cfripper

CFRipper CFRipper — это библиотека и CLI-анализатор безопасности для шаблонов AWS CloudFormation. Вы можете использовать CFRipper для предотвращения развертывания небезопасных ресурсов AWS в вашем облачном окружении. Вы также можете писать собственные проверки соответствия, добавляя новые плагины...

checkov

...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...

aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

cloudformation-waf-acl

cloudformation-waf-acl AWS CloudFormation टेम्पलेट जो AWS WAFv2 संसाधनों को प्रोविज़न और प्रबंधित करने के लिए उपयोग किया जाता है, जिसमें Web ACL, प्रबंधित नियम समूह, एक कस्टम regex पैटर्न सेट, और एक IP सेट शामिल हैं। घटक टेम्पलेट निम्नलिखित प्रदान करता है: 1. एक AWS::WAFv2::WebACL। 2. AWS प्रबंधि...

cfn_nag

पृष्ठभूमि cfn-nag टूल CloudFormation टेम्पलेट्स में ऐसे पैटर्न खोजता है जो असुरक्षित इंफ्रास्ट्रक्चर का संकेत दे सकते हैं। मोटे तौर पर, यह निम्नलिखित की तलाश करेगा: IAM नियम जो बहुत अनुमतिपूर्ण हैं वाइल्डकार्ड सुरक्षा समूह नियम जो बहुत अनुमतिपूर्ण हैं वाइल्डकार्ड एक्सेस लॉग जो सक्षम नहीं हैं...

serverless-application-model

Преобразование AWS SAM Преобразование AWS Serverless Application Model AWS SAM — это макрос AWS CloudFormation, который преобразует шаблоны SAM в шаблоны CloudFormation. Чтобы использовать преобразование SAM, добавьте AWS::Serverless-2016-10-31 в раздел Transform вашего шаблона CloudFormation...

apche-struts-vuln-demo-cve-2018-11776

Démo de vulnérabilité Apache Struts CVE-2018-11776 Description Met en place un environnement de test isolé pour expérimenter avec la vulnérabilité Apache Struts CVE-2018-11776. Pour commencer Pour lancer l'environnement de test, exécutez la commande suivante : root@kitploit: aws cloudformation...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: runc, amazon-k8s-cni, ctop, nri-apache, containerd, k9s, nri-elasticsearch, flux, omnibump, crossplane-provider-azure-sql, glab, crossplane-provider-azure-storage, dapr, harbor, opa-envoy, vcluster, crossplane, docker-machine-driver-harvester, hcloud,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, containerd, k9s, buildkitd, flux, crossplane-provider-azure-sql, glab, crossplane-provider-azure-storage, kargo, docker-compose, fscrypt, cilium-cli, hcloud, terragrunt, pulumi-language-yaml, witness, crossplane-provider-azure-managedidentity...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: runc, local-static-provisioner, kapp, ctop, mesosphere-vsphere-csi, sonobuoy, crossplane-provider-azure-sql, s5cmd, cilium-cli, azure-workload-identity-webhook, grafana-rollout-operator, ingress-nginx-controller, crossplane-provider-sql,...

GHSA-464C-974J-9XM6 AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

Summary The AWS Cloud Development Kit AWS CDK is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified an issue in which explicitly setting encrypted: true on the S3LoggingOptions property of an AWS...

CVE-2026-44795

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

CVE-2026-44795

CVE-2026-44795 affects Spinnaker (Cloud deployments/baking paths) where unsafe YAML processing bypasses safe deserialization via a non-safe constructor, enabling arbitrary Java class loading and remote code execution. Affected versions precede fixed releases and include 2026.1.0, 2026.0.3, 2025.4...

CVE-2026-44795 Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the YAML processing. An attacker can execute arbitrary code by supplying crafted YAML input that triggers unsafe class loading during operations such as CloudFormation deployments or CloudFoundry...

Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing: CloudFormation deployments CloudFoundry Baking The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE. Patches 2025.3.3,...

PT-2026-51444

Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 2026.1.0 Spinnaker versions prior to 2026.0.3 Spinnaker versions prior to 2025.4.4 Spinnaker versions prior to 2025.3.3 Description Unsafe YAML processing bypasses safe deserialization during CloudFormation...

CVE-2026-47358

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery SSRF via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external URLs referenced within those templates v...