서화합니다. 스크립트는 모든 데이터를 csv 파일로 내보내며, 이를 엑셀 통합 문서로 예쁘게 포맷할 수 있습니다. 모든 정책을 검색하고 문서화할 수 있도록 스크립트는 Microsoft Graph Beta API 엔드포인트를 사용합니다. 설치 및 사용 1. PowerShell 갤러리에서 이 스크립트를 설치합니다종속 Microsoft.Graph.Authentication 모듈이 자동으로 설치됩니다...
-CVE-2022-22954-scanner
CVE-2022-22954-scanner 취약점 소개 VMware Workspace ONE Access이전 명칭 VMware Identity Manager는 다중 인증, 조건부 액세스 및 SSOSingle Sign-On를 통해 직원이 SaaS, 웹 및 네이티브 모바일 애플리케이션에 더 빠르게 액세스할 수 있도록 설계되었습니다. 영향을 받는 버전은 다음과 같습니다: VMware Workspace ONE Access 어플라이언스 버전: 20.10.0.0, 20.10.0.1, 21.08.0.0, 21.08.0.1 VMware...
EntraFalcon
EntraFalcon EntraFalcon은 펜테스터, 보안 분석가, 시스템 관리자가 Microsoft Entra ID 환경의 보안 상태를 평가할 수 있도록 돕는 PowerShell 기반 평가 도구입니다. 사용 편의성을 염두에 두고 설계된 EntraFalcon은 PowerShell 5.1 및 7에서 실행되며, Windows와 Linux를 모두 지원하고, 추가 PowerShell 모듈이나 별도 설치, Microsoft Graph API 동의가 필요하지 않습니다. 이 도구는 종종 간과되는 권한 있는 객체, 잠재적으로 위험한 할당,...
TokenFlare
TokenFlare Entra ID / M365를 위한 서버리스 AITM 피싱 시뮬레이션 프레임워크 특징 간결함: 핵심 로직src/worker.js에 약 530줄의 JavaScript. 모듈형: 다양한 OAuth 흐름을 지원하며, Intune 조건부 액세스 우회 기능을 기본 내장 쉬운 조정: 반대화형 tokenflare configure campaign 하위 명령어로 클라이언트 브랜딩, URL 구조사용자 정의 유인 경로 및 매개변수, 인증 완료 후 최종 리디렉션 등을 설정 가능. 로컬 또는 원격 배포: Certbot으로 SSL...
caOptics
참고 개발 우선순위 변경과 커뮤니티 활동을 다른 영역PoC, 기타 도구, 데모/발표으로 재조정함에 따라 프로젝트가 보관 처리되었으며, 프로젝트는 읽기 전용으로 설정되었습니다. CA Optics - Azure AD Conditional Access Gap Analyzer Conditional Access란 무엇인가? 초기 테스터를 위한 참고 사항 릴리스 노트 문서 갭 예시 순열 생성 사전 요구 사항 중요 설명 - Conditional Access Gap 분석기 기존 도구와의 비교 범위 Opinionated 설계 설계 결정 플랫폼...
CVE-2026-54245
Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...
CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...
CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...
CVE-2026-54245
Fleet (open-source device management platform built on osquery) has a SQL injection in the Okta conditional access integration available in Fleet Premium. A value reported by a host's own agent is stored verbatim and then used in a database query without proper parameterization on an unauthentica...
EUVD-2026-66673
Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...
CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...
CVE-2026-54245: Improper Neutralization of Special Elements used in an SQL Command
Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...
GO-2026-6264 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database in github.com/fleetdm/fleet
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database in github.com/fleetdm/fleet...
GHSA-7Q96-F8XW-JV5J Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...
PT-2026-80753
Name of the Vulnerable Software and Affected Versions Fleet affected versions not specified Description A SQL injection exists in the Okta conditional access integration. An attacker controlling a single enrolled host can provide a value via the host agent that is used in a database query without...
PT-2026-33362
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 through 12.0 Description An incorrect authorization issue exists where the system fails to correctly check permissions assigned to developer credentials. This flaw allows low-privilege users to generate...
New Microsoft Secure Future Initiative (SFI) patterns and practices: Practical guides to strengthen security
Building on the momentum of our initial launch of the Microsoft Secure Future Initiative SFI patterns and practices, this second installment continues our commitment to making security implementation practical and scalable. The first release introduced a foundational library of actionable guidanc...