bulwark

一款组织资产与漏洞管理工具，集成 Jira，专为生成应用安全报告而设计。 功能特性 多客户端漏洞管理 安全报告生成 Jira 集成 基于团队的角色授权 API 密钥与管理 电子邮件集成 Markdown 支持 用户激活/停用（管理员） 注意 请注意，该项目正处于早期开发阶段。 演示 Jira 集成 使用 Docker 启动 1. 安装 Docker 2. 创建一个 .env 文件并提供以下属性： root@kitploit: MYSQLDATABASE="bulwark" MYSQLPASSWORD="bulwark" MYSQLROOTPASSWORD="bulwark"...

ElectricEye

ElectricEye ElectricEye 是一款多云、多 SaaS 的 Python CLI 工具，用于资产管理、安全态势管理和攻击面监控，支持数百种服务和评估，以强化您的 CSP 和 SaaS 环境，控制措施映射至超过 20 个行业、监管和最佳实践控制框架。...

SecurityManageFramwork

SecurityManageFramwork-SeMF README English | 中文 项目介绍 SEMF 是一款适用于企业内网安全管理平台，包含资产管理，漏洞管理，账号管理，知识库管、安全扫描自动化功能模块，可用于企业内部的安全管理。 本平台旨在帮助安全人员少，业务线繁杂，周期巡检困难，自动化程度低的甲方，更好的实现企业内部的安全管理。本软件只用作企业内部IT资产管理，无攻击性行为。请使用者遵守《中华人民共和国网络安全法》,勿将SEMF用于非授权测试，作者不负任何连带法律责任。 喜欢请点 Star，如果不打算贡献，千万别...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

CVE-2026-18741

CVE-2026-18741 - XSS Almacenado en Worksuite SaaS Acerca de CVE-2026-18741 es una vulnerabilidad de XSS almacenado que afecta a Worksuite SaaS en versiones anteriores a la 6.0.14. El problema se encuentra en el módulo de Gestión de Activos. La entrada controlada por el usuario puede almacenarse a...

Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application

Summary There are multiple security vulnerability in IBM Maximo Asset Management application Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in...

CVE-2020-4463

IBM Maximo Asset Management 存在通过 XXE 漏洞导致的信息泄露 CVE-2020-4463 IBM Maximo Asset Management 在处理 XML 数据时容易受到 XML 外部实体注入 XXE 攻击。远程攻击者可以利用此漏洞泄露敏感信息或消耗内存资源。 基础评分: 8.2 向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L 受影响的核心组件 IBM Maximo Asset Management 7.6.0 IBM Maximo Asset Management 7.6.1 IBM Maximo...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089

A SQL injection vulnerability in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_USER ) to exploit the DATE_FORMAT parameter in two shipped JasperReports ("Maintenance contracts expired" and "Maintenance contracts strategy") via the reporting REST API (POST /rest/rep...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-86736

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

Exploit for CVE-2026-18741

CVE-2026-18741 - Stored XSS in Worksuite SaaS...

EUVD-2026-42998

Snipe-IT has incorrect permission for legacy license checkin API...

EUVD-2026-42989

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...

EUVD-2026-42997

Snipe-IT has CSV formula injection in Activity Report export...

CVE-2026-55703

creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:05+00:00| published-proof-of-concept| https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q...

CVE-2026-55519

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...

EUVD-2026-62627

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...