43 matches found
inspec_cve_2019_15224
一个恶意的 rest-client gem 2019年8月19日，发现rest-client gem有多个版本发布了包含恶意代码。在发现恶意的rest-client的同时，还确定了其他几个新的 gem 也携带了类似的代码。 相关报道： https://www.securityweek.com/backdoor-found-rest-client-ruby-gem https://www.theregister.co.uk/2019/08/20/rubygemhacked/ https://www.macobserver.com/news/ruby-11-backdoors/...
mysql-baseline
DevSec MySQL 基线 此合规性配置文件确保所有加固项目保持相同的质量。 https://github.com/dev-sec/ansible-collection-hardening/tree/master/roles/mysqlhardening https://github.com/dev-sec/chef-mysql-hardening https://github.com/dev-sec/puppet-mysql-hardening 独立使用 此合规性配置文件需要 cinc-auditor 或 InSpec 来执行： root@kitploit: git clone...
linux-baseline
DevSec Linux 基线 此合规配置文件确保所有加固项目保持相同的质量。 https://github.com/dev-sec/puppet-os-hardening https://github.com/dev-sec/chef-os-hardening https://github.com/dev-sec/ansible-os-hardening 独立使用 此合规配置文件需要 InSpec 来执行： root@kitploit: $ git clone https://github.com/dev-sec/linux-baseline $ inspec exec...
windows-security-cve-2017-8543
Ejemplo de Perfil InSpec Este ejemplo muestra la implementación de un perfil de InSpec...
ssh-baseline
DevSec SSH 基线 此合规配置文件确保所有加固项目保持相同的质量。 https://github.com/dev-sec/puppet-ssh-hardening https://github.com/dev-sec/chef-ssh-hardening https://github.com/dev-sec/ansible-ssh-hardening 独立使用 此合规配置文件需要 InSpec 来执行： root@kitploit: $ git clone https://github.com/dev-sec/ssh-baseline $ inspec exec...
nginx-baseline
DevSec Nginx 基线 此合规性配置文件确保所有加固项目保持相同的质量。 https://github.com/dev-sec/ansible-nginx-hardening https://github.com/dev-sec/chef-nginx-hardening https://github.com/dev-sec/puppet-nginx-hardening 独立使用 此合规性配置文件需要 InSpec 来执行： root@kitploit: $ git clone https://github.com/dev-sec/nginx-baseline $ inspec...
inspec-log4j
inspec-log4j 此配置文件直接在文件系统以及嵌入在WAR文件中扫描易受攻击的Log4j Core JAR文件版本。 在本地运行配置文件 root@kitploit: git clone https://github.com/trickyearlobe/inspec-log4j inspec exec inspec-log4j 针对远程SSH目标运行配置文件 确保目标上已为特权用户（如root）加载SSH密钥。 或者，查看CLI文档，了解如何使用Inspec与SUDO。 root@kitploit: git clone...
inspec_CVE-2016-5195
用于检测 CVE-2016-5195（即 Dirty COW）的 Inspec 配置文件。 该配置文件包含一个控制项，它执行此处详述的步骤来评估漏洞。有关 Dirty COW 及脚本的更多信息。 请注意，此测试需要几分钟才能执行完毕。...
regreSSHion
regreSSHion 用于检查 regreSSHion 漏洞 CVE-2024-6387 的 Chef Inspec 配置文件 请根据您自己的需求修改此文件。此处仅作为示例提供。...
CVE-2025-6723
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
CVE-2025-6723
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
CVE-2025-6723 Untrusted user data can lead to privilege escalation
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
CVE-2025-6723
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
CVE-2025-6723 Untrusted user data can lead to privilege escalation
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
EUVD-2025-206578
Chef InSpec up to version 5.23 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated...
CVE-2025-6723
CVE-2025-6723 : Red Hat and NVD entries describe that Chef InSpec up to version 5.23 creates named pipes with overly permissive default Windows access controls. A local attacker could interfere with the pipe connection process and exploit insufficient access restrictions to assume the InSpec exec...
CVE-2025-6723 Untrusted user data can lead to privilege escalation
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
Chef InSpec authorization issue vulnerability
Chef InSpec is an open-source automation testing and compliance checking framework developed by Chef Inc. It aims to assist developers and operations teams in writing, running, and maintaining automated test scripts to verify the compliance and security of applications and infrastructure. Chef...