goblob

Goblob 🫐 Goblob은 Azure Blob에 공개적으로 노출된 민감 정보를 발견하는 데 도움을 주는 가볍고 빠른 열거 도구입니다. 이는 취약점 평가, 침투 테스트, 정찰 등 다양한 연구 목적에 유용할 수 있습니다. 경고. Goblob은 각 저장소 계정에서 확인할 각 컨테이너 이름에 대해 개별 고루틴을 생성하며, -goroutines 플래그에 지정된 최대 동시 고루틴 수로만 제한됩니다. 이 구현은 기본 워드리스트를 사용할 경우 대부분의 경우 대역폭을 빠르게 소진하거나, 클라우드 환경에서 도구를 사용할 경우 많은 비용이 발...

CVE-2026-55726

CVE-2026-55726: Container Azure Blob Storage con elenco pubblico log dei dispositivi Avviso Campo| Valore ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 Medio Vettore 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vettore 4.0|...

CVE-2025-10681

CVE-2025-10681: Chiave dell'account Azure Blob Storage hardcoded Avviso Campo| Valore ---|--- CVE| CVE-2025-10681 ICSA| ICSA-26-055-03 CVSS 3.1| 8.6 High Vettore| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE| CWE-798 Uso di credenziali hardcoded Ricercatore| Michael Groberman — Gr0m Pubblicat...

ClickOnceBlobber

ClickOnce AppDomainManager Injektions-Toolkit Waffnen Sie signierte .NET ClickOnce-Anwendungen für den Erstzugriff, indem Sie eine Abhängigkeits-DLL per AppDomainManager-Injection kapern und einen C-Port des ProxyBlob-Agenten laden. Enthält einen C-Port von ProxyBlob – einen SOCKS5-Proxy, der den...

BlobHunter

BlobHunter Uno strumento open-source per scansionare gli account di archiviazione blob di Azure alla ricerca di blob aperti pubblicamente. BlobHunter fa parte della ricerca Hunting Azure Blobs Exposes Millions of Sensitive Files. Panoramica BlobHunter ti aiuta a identificare i contenitori di...

CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-50173

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173

In Flow-Like before 1.0.4, the GET /api/v1/apps/{app_id}/invoke/presign route mints an Azure SAS token with sp=rwdl for any user holding only ExecuteEvents, even when they lack ReadFiles/WriteFiles. This lets low-privilege authenticated users directly write or delete blobs under the app content p...

[SECURITY] Fedora 44 Update: restic-0.19.1-1.fc44

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

PT-2026-57441

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.1 Parse Server versions 8.x through 8.6.83 Description A stored cross-site scripting XSS issue exists when the software fails to recognize an uploaded file's extension via the mime package,...

PYSEC-2026-784 Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

Summary The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. Severity...

EUVD-2026-41465

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container...

CVE-2026-55726

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container...

CVE-2026-55726

CVE-2026-55726 concerns Gardyn IoT Hub: the Azure Blob Storage container used for device logs is publicly listable without authentication, enabling access to any device log file in that container. The root cause is a misconfiguration of storage permissions, exposing logs to unauthenticated users....

CVE-2026-55726 Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container...

CVE-2026-55726

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container...

Malicious code in electron-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f On require'electron-orbit', the module unconditionally fires an auto-prefetch pipeline in Node contexts when no document is present that opens a raw...

[SECURITY] Fedora 44 Update: restic-0.19.0-1.fc44

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...