petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

django-DefectDojo

DefectDojo | ---|--- DefectDojo es una herramienta de DevSecOps, ASPM gestión de la postura de seguridad de aplicaciones y gestión de vulnerabilidades. DefectDojo orquesta pruebas de seguridad de extremo a extremo, seguimiento de vulnerabilidades, deduplicación, remediación y generación de...

cluster-image-scanner

ClusterImageScanner 在生產環境中發現漏洞和容器镜像配置错误。 简介 ClusterImageScanner 能检测 Kubernetes 集群中的镜像，并根据各种安全测试提供快速反馈。建议在生产环境中运行 ClusterImageScanner，以便在安全漏洞产生实际影响时获得及时反馈。 由于 ClusterImageScanner 本身是运行在 Kubernetes 集群中的服务，你可以复用现有的部署流程。 概述 下图提供了概述： 执行以下步骤。 1. 镜像收集器，顾名思义，从容器环境（如 Kubernetes 集群）中收集不同的镜像。收集器创建一个 JSON...

CVE-2026-16764

CVE-2026-16764 OWASP DefectDojo 中通过 isstaff API 绕过导致的权限提升。 摘要 仅拥有 auth.changeuser 权限的用户可以通过两个步骤提升为超级用户： 1. 通过 REST API 在自己的账户上设置 isstaff=true（验证仅阻止 issuperuser） 2. 访问 Django Admin 并勾选 issuperuser 复选框 受影响版本 2.59.0 修复版本 2.58.3, 2.58.4, 3.0.0+ CVSS 7.8 High -...

django-DefectDojo v3.3.100

DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...

django-DefectDojo v3.2.400

DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...

CVE-2026-16764

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764

The CVE pertains to OWASP DefectDojo 2.59.0, where the UserSerializer in dojo/api_v2/serializers.py mishandles the is_staff argument, enabling improper privilege management. This issue can be exploited remotely; an exploit exists publicly. Remediation is to upgrade to DefectDojo 2.58.3 or 3.0.0, ...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764: Improper Privilege Management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

PT-2026-64184

Name of the Vulnerable Software and Affected Versions OWASP DefectDojo version 2.59.0 Description Improper privilege management occurs in the API/Web component within the UserSerializer function located in the dojo/api v2/serializers.py file. A remote attacker can manipulate the is staff argument...

CVE-2026-7510

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510 OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510

The CVE-2026-7510 entry concerns OWAP DefectDojo up to 2.55.4, with an authorization bypass affecting the Benchmark/Engagement/Product/Survey functionality. The issue is reachable remotely and is supported by a public disclosure; upgrading to DefectDojo 2.56.0 addresses the vulnerability (patch e...

CVE-2026-7510 OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

CVE-2026-7510

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...