867 matches found
Reproduce-CVE-2024-21513
复现 CVE-2024-21513 概述 本项目演示了 langchain-experimental 包中的漏洞 CVE-2024-21513，该漏洞影响版本 =0.0.15 且 0.0.21。由于对检索到的所有值使用了 eval，VectorSQLDatabaseChain 组件在从数据库检索值时允许任意代码执行。 复现漏洞的工作流程 该应用程序允许你通过与电影相关的 SQL 数据库（包含 ID、标题、导演、年份、评分）进行对话。 使用 langchain 的 SQLDatabase 工具连接到 PostgreSQL 数据库。 利用 OpenAI 的 GPT 模型生成 SQL 查询。 ...
WebGoat.NET
Webgoat.NET Código fuente: https://github.com/jerryhoff/WebGoat.NET Descargar zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master Esta aplicación web es una plataforma de aprendizaje que intenta enseñar sobre fallos comunes de seguridad web. Contiene fallos de seguridad genéricos que...
Judge-Jury-and-Executable
法官、陪审团与执行者 一款威胁狩猎取证工具 特性： 立即扫描挂载的文件系统以发现威胁 或在事件发生前收集系统基线，以获得额外的威胁狩猎能力 可在事件发生前、发生中或发生后使用 适用于单台到多台工作站 扫描 MFT，绕过文件权限、文件锁定或操作系统文件保护/隐藏/阴影 为每个文件收集多达 51 个不同属性 扫描结果存入 SQL 表，便于后续搜索、跨多次扫描和/或多台机器聚合结果，以及进行历史或回溯分析 利用 SQL 的强大功能搜索文件系统、查询文件属性、回答复杂或高层级问题，并狩猎威胁或入侵指标 要求： .NET Framework v4.8 Microsoft Visual C++ 20...
cloudquery
CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...
BSQLinjector
BSQLinjector BSQLinjector 使用盲注方法从 SQL 数据库中检索数据。 我建议使用 "--test" 开关，以便在实际发送请求前清晰地查看配置后的 payload 样式。 选项： root@kitploit: --file Mandatory - File containing valid HTTP request and SQL injection point SQLINJECT. --file=/tmp/req.txt --pattern Mandatory - Pattern to look for when query is true...
jackdaw
jackdaw 收集 收集 收集 这是什么？ Jackdaw 旨在收集你域中的所有信息，将其存储到 SQL 数据库中，并以精美的图形展示域对象之间的交互关系，以及潜在攻击者可能如何利用这些交互。 它还附带一个便利的功能，可帮你处理密码破解项目：存储/查找/报告哈希/密码/用户。 快速使用信息 如果不使用自动收集（例如不在 Windows 上），你需要通过 dbinit 创建一个初始空数据库 首先你需要执行 enum。在 Windows 上可以双击可执行文件或输入 jackdaw.exe auto 自动完成。 其次你需要运行 nest 来启动 Web 界面。默认情况下，它提供在...
jackdaw
jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...
msdat
Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atabase A ttacking T ool is an open source penetration testing tool that tests the security of Microsoft SQL Databases remotely. Usage examples of MSDAT: You have a Microsoft database listening remotely...
securitybot
Securitybot Distributed alerting for the masses! Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber's blog post. Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster...
CVE-2026-69502
Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-69502
CVE-2026-69502 is a server-side request forgery (SSRF) vulnerability in Azure SQL Database that allows an unauthorized, network-based attacker to elevate privileges . The CNA-assigned CVSS 3.1 score is 10.0 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating no privileges ...
CVE-2026-69502 Azure SQL Database Elevation of Privilege Vulnerability
...
EUVD-2026-63994
Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-69502 Azure SQL Database Elevation of Privilege Vulnerability
...
EUVD-2026-63690
Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...
EUVD-2026-63622
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network...
EUVD-2026-63624
Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...
PT-2026-79396
Name of the Vulnerable Software and Affected Versions Azure SQL Database affected versions not specified Description Server-side request forgery SSRF allows an unauthorized attacker to elevate privileges over a network. SSRF is a flaw where an attacker can induce the server-side application to ma...