ElectricEye

ElectricEye ElectricEye는 자산 관리, 보안 태세 관리 및 공격 표면 모니터링을 위한 멀티 클라우드, 멀티 SaaS Python CLI 도구로, CSP 및 SaaS 환경을 강화하기 위해 수백 개의 서비스와 평가를 지원하며, 20개 이상의 업계, 규제 및 모범 사례 통제 프레임워크에 매핑된 통제를 제공합니다...

SecurityManageFramwork

SecurityManageFramwork-SeMF README English | 中文 소개 SEMF 는 기업 내부 네트워크를 위한 보안 관리 플랜폼으로, 자산 관리, 취약점 관리, 계정 관리, 지식 베이스 관리 및 보안 스캐닝 자동화 기능을 포함합니다. 내부 보안 관리에 사용될 수 있습니다. 이 플랫폼은 보안 인력이 적고, 비즈니스 라인이 복잡하며, 정기 점검이 어렵고 자동화 수준이 낮은 갑甲方 측이 내부 보안 관리를 더 잘 수행할 수 있도록 돕기 위해 설계되었습니다. 이 소프트웨어는 내부 IT 자산 관리 전용이며, 공격적인...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

bulwark

조직의 자산 및 취약점 관리 도구로, Jira 통합 기능을 갖추고 있으며 애플리케이션 보안 보고서 생성을 위해 설계되었습니다. 기능 다중 클라이언트 취약점 관리 보안 보고서 생성 Jira 통합 팀 기반 역할 권한 부여 API 키 및 관리 이메일 통합 Markdown 지원 사용자 활성화/비활성화 관리자 참고 사항 이 프로젝트는 초기 개발 단계에 있음을 양해 부탁드립니다. 데모 Jira 통합 Docker로 실행 1. Docker 설치 2. .env 파일을 만들고 다음 속성을 입력하세요: root@kitploit:...

CVE-2020-4463

IBM Maximo Asset Management は、XXE 脆弱性 CVE-2020-4463 による情報漏えいに対して脆弱です IBM Maximo Asset Management は、XML データを処理する際に XML 外部エンティティインジェクション XXE 攻撃に対して脆弱です。リモートの攻撃者がこの脆弱性を悪用して、機密情報を公開したり、メモリリソースを消費させたりする可能性があります。 基本スコア: 8.2 ベクター: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L 影響を受けるコアコンポーネント IBM Maximo...

CVE-2026-18741

CVE-2026-18741 - Worksuite SaaS における保存型XSS 概要 CVE-2026-18741 は、Worksuite SaaS のバージョン 6.0.14 未満に影響する保存型XSSの脆弱性です。 この問題は資産管理モジュールに存在します。 ユーザーが制御する入力は、以下のようなフィールドを通じて保存される可能性があります: 場所 説明 保存された入力は、影響を受ける資産が表示された際に後でレンダリングされ、攻撃者が制御するJavaScriptが、資産を表示しているユーザーのブラウザコンテキストで実行される可能性があります。 影響を受けるバージョン...

Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application

Summary There are multiple security vulnerability in IBM Maximo Asset Management application Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089

A SQL injection vulnerability in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_USER ) to exploit the DATE_FORMAT parameter in two shipped JasperReports ("Maintenance contracts expired" and "Maintenance contracts strategy") via the reporting REST API (POST /rest/rep...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-86736

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

Exploit for CVE-2026-18741

CVE-2026-18741 - Stored XSS in Worksuite SaaS...

EUVD-2026-42998

Snipe-IT has incorrect permission for legacy license checkin API...

EUVD-2026-42989

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...

EUVD-2026-42997

Snipe-IT has CSV formula injection in Activity Report export...

CVE-2026-55703

creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:05+00:00| published-proof-of-concept| https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q...

CVE-2026-55519

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...

EUVD-2026-62627

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...