CVE-2026-3494_Verfication

CVE-2026-3494 - MariaDB serveraudit 로깅 검증 PoC 이 프로젝트는 MariaDB serveraudit 플러그인에서 SQL 쿼리 내 특정 인라인 주석, --이 사용될 때 발생할 수 있는 감사 로깅 우회를 검증하고 분석하기 위한 특수 환경을 제공합니다. 주요 발견 사항 v11.8.6의 로깅 누락 : MariaDB v11.8.6에서 특정 쿼리예: 주석이 포함된 SET PASSWORD 또는 Error 1046 케이스가 감사 로그에 기록되지 않는 현상이 관찰되었습니다. 해당 버전은 이전에 패치된 버전으로...

ALFA

ALFA Google Workspace 자동 감사 로그 법의학 분석 Copyright c 2026 Invictus Incident Response 원저자 Greg Charitonos & BertJanCyber Invictus Incident Response가 유지 관리 시작하기 전에 지원되는 운영 체제에 대한 참고 사항: ALFA는 여러 Linux 배포판Debian 및 Ubuntu에서 테스트되었습니다. Windows나 macOS에서 사용할 수도 있지만 결과가 다를 수 있으므로 자신의 책임 하에 진행하십시오. 설치 1. 이...

DFIR-O365RC

Содержание: 1. Описание модуля 2. Установка и предварительные требования 1. Использование Docker 2. Ручная установка 3. Управление приложением DFIR-O365RC 1. Создание приложения 2. Обновление приложения 3. Удаление приложения 4. Требования к разрешениям и лицензиям 5. Функции, включённые в модуль...

Elkeid

Elkeid - Платформа защиты рабочих нагрузок в облаке от ByteDance Английский | 简体中文 Elkeid — это решение с открытым исходным кодом, которое может удовлетворять требованиям безопасности различных рабочих нагрузок, таких как хосты, контейнеры, K8s и serverless. Оно основано на лучших внутренних...

cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - FacturaScripts EditUser Nick 매개변수 취약한 접근 제어 설명 요약 이 애플리케이션은 EditUser 컨트롤러로 전송되는 POST 요청 중 nick 매개변수를 검증하지 않습니다. UI에서는 이 필드의 편집을 차단하지만, 사용자는 프록시를 사용하여 이 제한을 우회 하고 관리자 계정을 포함한 모든 계정의 이름을 변경 할 수 있습니다. 이로 인해 취약한 접근 제어Broken Access Control 및 잠재적인 감사 로그 손상Audit Log Corruption 이 발생합니다. ...

CVE-2024-10793

CVE-2024-10793 PoC 이 줄들을 hosts 파일에 추가하세요: root@kitploit: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com Docker를 사용하여 Wordpress 실행: root@kitploit: $ sudo systemctl start docker $ sudo docker-compose up -d http://goodcms.lab:2121을 열고 워드프레스 설치 단계를 진행합니다. wordpress에 wp-security-audit-log.5.2.1 또는 이전 버전...

CVE-2026-84479

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-82267

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

EUVD-2026-67798

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267

Komodo (through version 2.3.2) contains a logic flaw in the /execute and /execute/{variant} API handlers, where internal resource identifiers are disclosed and audit log entries are written before permission checks are evaluated. Authenticated users can exploit this by guessing resource names to ...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093269)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093269 advisory. Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Log. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...

CVE-2026-44256

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

CVE-2026-44256

Wazuh (open-source threat prevention, detection, and response platform) is vulnerable to CRLF log injection in its API access logger. In versions 4.4.0 through 4.14.6 and 5.0.0-beta2 , the file api/api/middlewares.py decodes the Basic-authentication username before credential validation and passe...

EUVD-2026-62575

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

CVE-2026-44256 Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

GHSA-4H97-P9WQ-CHQJ Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...