phishlulz

PhishLulz PhishLulz è un insieme di strumenti Ruby progettato per automatizzare le attività di Phishing. Quando avvii una campagna di phishing, viene generata un'istanza dedicata Amazon EC2 Debian 7. La VM viene fornita con vari strumenti open source che sono stati combinati. I due componenti...

cowcloud

CowCloud una soluzione serverless per distribuire carichi di lavoro in AWS CowCloud è stato originariamente creato per eseguire strumenti di ricognizione e scan di vulnerabilità in modo distribuito; per esempio, un caso d'uso potrebbe essere quello dei cacciatori di bug bounty. Questa soluzione è...

c2-cloud

About The Project The C2 Cloud is a robust web-based C2 framework, designed to simplify the life of penetration testers. It allows easy access to compromised backdoors, just like accessing an EC2 instance in the AWS cloud. It can manage several simultaneous backdoor sessions with a user-friendly...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

poro

poro Descrizione Scansiona le risorse accessibili pubblicamente nel tuo ambiente AWS Servizi coperti da questo strumento: AWS ELB API Gateway Bucket S3 Database RDS istanze EC2 Database Redshift Poro controlla anche se un tag specificato è applicato alle risorse pubbliche identificate usando gli...

aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

metabadger

Metabadger Prevent SSRF attacks on AWS EC2 via automated upgrades to the more secure Instance Metadata Service v2 IMDSv2. Metabadger Purpose and functionality Diagnose and evaluate your current usage of the AWS Instance Metadata Service along with understanding how the service works Prepare you t...

metabadger

Metabadger SSRF-Angriffe auf AWS EC2 verhindern durch automatisierte Upgrades auf den sichereren Instance Metadata Service v2 IMDSv2. Metabadger Zweck und Funktionalität Diagnostizieren und bewerten Sie Ihre aktuelle Nutzung des AWS Instance Metadata Service und verstehen Sie, wie der Service...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, newrelic-infra-operator, crossplane-provider-aws-dynamodb, gostatsd, external-secrets-operator, nri-apache, istio, crossplane, harbor, snyk-cli, helm, kubo, buildah, crossplane-provider-aws-kms, docker-credential-acr-env, govulncheck,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-dynamodb, external-secrets-operator, istio, rootlesskit, snyk-cli, wolfictl, helm, buildah, crossplane-provider-aws-kms, tw, crossplane-provider-keycloak, apko, docker-cli-buildx, buildkitd, gptscript, openbao, gomplate, zot, dagger, melange,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: k3d, newrelic-infra-operator, crossplane-provider-aws-dynamodb, gostatsd, kor, pgtimetable, timescaledb-parallel-copy, vertical-pod-autoscaler, wave, extism, mesosphere-vsphere-csi, kubo, rancher-telemetry, restic, amass, rabbitmq-default-user-credential-updater,...

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied projectid for an EC2-type credential was not validated against the project of the authenticating...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...

SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...

EUVD-2026-52417

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the loadawscredentials function with the redactsecret parameter set to false, circumventing the...

Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

PYSEC-2026-2924 PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

Summary passthrough and apassthrough in praisonai accept a caller-controlled apibase parameter that is concatenated with endpoint and passed directly to httpx.Client.request when the litellm primary path raises AttributeError. No URL scheme validation, private IP filtering, or domain allowlist is...

PYSEC-2026-1125 Ansible may expose private key

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availabili...