Elkeid

Elkeid - Bytedance 클라우드 워크로드 보호 플랫폼 English | 简体中文 Elkeid 는 호스트, 컨테이너, K8s, 서버리스 등 다양한 워크로드의 보안 요구 사항을 충족할 수 있는 오픈 소스 솔루션입니다. 이는 바이트댄스의 내부 모범 사례에서 비롯되었습니다. 기업의 비즈니스 발전에 따라 멀티 클라우드, 클라우드 네이티브, 여러 워크로드의 공존 상황이 점점 더 두드러지고 있습니다. 우리는 다양한 워크로드에서 보안 요구 사항을 충족할 수 있는 솔루션 세트가 있기를 바랐고, 그래서 Elkeid 가 탄생했습니다. ...

CVE-2024-10793

CVE-2024-10793 PoC 以下の行を hosts ファイルに設定してください: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com docker を使用して Wordpress を起動します: $ sudo systemctl start docker $ sudo docker-compose up -d http://goodcms.lab:2121 を開き、wordpress のインストール手順を実行してください。 wordpress に wp-security-audit-log.5.2.1...

ALFA

ALFA Google Workspace 자동 감사 로그 법의학 분석 Copyright c 2026 Invictus Incident Response 원저자 Greg Charitonos & BertJanCyber Invictus Incident Response가 유지 관리 시작하기 전에 지원되는 운영 체제에 대한 참고 사항: ALFA는 여러 Linux 배포판Debian 및 Ubuntu에서 테스트되었습니다. Windows나 macOS에서 사용할 수도 있지만 결과가 다를 수 있으므로 자신의 책임 하에 진행하십시오. 설치 1. 이...

DFIR-O365RC

목차: 1. 모듈 설명 2. 설치 및 전제 조건 1. Docker 사용하기 2. 수동 설치 3. DFIR-O365RC 애플리케이션 관리 1. 애플리케이션 생성 2. 애플리케이션 업데이트 3. 애플리케이션 제거 4. 권한 및 라이선스 요구 사항 5. 모듈에 포함된 함수 6. 생성되는 파일 DFIR-O365RC는 SSTIC 2021정보통신기술 보안 심포지엄에서 발표되었습니다. 프랑스어로 된 발표 슬라이드와 녹화 영상은 여기에서 확인할 수 있습니다. ⚠️ 2024년 3월 31일, Microsoft는 DFIR-O365RC에서 사용하던...

cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - FacturaScripts EditUser Nick パラメータのアクセス制御の欠陥 説明 概要 このアプリケーションは、EditUser コントローラへの POST リクエスト中に nick パラメータを検証できません。UI ではこのフィールドの編集は防止されていますが、ユーザーはプロキシを使用してこの制限をバイパス し、任意のアカウント（管理者を含む） をリネームできます。これにより、アクセス制御の欠陥（Broken Access Control） と、潜在的な監査ログの破損 が発生します。 詳細...

CVE-2026-3494_Verfication

CVE-2026-3494 - MariaDB serveraudit ログ記録検証 PoC このプロジェクトは、SQLクエリ内で特定のインラインコメント（、--）が使用された際に、MariaDBのserverauditプラグインにおける潜在的な監査ログバイパスを検証・分析するための専用環境を提供します。 主な発見 v11.8.6におけるログ記録漏れ : MariaDB v11.8.6（以前はパッチ適用済みと見なされていたバージョン）において、特定のクエリ（例: コメント付きのSET PASSWORDやError 1046のケース）が監査ログに記録されないことを確認しました。...

Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / galera / etc Multiple Vulnerabilities (crlsa-2022_1556)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221556 advisory. mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2154 mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2166 mysql: Inno...

Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / galera / etc Multiple Vulnerabilities (crlsa-2022_1557)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221557 advisory. mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2154 mysql: Server: DML unspecified vulnerability CPU Apr 2021 CVE-2021-2166 mysql: Inno...

PT-2026-103544

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description An authenticated administrator can set a configurable security-policy setting to a value exceeding the maximum permitted limit. This allows the associated security control to be rendered...

BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-84718

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

EUVD-2026-85613

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-84718

A flaw exists in the Ansible Automation Platform automation-controller where the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying it originated from a trusted proxy. By selecting the leftmost (attacker-controlled) header value, an attacker ...

EUVD-2026-84942

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

PT-2026-97546

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description In the production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying if it...

CVE-2026-84718: Use of Less Trusted Source

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-18161

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

CVE-2026-18161 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

CVE-2026-18161 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...

CVE-2026-18161

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to an issue where a remote authenticated attacker can falsify transaction audit logs . The root cause is the improper validation of a client-supplied HTTP header . No specific patch versions or exploit details are provided...