43 matches found
CVE-2021-42561
CVE-2021-42561: Injection de commandes via le plugin Human dans MITRE Caldera Dans Caldera versions =2.8.1, le plugin Human transmet le paramètre name non assaini à une fonction Python "os.system". Cela permet aux attaquants d'utiliser des métacaractères shell par exemple les backticks "" ou les...
CVE-2021-42559
CVE-2021-42559: حقن الأوامر عبر الإعدادات في MITRE Caldera يحتوي كالدرا الإصدارات =2.8.1 على عدة "متطلبات" تشغيلية تقوم بتنفيذ أوامر عند بدء تشغيل الخادم. نظرًا لأنه يمكن تغيير هذه الأوامر عبر Rest API، يمكن لمستخدم موثَّق إدراج أوامر عشوائية سيتم تنفيذها عند إعادة تشغيل الخادم. إفادة البائع: يمك...
CVE-2021-42558
CVE-2021-42558 : Multiples Cross-Site Scripting dans MITRE Caldera Caldera versions =2.8.1 contient plusieurs vulnérabilités XSS réfléchies, stockées et self-XSS qui peuvent être exploitées par des attaquants authentifiés et non authentifiés. Divulgation du fournisseur : La divulgation du...
CVE-2021-42562
CVE-2021-42562: MITRE Caldera의 부적절한 접근 제어 Caldera버전 =2.8.1는 사용자 권한을 제대로 분리하지 않아, 비관리자 사용자가 관리자 사용자만 접근할 수 있어야 하는 구성 또는 기타 구성 요소를 읽고 수정할 수 있게 됩니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개 내용은 여기에서 확인할 수 있습니다. 요구사항: 이 취약점에는 다음이 필요합니다: 유효한 비관리자 사용자 자격 증명 개념 증명: 자세한 내용과 악용 과정은 이 PDF에서 확인할 수 있습니다. 추가 리소스: 이 취약점을 통...
soc-automation-lab
مختبر أتمتة مركز العمليات الأمنية SOC يُوثّق هذا المستودع التصميم، ومنطق الكشف، وسير العمل الآلي، والدروس المستفادة من بناء عرض توضيحي لمركز عمليات أمنية SOC آلي باستخدام أدوات مفتوحة المصدر. يركز المشروع على كيفية انتقال التنبيهات من الكشف إلى التحقيق والإشعار ، وما يحدث من أعطال على طول الطريق...
EUVD-2025-4278
Malicious code in bioql PyPI...
EUVD-2022-43879
Malicious code in bioql PyPI...
EUVD-2022-44380
Malicious code in bioql PyPI...
EUVD-2022-43880
Malicious code in bioql PyPI...
Simulating Cyberattacks through a Breach Attack Simulation (BAS) Platform Empowered by Security Chaos Engineering (SCE)
In today digital landscape, organizations face constantly evolving cyber threats, making it essential to discover slippery attack vectors through novel techniques like Security Chaos Engineering SCE, which allows teams to test defenses and identify vulnerabilities effectively. This paper proposes...
CVE-2022-40606
MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40605...
MITRE Caldera dynamic compilation command injection
Added: 02/28/2025 Background MITRE Caldera is a security platform for emulating adversaries. Problem The dynamic compilation functionality in the Manx and Sandcat agents is affected by an injection vulnerability which could allow remote command execution. Resolution Upgrade to Caldera 5.1.0 or...
MITRE Caldera dynamic compilation command injection
Added: 02/28/2025 Background MITRE Caldera is a security platform for emulating adversaries. Problem The dynamic compilation functionality in the Manx and Sandcat agents is affected by an injection vulnerability which could allow remote command execution. Resolution Upgrade to Caldera 5.1.0 or...
CVE-2025-27364
In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution RCE vulnerability was found in the dynamic agent implant compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web...
MITRE Caldera 安全漏洞
MITRE Caldera is a MITRE open source automated adversarial simulation platform. A security vulnerability exists in MITRE Caldera versions 4.2.0 and earlier and 5.0.0 and earlier, which stems from remote code execution in the Dynamic Proxy Compilation feature and allows an attacker to execute...
CVE-2025-27364
In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution RCE vulnerability was found in the dynamic agent implant compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web...
CVE-2025-27364
In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution RCE vulnerability was found in the dynamic agent implant compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web...
CVE-2025-27364
MITRE Caldera vulnerability CVE-2025-27364 affects Caldera server in versions up to 4.2.0 and 5.0.0 prior to the commit 35bc06e. It is a Remote Code Execution (RCE) in the server’s dynamic agent (implant) compilation feature, allowing a remote attacker to run arbitrary code on the Caldera host vi...
caldera -- Remote Code Execution
MITRE Caldera contributor report: In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution RCE vulnerability was found in the dynamic agent implant compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is...
