26 matches found
honeyLambda
Serverless trap honeyλ - a simple serverless application designed to create and monitor URL honeytokens, on top of AWS Lambda and Amazon API Gateway Slack notifications Email and SMS alerts Load config from local file or Amazon S3 Customize the HTTP response for each token Threat Intelligence...
TokenFlare
TokenFlare Serverless AITM Phishing Simulation Framework for Entra ID / M365 Features Lean: Core logic in src/worker.js only 530 lines of JavaScript. Modular: Supports a number of OAuth flows, with Intune Conditional Access bypass support out of the box Easily tweaked: Set up client branding, URL...
serverless
网站 • 文档 • X / Twitter • 社区 Slack • 论坛 The Serverless Framework – 使您可以轻松使用 AWS Lambda 和其他托管云服务，构建能够自动扩展、空闲时零成本且维护成本极低的应用。 Serverless Framework 是一个命令行工具，采用易用的 YAML 语法，既部署您的代码，也部署支持众多无服务器应用场景（如 API、前端、数据管道和定时任务）所需的云基础设施。它是一个多语言框架，支持 Node.js、Typescript、Python、Go、Java 等。它还通过 1,000...
AlertResponder
AlertResponder NOTE: This repository is obsoleted. New repository is here: https://github.com/m-mizutani/deepalert AlertResponder is a serverless framework for automatic response of security alert. Overview AlertResponder receives an alert that is event of interest from security view point and...
CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit
hi CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit Serverless Framework MCP Server CVE-2025-69256 Base Score: 9.4/10 → CTT Enhanced Score: 9.9/10 A critical command injection vulnerability in Serverless Framework's MCP Model Context Protocol server enhanced with CTT temporal...
CVE-2026-52832
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...
CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...
CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
CVE-2026-79754 Nuclio: Kaniko build tempDir command injection
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...
CVE-2026-52833 Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...
EUVD-2026-36101
Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container...
CVE-2026-46614
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an internal-style route — /fission-function/ and /fission-function// — for every Function object,...
PT-2026-48504
Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0 Description Fission is an open-source, Kubernetes-native serverless framework used for deploying functions and applications on Kubernetes. A flaw exists where a low-privilege developer with permissions to creat...
CVE-2026-29042
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the...
Exploit for CVE-2025-69256
hi CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MC...
Command Injection
Serverless Framework is vulnerable to Command Injection. The vulnerability is due to unsanitized user input being passed to childprocess.exec in the experimental MCP server feature, which allows an attacker to inject shell metacharacters and execute arbitrary system commands with the privileges o...
CVE-2025-69256
The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This...
serverless MCP Server vulnerable to Command Injection in list-projects tool
Summary A command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This vulnerability only affects users of the experimental MCP server feature serverless mcp, which represents less than 0.1% of Serverless Framework users. The core Serverle...
GHSA-RWC2-F344-Q6W6 serverless MCP Server vulnerable to Command Injection in list-projects tool
Summary A command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This vulnerability only affects users of the experimental MCP server feature serverless mcp, which represents less than 0.1% of Serverless Framework users. The core Serverle...