aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...

cloudsplaining

Cloudsplaining Cloudsplaining 是一个 AWS IAM 安全评估工具，用于识别违反最小权限原则的情况，并生成基于风险优先级的 HTML 报告。 示例报告 文档 完整的文档，请访问 ReadTheDocs 上的项目。 安装 速查表 示例报告 概述 Cloudsplaining 能够识别 AWS IAM 策略中违反最小权限原则的情况，并生成美观的 HTML 报告。它可以扫描您 AWS 账户中的所有策略、跨多个 AWS 账户扫描，或者扫描单个策略文件。 该工具有助于识别未使用资源约束的 IAM 操作，同时通过标记出以下无限制情况下给 AWS 账户带来风险的 IAM...

CVE-2025-62506

Script de Verificación de Vulnerabilidad CVE-2025-62506 Descripción General Este repositorio contiene un script de verificación para CVE-2025-62506, una vulnerabilidad de escalada de privilegios en cuentas de servicio de MinIO y cuentas STS Servicio de Token de Seguridad. Descripción de la...

CVE-2026-82860

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

CVE-2026-82857

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

EUVD-2026-68448

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

CVE-2026-82857

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy . The root cause is insufficient boundary restrictions on role lifecycle operations targeting af-e2e-* roles, allowing an attacker with the documented principal to create persistent hig...

CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

EUVD-2026-68445

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

PT-2026-83734

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

PT-2026-83737

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

CVE-2026-82857: Improper Privilege Management

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

orca-poc-target

orca-poc-target A deliberately small, deliberately vulnerable...

CVE-2026-73289 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

CVE-2026-73289 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

CVE-2026-73289 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...