polaris

Polaris ist eine Open-Source-Richtlinien-Engine für Kubernetes Polaris ist eine Open-Source-Richtlinien-Engine für Kubernetes, die die Konfiguration von Ressourcen validiert und korrigiert. Sie enthält über 30 integrierte Konfigurationsrichtlinien sowie die Möglichkeit, benutzerdefinierte...

isr-sqlget

-- ISR - Infobyte Security Research -- | ISR-sqlget | www.infobytesec.com | ..:: DESCRIÇÃO ISR-sqlget: é uma ferramenta de injeção SQL cega desenvolvida em Perl. Permite obter esquemas de bancos de dados e linhas de tabelas. Usando um único GET/POST, você pode acessar discretamente a estrutura do...

airflowscan

airflowscan Checklist e strumenti per aumentare la sicurezza di Apache Airflow. AVVERTENZA Questo progetto NON È AFFILIATO con la Apache Foundation e il progetto Airflow, e non è da loro approvato. Contenuti Lo scopo di questo progetto è fornire strumenti per aumentare la sicurezza delle...

WebGoat.NET

Von der Eingabeaufforderung aus in das WebGoat.NET DB-Verzeichnis wechseln root@kitploit: % cd /WebGoat.NET/DB Starten Sie das mysql-Dienstprogramm und geben Sie den Namen und ggf. das Passwort eines Benutzers mit Berechtigung zum Erstellen von Datenbanken an. Um z. B. den Standard-Root-Benutzer ...

graphicator

Graphicator Graphicator è un "raschietto" / estrattore per GraphQL. Lo strumento itera sul documento di introspezione restituito dall'endpoint GraphQL di destinazione, e poi ristruttura lo schema in una forma interna in modo da poter ricreare le query supportate. Quando tali query vengono create,...

EUVD-2026-67931

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configure...

CVE-2026-41242

CVE-2026-41242 — protobuf.js Code-Injection zu RCE CVSS 9.4 Kritisch | Code-Injection CWE-94 Übersicht protobuf.js npm: protobufjs in den Versionen ≤ 7.5.4 und ≤ 8.0.0 ist anfällig für beliebige Codeausführung über Typnamen im protobuf-Schema. Das Modul @protobufjs/codegen fügt den Typnamen direk...

CVE-2026-77184

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

CVE-2026-81490

MongoDB Connector for BI (mongosqld) contains an improper error handling flaw in its schema-sampling routine. A database user who can create a view in a sampled namespace can define a view whose evaluation reliably fails. The sampling logic misclassifies the resulting server message as transient ...

CVE-2026-77184 MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

EUVD-2026-67779

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

CVE-2026-77184

MongoDB Connector for BI is affected by an incomplete escaping flaw: the description text of a collection's JSON schema validator is incorporated into the comment text of DDL returned by SHOW CREATE statements without fully escaping backslash characters. An attacker with permission to modify a co...

GraphQLmap

GraphQLmap GraphQLmap é um motor de script para interagir com um endpoint GraphQL para fins de teste de penetração. Install Funcionalidades e exemplos Despejar um esquema GraphQL Interagir com um endpoint GraphQL Executar consultas GraphQL Autocomplete de consultas Fuzzing de campo GraphQL Exempl...

sysmon-parser

sysmon-parser Parser Sysmon generato automaticamente per Azure Sentinel Sysmon-AllVersionsParser.txt può essere caricato come funzione in Azure Sentinel per analizzare tutti i tuoi eventi. È presente una pipeline Azure Devops che viene attivata quotidianamente per installare l'ultima versione di...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: Autenticazione mancante su /api/v1/full-spec divulga l'intero schema OpenAPI Prodotto: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/api/Spec.py CWE: CWE-306 — Autenticazione mancante per funzione critica CVSS 3.1:...

CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning

CVE-2026-21005 – Envenenamento de Imagens no Docker Registry V2 Schema 1 Código do Programa Python Flask + Shell root@kitploit: dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers':...

CVE-2025-27407

CVE-2025-27407 GitLab-Podman-Labor Minimales rein lokales Labor zum Nachweis, dass der GitLab-Direct-Transfer-HTTP-Pfad den verwundbaren graphql-ruby-Introspection-Schema-Loader erreicht. Das Labor betreibt einen einzelnen verwundbaren GitLab-CE-Container; das PoC-Skript startet seinen simulierte...

quokka

Quokka immagine generata da DALL-E Sommario Introduction Installation Usage Building Documentation FAQ Introduzione Quokka è un esportatore di binari: dal disassembly di un programma genera un file di export che può essere utilizzato senza il disassembler. Attualmente supporta IDA Pro , Ghidra e...

airflowscan

airflowscan Checklist and tools for increasing security of Apache Airflow. DISCLAIMER This project NOT AFFILIATED with the Apache Foundation and the Airflow project, and is not endorsed by them. Contents The purpose of this project is provide tools to increase security of Apache Airflow...

SuiteCRM Unauthenticated Graphql Introspection

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...