bulwark

조직의 자산 및 취약점 관리 도구로, Jira 통합 기능을 갖추고 있으며 애플리케이션 보안 보고서 생성을 위해 설계되었습니다. 기능 다중 클라이언트 취약점 관리 보안 보고서 생성 Jira 통합 팀 기반 역할 권한 부여 API 키 및 관리 이메일 통합 Markdown 지원 사용자 활성화/비활성화 관리자 참고 사항 이 프로젝트는 초기 개발 단계에 있음을 양해 부탁드립니다. 데모 Jira 통합 Docker로 실행 1. Docker 설치 2. .env 파일을 만들고 다음 속성을 입력하세요: root@kitploit:...

SecurityManageFramwork

SecurityManageFramwork-SeMF README English | 中文 소개 SEMF 는 기업 내부 네트워크를 위한 보안 관리 플랜폼으로, 자산 관리, 취약점 관리, 계정 관리, 지식 베이스 관리 및 보안 스캐닝 자동화 기능을 포함합니다. 내부 보안 관리에 사용될 수 있습니다. 이 플랫폼은 보안 인력이 적고, 비즈니스 라인이 복잡하며, 정기 점검이 어렵고 자동화 수준이 낮은 갑甲方 측이 내부 보안 관리를 더 잘 수행할 수 있도록 돕기 위해 설계되었습니다. 이 소프트웨어는 내부 IT 자산 관리 전용이며, 공격적인...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

ElectricEye

ElectricEye ElectricEyeは、マルチクラウド・マルチSaaS向けのPython CLIツールで、アセット管理、セキュリティ態勢管理、攻撃対象領域監視を提供します。数百のサービスと評価をサポートし、CSPおよびSaaS環境を強化するための制御を、20以上の業界、規制、ベストプラクティスの制御フレームワークにマッピングしています。...

CVE-2020-4463

IBM Maximo Asset Management は、XXE 脆弱性 CVE-2020-4463 による情報漏えいに対して脆弱です IBM Maximo Asset Management は、XML データを処理する際に XML 外部エンティティインジェクション XXE 攻撃に対して脆弱です。リモートの攻撃者がこの脆弱性を悪用して、機密情報を公開したり、メモリリソースを消費させたりする可能性があります。 基本スコア: 8.2 ベクター: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L 影響を受けるコアコンポーネント IBM Maximo...

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

CVE-2026-18741

CVE-2026-18741 - XSS Almacenado en Worksuite SaaS Acerca de CVE-2026-18741 es una vulnerabilidad de XSS almacenado que afecta a Worksuite SaaS en versiones anteriores a la 6.0.14. El problema se encuentra en el módulo de Gestión de Activos. La entrada controlada por el usuario puede almacenarse a...

EUVD-2026-42998

Snipe-IT has incorrect permission for legacy license checkin API...

EUVD-2026-42989

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...

EUVD-2026-42997

Snipe-IT has CSV formula injection in Activity Report export...

CVE-2026-55703

creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:05+00:00| published-proof-of-concept| https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q...

CVE-2026-55519

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...

EUVD-2026-62627

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...

CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...

CVE-2026-55703

Snipe-IT (IT asset/license management system) prior to 8.6.3 contains an authorization bypass in MaintenancesController::show(). The method renders a maintenance record without calling authorize(), unlike all sibling actions (index, edit, update, destroy) which properly gate on the asset. Any act...

CVE-2026-55519 Snipe-IT: Improper Authorization in File Deletion (IDOR)

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...

CVE-2026-55519

In Snipe-IT versions before 8.4.1, the destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php perform class-level authorization checks instead of instance-level checks, enabling any authenticated user with generic asset edit ...

CVE-2026-55519 Snipe-IT: Improper Authorization in File Deletion (IDOR)

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...

CVE-2026-61296

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite component: Linear Asset Management. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61359

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite component: Linear Asset Management. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...