Abused-Legitimate-Services

악용되는 합법적 서비스 합법적인 타사 PaaSPlatform-as-a-Service 제공업체는 점점 더 위협 행위자들에 의해 피싱 및 악성코드 배포에 활용되고 있습니다. 클라우드 인스턴스, 마케팅 플랫폼, CDN콘텐츠 전송 네트워크, 동적 DNS 서버 등의 PaaS 제공업체는 다양한 악성 활동에 무기화되었습니다. 주요 이점 중 하나는 탐지 시스템을 회피하는 데 사용될 수 있다는 점입니다. 이는 확립된 신뢰 수준과 합법적 사용으로 인해 사전 차단될 가능성이 낮아지기 때문입니다. 자세한 분석은 여기 블로그에서 확인하세요:...

cirrusgo

CirrusGo Un outil rapide pour scanner les applications SAAS et PAAS écrit en Go Support des applications SAAS : salesforce contentful prochaine version Note : le flag -o output ne fonctionne pas installation : golang version 1.18 go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or go...

Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

Source: amazon-inspector ffdc9c111498bf0f75d014ef58b811df488c9014addfb1ed64f7ab28cf9c11b1 On require'@galicia-toolkit-nestjs-20/paas', index.js unconditionally loads prebuilds/-/metrics.node at module top level inside a try/catch. The shipped ELF addon reads AWSACCESSKEYID, AWSSECRETACCESSKEY,...

Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

Source: amazon-inspector fb9736fcd5112c468c10509da5d624384a70802de5e20b218ad2cbebe0c7a443 The package declares scripts.preinstall node index.js || true, and index.js also the main entry requires a platform-specific prebuilt native addon at prebuilds/-/metrics.node. The native binary reads a curat...

Malicious code in @galicia-toolkit-nestjs/paas (npm)

Source: amazon-inspector 5df4f7b59cbe90e6b36ce17f0870cd419345167d9aee683d65a43c65ea5fb213 The package's main entry index.js loads a prebuilt native addon prebuilds/-/metrics.node inside a try/catch on require. The ELF reads CI and cloud credentials from the environment — AWSACCESSKEYID,...

MAL-2026-17730 Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9736fcd5112c468c10509da5d624384a70802de5e20b218ad2cbebe0c7a443 The package declares scripts.preinstall node index.js || true, and index.js also the main entry requires a platform-specific prebuilt native addon at...

CVE-2026-34048

CVE-2026-34048 Маршруты начальной загрузки терминала, доступные только администраторам, проверяли только состояние входа в систему, что позволяло обычному участнику команды управлять серверной частью терминала Coolify в реальном времени и выполнять команды на серверах команды. Введение Я обнаружи...

CVE-2026-86059

Prior to version 0.29.13 , the self-hostable PaaS Dokploy suffered from a vulnerability where organization members without Git provider access could retrieve plaintext credentials. The root cause is that certain protected procedures for github.one , gitlab.one , gitea.one , and bitbucket.one fail...

CVE-2026-84385

A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7....

EUVD-2026-72925

A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7....

CVE-2026-84385

A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7....

CVE-2026-84385

A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7....

CVE-2026-84385

Fortinet FortiSOAR (both PaaS and on-premise ) is affected by an improper access control vulnerability spanning versions 7.3 through 7.6.6 (all 7.3 and 7.4 versions; 7.5.0–7.5.3; 7.6.0–7.6.6). The flaw may allow an attacker with low privileges to achieve privilege escalation over the network with...

CVE-2026-26084: Improper Access Control

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...

CVE-2026-84385: Improper Access Control

A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7....

PT-2026-87177

A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7....

CVE-2026-45790 Dokploy: Invitation Role Escalation Allows Organization Takeover

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...

CVE-2026-45790 Dokploy: Invitation Role Escalation Allows Organization Takeover

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while...

The vulnerability of Azure SQL Managed Instance, a PaaS service, arises from insufficient network connection restrictions for specified endpoints. This allows attackers to escalate their privileges.

The vulnerability of Azure SQL Managed Instance PaaS is related to insufficient network connection restrictions for specified endpoints. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

CVE-2026-72878

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via childprocess.exec. An...