owLSM

🛡️ owLSM aspire à devenir la référence en matière de prévention et de détection pour Linux 🛡️ owLSM est un agent eBPF LSM qui implémente un moteur de règles Sigma avec état, axé sur la prévention. Qu'est-ce que le projet : owLSM se concentre sur trois aspects principaux : 1 Des capacités de...

Hermes-Proxy

Hermes Proxy Hermes Proxy est une application de bureau d'interception HTTP/HTTPS construite avec Electron et Vite. Elle capture les requêtes/réponses, permet de rejouer les requêtes et d'exporter/importer des fichiers HAR. Fonctionnalités Tableau du trafic en direct avec les détails des...

cloud-custodian

Cloud Custodian c7n Cloud Custodian, également connu sous le nom de c7n, est un moteur de règles pour la gestion des comptes et des ressources cloud publics. Il permet aux utilisateurs de définir des politiques pour une infrastructure cloud bien gérée, à la fois sécurisée et optimisée en termes d...

CVE-2026-39842

CVE-2026-39842: Выполнение произвольного кода через внедрение выражений в Rules Engine OpenRemote Краткое описание Критическая уязвимость удалённого выполнения кода в Rules Engine OpenRemote позволяет аутентифицированным пользователям с ролью write:rules выполнять произвольный код на сервере с...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon est une application de modélisation des menaces gratuite, open-source et multiplateforme, comprenant un outil de diagrammes système et un moteur de règles pour générer automatiquement des menaces/mitigations. C'est un projet incubateur OWASP. L'accent est mis sur...

CVE-2026-71235

A flaw was found in Magistrala's Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

CVE-2026-71235

CVE-2026-71235 affects Magistrala’s Rules Engine, where authenticated users can create rules with embedded Go or Lua scripts that execute server-side when IoT messages arrive. The Go engine (re/golang.go) runs scripts via Yaegi, exposing the full Go standard library (including os and net/http) wi...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

Exploit for CVE-2026-39842

CVE-2026-39842: OpenRemote Expression Injection RCE in Rules E...

CVE-2026-39842

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval...

CVE-2026-39842

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the rules engine process. An attacker can execute arbitrary code on the server, read arbitrary files, steal environment variables including database credentials, and bypass multi-tenant isolation to access da...

CVE-2026-39842

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval...

CVE-2026-39842 OpenRemote is Vulnerable to Expression Injection

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval...

GHSA-7MQR-33RV-P3MP Expression Injection in OpenRemote

Summary The OpenRemote IoT platform's rules engine contains two interrelated critical expression injection vulnerabilities that allow an attacker to execute arbitrary code on the server, ultimately achieving full server compromise. - Unsandboxed Nashorn JavaScript Engine: JavaScript rules are...

PT-2026-32964

Summary The OpenRemote IoT platform's rules engine contains two interrelated critical expression injection vulnerabilities that allow an attacker to execute arbitrary code on the server, ultimately achieving full server compromise. - Unsandboxed Nashorn JavaScript Engine: JavaScript rules are...

GHSA-9F3R-2VGW-M8XP File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter

Description The resourcePatchHandler in http/resource.go validates the destination path against configured access rules before the path is cleaned/normalized. The rules engine rules/rules.go uses literal string prefix matching strings.HasPrefix or regex matching against the raw path. The actual...

PT-2026-25856

Name of the Vulnerable Software and Affected Versions File Browser versions 2.61.2 and below Description File Browser, a file managing interface, has an issue where an authenticated user with Create or Rename permissions can bypass administrator-configured deny rules. This is due to the order in...

CVE-2026-24904 TrustTunnel has `client_random_prefix` rule bypass via fragmented or partial TLS ClientHello

TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In tlslistener.rs, TlsListener::listen peeks 1024 bytes and calls extractclientrandom.... If parsetlsplaintext fails for example, a fragmented/partial ClientHello split across TCP writes,...