20317 matches found
WinShareEnum
WinShareEnum Windows 共享枚举器 下载 https://github.com/nccgroup/WinShareEnum/raw/master/Info/WinShareEnum.exe 在我的本地（非域）网络上针对一个网段运行，其中包含几个测试共享。请记住，这主要用于域环境/大型网络： 选项： 几点说明： root@kitploit: 将用户名设置为 "." 将在本地进行身份验证，而不是在域上进行，即 .\guest 将尝试以 guest 账户在本地对每台服务器进行身份验证，而不是使用 \guest 支持多个 IP 范围（例如 10.0-255.0.0-242...
WindowsDACLEnumProject
Windows DACL Enum Project Windows DACL を列挙・分析するためのツール群 NCC Group Plc によりオープンソースとして公開 - http://www.nccgroup.com/ 開発: Ollie Whitehouse ollie dot whitehouse at nccgroup dot com https://github.com/nccgroup/WindowsDACLEnumProject AGPL のもとで公開されています。詳細は LICENSE を参照してください。 Windows DACL と ACE の概要 参照 -...
WMIcmd
問題 低影響の調査やその他の類似活動を行う際、ディスクに書き込まれるもの / 露見するものを最小限に抑えたい場合があります。 このツールを使用すると、WMIを介してコマンドを実行し、このチャネルでは他に得られない情報を取得できます。 目的 WMIのみを使用して以下を行う小さなユーティリティ: コマンドシェルコマンドを実行する これらのコマンドの標準出力をキャプチャしてレジストリに書き込む レジストリから読み取り、その後削除する ローカルの標準出力に出力する 設計 このツールは以下で構成されています: NCC Group 内部コアライブラリ WMICore のごく小さなサブセット コマンド...
yaml2yara
简介 由 NCC Group Plc 开源发布 - http://www.nccgroup.com/ 开发者：David Cannings @edeca [email protected] http://www.github.com/nccgroup/yaml2yara 本项目基于 AGPL 许可证发布。更多信息请参阅 LICENSE。 概述 此仓库包含一个脚本，可根据 YAML 输入创建自定义检测规则。 它用于为多条输入数据自动生成同一条规则，例如： 检测被盗代码签名证书的规则。 检测利用文档中已知易受攻击的 OLE 组件的规则。 检测已知恶意资源（图标、对话框等）的规则。...
CVE-2026-88915
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharinggroupid. The instantiation path passed that value into event creation without verifying that the user...
CVE-2026-88915
MISP ≤2.5.45 is affected by an authorization bypass in the event template instantiation path. When a template uses distribution = 4 , the template's sharing_group_id was passed directly into event creation without verifying that the acting user is permitted to use that sharing group via SharingGr...
CVE-2026-88915 MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharinggroupid. The instantiation path passed that value into event creation without verifying that the user...
EUVD-2026-75409
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharinggroupid. The instantiation path passed that value into event creation without verifying that the user...
CVE-2026-88915 MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharinggroupid. The instantiation path passed that value into event creation without verifying that the user...
DEBIAN-CVE-2026-84828
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828
A local privilege escalation and information disclosure flaw in PCS (Pacemaker Configuration System) allows a user with membership in the haclient group to read arbitrary files on the filesystem via the pcs host auth --token command. The pcsd daemon reads file contents with root privileges , and ...
CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
EUVD-2026-75396
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
kernel: net: bridge: stop fast-leave after deleting a port group
A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...
kernel: net: bridge: stop fast-leave after deleting a port group
A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...