36 matches found
aws_pwn
AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...
cloudsplaining
Cloudsplaining Cloudsplaining es una herramienta de evaluaciรณn de seguridad de AWS IAM que identifica violaciones del principio de mรญnimo privilegio y genera un informe HTML priorizado por riesgo. Informe de ejemplo Documentaciรณn Para la documentaciรณn completa, visite el proyecto en ReadTheDocs...
CVE-2025-62506
CVE-2025-62506 Vulnerability Verification Script Overview This repository contains a verification script for CVE-2025-62506, a privilege escalation vulnerability in MinIO service accounts and STS Security Token Service accounts. Vulnerability Description CVE-2025-62506 is a privilege escalation...
Evaluating Behavioral Context for Interpretable IAM Policy Risk Scoring in Cloud Environments
IAM policy analysis typically emphasizes the authorization capabilities encoded in a policy, but security analyst review priority may also depend on the behavioral and environmental context surrounding a policy event. This paper evaluates whether contextual information provides measurable...
CVE-2026-82860
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
CVE-2026-82857
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...
EUVD-2026-68448
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
CVE-2026-82857
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy . The root cause is insufficient boundary restrictions on role lifecycle operations targeting af-e2e-* roles, allowing an attacker with the documented principal to create persistent hig...
EUVD-2026-68445
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...
CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...
CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...
CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...
CVE-2026-82857: Improper Privilege Management
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...
PT-2026-83737
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
PT-2026-83734
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...
orca-poc-target
orca-poc-target A deliberately small, deliberately vulnerable...
CVE-2026-73289 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...
CVE-2026-73289 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...