goblob

Goblob 🫐 Goblob 是一款轻量且快速的枚举工具，旨在帮助发现 Azure Blob 中公开暴露的敏感信息，可用于漏洞评估、渗透测试和情报收集等各种研究目的。 警告 。Goblob 会为每个存储账户中的每个容器名称生成独立的协程，仅受 -goroutines 参数指定的最大并发协程数限制。在大多数情况下，使用默认词表时，这种实现方式会迅速耗尽带宽，或者如果您在云环境中使用该工具，可能会产生高昂的费用。运行该工具前，请确保您清楚自己在做什么。 安装 go install github.com/Macmod/goblob@latest 用法 使用 goblob 只需运行以下命令：...

ClickOnceBlobber

ClickOnce AppDomainManager 注入工具包 通过 AppDomainManager 注入劫持依赖 DLL 并加载 C 移植的 ProxyBlob Agent，将已签名的 .NET ClickOnce 应用程序武器化，用于初始访问。附带 ProxyBlob 的 C 移植版本——一种通过 Azure Blob Storage 隧道传输所有流量的 SOCKS5 代理，可融入 .blob.core.windows.net 被列入白名单的环境中。 为什么有效 ClickOnce 是微软针对 .NET 应用程序的一键部署技术。当用户点击 .application URL...

BlobHunter

BlobHunter 一个用于扫描Azure Blob存储账户中公开Blob的开源工具。 BlobHunter是 Hunting Azure Blobs Exposes Millions of Sensitive Files 研究的一部分。 概述 BlobHunter可帮助您识别那些存储了任何有互联网连接的人均可公开访问的文件的Azure Blob存储容器。 该工具通过识别配置不当且存储敏感数据的容器来帮助降低风险，在存在大量难以跟踪的存储账户的大型Azure订阅中尤其有用。 BlobHunter会生成一份信息丰富的CSV结果文件，其中包含扫描环境中每个公开容器的重要详细信息。 要求 1...

CVE-2025-10681

CVE-2025-10681：硬编码的 Azure Blob 存储帐户密钥 公告 字段| 值 ---|--- CVE| CVE-2025-10681 ICSA| ICSA-26-055-03 CVSS 3.1| 8.6（高危） 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE| CWE-798（使用硬编码凭据） 研究人员| Michael Groberman — Gr0m 发布日期| 2026-02-24 产品 字段| 值 ---|--- 供应商| Gardyn 产品| Gardyn Home Kit 1.0, 2.0, 3.0,...

CVE-2026-55726

CVE-2026-55726：可公开列出的 Azure Blob 存储容器（设备日志） 公告 字段| 值 ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3（中危） 向量（3.1）| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 向量（4.0）| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE| CWE-497（向未授权控制范围暴露敏感系统信息） 研究人员...

CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-50173

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173

In Flow-Like before 1.0.4, the GET /api/v1/apps/{app_id}/invoke/presign route mints an Azure SAS token with sp=rwdl for any user holding only ExecuteEvents, even when they lack ReadFiles/WriteFiles. This lets low-privilege authenticated users directly write or delete blobs under the app content p...

[SECURITY] Fedora 44 Update: restic-0.19.1-1.fc44

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

PT-2026-57441

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.1 Parse Server versions 8.x through 8.6.83 Description A stored cross-site scripting XSS issue exists when the software fails to recognize an uploaded file's extension via the mime package,...

PYSEC-2026-784 Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

Summary The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. Severity...

EUVD-2026-41465

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container...

CVE-2026-55726

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container...

CVE-2026-55726

CVE-2026-55726 concerns Gardyn IoT Hub: the Azure Blob Storage container used for device logs is publicly listable without authentication, enabling access to any device log file in that container. The root cause is a misconfiguration of storage permissions, exposing logs to unauthenticated users....

CVE-2026-55726 Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container...

CVE-2026-55726

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container...

Malicious code in electron-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f On require'electron-orbit', the module unconditionally fires an auto-prefetch pipeline in Node contexts when no document is present that opens a raw...

[SECURITY] Fedora 44 Update: restic-0.19.0-1.fc44

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...