43 matches found
linux-baseline
DevSec Linux 기준선 이 규정 준수 프로필은 모든 강화 프로젝트가 동일한 품질을 유지하도록 보장합니다. https://github.com/dev-sec/puppet-os-hardening https://github.com/dev-sec/chef-os-hardening https://github.com/dev-sec/ansible-os-hardening 독립 실행 사용법 이 규정 준수 프로필을 실행하려면 InSpec이 필요합니다. root@kitploit: $ git clone...
ssh-baseline
DevSec SSH 기준 이 규정 준수 프로파일은 모든 강화 프로젝트가 동일한 품질을 유지하도록 보장합니다. https://github.com/dev-sec/puppet-ssh-hardening https://github.com/dev-sec/chef-ssh-hardening https://github.com/dev-sec/ansible-ssh-hardening 독립 실행 사용법 이 규정 준수 프로파일은 실행을 위해 InSpec이 필요합니다: root@kitploit: $ git clone...
nginx-baseline
DevSec Nginx 基线 此合规性配置文件确保所有加固项目保持相同的质量。 https://github.com/dev-sec/ansible-nginx-hardening https://github.com/dev-sec/chef-nginx-hardening https://github.com/dev-sec/puppet-nginx-hardening 独立使用 此合规性配置文件需要 InSpec 来执行： root@kitploit: $ git clone https://github.com/dev-sec/nginx-baseline $ inspec...
inspec_CVE-2016-5195
CVE-2016-5195（別名Dirty COW）を検出するためのInSpecプロファイル。 このプロファイルには、脆弱性を評価するためにこちらに詳述された手順を実行する1つのコントロールが含まれています。Dirty COWおよびスクリプトの詳細情報。 このテストの実行には数分かかることに注意してください。...
mysql-baseline
DevSec MySQL 기준선 이 규정 준수 프로필은 모든 강화 프로젝트가 동일한 품질을 유지하도록 보장합니다. https://github.com/dev-sec/ansible-collection-hardening/tree/master/roles/mysqlhardening https://github.com/dev-sec/chef-mysql-hardening https://github.com/dev-sec/puppet-mysql-hardening 독립 실행 사용법 이 규정 준수 프로필은 실행을 위해 cinc-auditor 또는...
inspec_cve_2019_15224
악성 rest-client gem 2019년 8월 19일, rest-client gem에 악성 코드를 포함한 여러 버전이 게시된 것이 발견되었습니다. 악성 rest-client를 발견하는 과정에서, 몇몇 다른 새로운 gem들도 유사한 코드를 포함하고 있는 것으로 확인되었습니다. 관련 보도: https://www.securityweek.com/backdoor-found-rest-client-ruby-gem https://www.theregister.co.uk/2019/08/20/rubygemhacked/...
regreSSHion
regreSSHion regreSSHion の脆弱性 CVE-2024-6387 をチェックするための Chef Inspec プロファイル 必要に応じてこれを変更してください。これは例として提供されています。...
windows-security-cve-2017-8543
예제 InSpec 프로필 이 예제는 InSpec 프로필의 구현을 보여줍니다...
inspec-log4j
inspec-log4j このプロファイルは、脆弱性のあるバージョンのLog4j Core JARファイルを、ファイルシステム上およびWARファイル内に埋め込まれた状態で直接スキャンします。 プロファイルをローカルで実行する root@kitploit: git clone https://github.com/trickyearlobe/inspec-log4j inspec exec inspec-log4j リモートSSHターゲットに対してプロファイルを実行する 対象マシンに特権ユーザー（rootなど）のSSHキーが読み込まれていることを確認してください。...
CVE-2025-6723
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
CVE-2025-6723
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
CVE-2025-6723 Untrusted user data can lead to privilege escalation
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
CVE-2025-6723
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
EUVD-2025-206578
Chef InSpec up to version 5.23 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated...
CVE-2025-6723 Untrusted user data can lead to privilege escalation
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
CVE-2025-6723
CVE-2025-6723 : Red Hat and NVD entries describe that Chef InSpec up to version 5.23 creates named pipes with overly permissive default Windows access controls. A local attacker could interfere with the pipe connection process and exploit insufficient access restrictions to assume the InSpec exec...
CVE-2025-6723 Untrusted user data can lead to privilege escalation
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially...
Chef InSpec authorization issue vulnerability
Chef InSpec is an open-source automation testing and compliance checking framework developed by Chef Inc. It aims to assist developers and operations teams in writing, running, and maintaining automated test scripts to verify the compliance and security of applications and infrastructure. Chef...