browser-identity-attacks-matrix

Browser & Identity Attacks Matrix This repository is a collection of browser and identity attack techniques covering SaaS apps, browser-based attacks, identity providers, and phishing. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about...

prey-android-client

Aquí encontrarás todo el código fuente de las versiones actual y en desarrollo del cliente de Prey para dispositivos Android. Prey es una plataforma SaaS para el rastreo de dispositivos, monitoreo, protección de datos y administración de dispositivos. Su agente de código abierto se ejecuta en los...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

grove

Grove 是一个软件即服务（SaaS）日志收集框架，旨在支持从本身不支持日志流式传输的服务中收集日志。 Grove 使团队能够以可靠且一致的方式从其供应商处收集安全相关事件。然后，这些数据可以使用团队现有的工具进行存储和分析，以支持威胁检测和合规计划。 开箱即用，Grove 提供： 🪵 可靠且周期性的日志收集。 ☁️ 支持大量广泛使用的 SaaS 应用程序和服务。 🧱 基于插件的“连接器”，以支持新的应用程序和服务。 🧳 “自带”缓存、输出、配置和机密后端。 Grove 由 HashiCorp 安全团队创建并持续维护。 请注意 ：虽然这不是一个官方的 HashiCorp...

CVE-2026-18741

CVE-2026-18741 - Stored XSS in Worksuite SaaS About CVE-2026-18741 is a Stored XSS vulnerability affecting Worksuite SaaS versions prior to 6.0.14. The issue is located in the Asset Management module. User-controlled input can be stored through fields such as: Location Description The stored inpu...

Advantech WISE-IoTSuite/SaaS - SQL Injection

Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the filename parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code such as the use of pgsleep for time delays to...

trivy-plugin-aqua

trivy-plugin-aqua Plugin de Trivy para integración con la plataforma SaaS de Aqua Security Uso Las opciones de Trivy deben pasarse después de --. Trivy recibe un directorio de destino que contiene archivos IaC Establece el plugin de Aqua como el plugin predeterminado actual de Trivy exportando un...

cirrusgo

CirrusGo 一款用 Go 编写的快速扫描 SaaS、PaaS 应用的工具 支持的 SaaS 应用： salesforce contentful（下一版本） 注意：-o 输出标志不起作用 安装： 需要 Go 1.18 版本 root@kitploit: go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or go install -v github.com/Ph33rr/CirrusGo/cmd/cirrusgo@latest 帮助： root@kitploit: cirrusgo --help...

PurplePanda

PurplePanda 该工具从不同的云/SaaS应用中获取资源，重点关注权限，以便识别云/SaaS配置中的权限提升路径和危险权限 。注意，PurplePanda 会同时搜索平台内和跨平台的权限提升路径 。 名称来源于动物Red Panda 。这只熊猫吃豌豆，就像 Purple Panda 一样，它可以吞食由 PEASS 发现的 API 密钥/令牌。颜色改为紫色是因为该工具主要面向紫队 （因为它对蓝队和红队都高度有用 ）。 如何使用 /intel 中的每个文件夹定义一个可枚举的平台，并包含一个 README.md 文件，解释如何使用该特定模块 。 下载 Neo4jDesktop...

saas_enum

SaaS Enum SaaS Enum es una herramienta de línea de comandos para descubrir las plataformas SaaS que una empresa puede estar utilizando. La herramienta busca registros DNS que coincidan con patrones de proveedores conocidos y, opcionalmente, realiza comprobaciones web ligeras para confirmar...

saas_enum

SaaS Enum SaaS Enum es una herramienta de línea de comandos para descubrir las plataformas SaaS que una empresa puede estar utilizando. La herramienta busca entradas DNS que coincidan con patrones conocidos de proveedores y, opcionalmente, realiza comprobaciones web ligeras para confirmar...

ciso-assistant-community

¡Dale una estrella al proyecto 🌟 para recibir notificaciones de lanzamientos y ayudar a hacer crecer la comunidad! intuitem.com · Prueba gratuita de SaaS · Hoja de ruta · Documentación · Idiomas · Discord · Marcos de trabajo...

StalkPhish

StalkPhish project has been renamed StalkPhish-OSS You can find the new project page here: https://github.com/t4d/StalkPhish-OSS Online StalkPhish SaaS You can found our online StalkPhish SaaS application on https://www.Stalkphish.io and use the REST API available for free. Join us You can join u...

CVE-2026-23552

CVE-2026-23552 - Aceptación de tokens entre reinos en camel-keycloak Resumen La KeycloakSecurityPolicy de Apache Camel no valida la reclamación iss emisor de los tokens JWT contra el reino configurado. Esto significa que un token emitido por un reino de Keycloak es aceptado silenciosamente por un...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform Disclosure Date: 2025-10-28 Last Updated: 2025-10-28 Reporter: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Summary A stored Cross-Site Scripting XSS vulnerability wa...

CVE-2026-55375

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

EUVD-2026-78905

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API . In versions prior to 3.0.0 , Request::buildRequestUrl() joins path variable values without URL-encoding each segment. An attacker who controls a path variable value (e.g., scheme or contentId) through a consuming applicatio...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...