security-study-plan

一个实用的学习计划，旨在帮助你成为成功的网络安全工程师，涵盖渗透测试、应用安全、云安全、DevSecOps等角色，提供免费/付费资源、工具和概念，助你精通技能。 内容涵盖但不限于： 已完成 1. 网络安全学习计划通用技能 2. AWS 安全学习计划 3. GCP 安全学习计划 4. Web 渗透测试学习计划 5. 应用安全测试计划 6. API 安全学习计划 7. 威胁建模学习计划 8. GRC 学习计划 9. Azure 安全学习计划 10. DevSecOps 学习计划 11. Docker 安全学习计划 12. Kubernetes 安全学习计划 13. 网络安全学习计划 14...

Security Bulletin: Security Vulnerability in commons-lang affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-48924)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to commons-lang library. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...

Umbrella_android

Umbrella Umbrella è un'applicazione mobile Android sviluppata da Security First che fornisce ai difensori dei diritti umani informazioni su cosa fare in qualsiasi situazione di sicurezza e gli strumenti per farlo. Permette all'utente di scegliere cosa vuole fare, come: proteggere i dati; effettua...

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. id: CVE-2026-25892 info: name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent Do...

certificate-of-compromise

Certificato di Compromissione SoK/Whitepaper sulle operazioni offensive contro il Servizio Certificati di Active Directory v1.0.0 Documento Vivo e Contributi della Comunità Questo documento è un documento vivo. La ricerca su ADCS non è statica: le tecniche vengono corrette, vengono scoperte nuove...

solarwinds-sunburst-cve-2020-10148

🔍 Ricerca sulle vulnerabilità Una collezione curata di writeup approfonditi sulle vulnerabilità che coprono incidenti di sicurezza reali nell'ecosistema software. Ogni voce include un'analisi tecnica completa, proof-of-concept, elenco di IOC e indicazioni per la remediation. Scopo: Riferimento...

spectre-meltdown-checker

Spectre & Meltdown Checker Uno script shell autonomo per valutare la resilienza del tuo sistema contro le diverse CVE di esecuzione transitoria pubblicate dall'inizio del 2018, e fornire indicazioni su come mitigarle. Elenco CVE...

Cybersecurity-Mastery-Roadmap

🛡️ Roadmap Definitiva per la Padronanza della Cybersecurity Una guida completa e passo passo per padroneggiare la cybersecurity dal livello principiante a quello esperto, con risorse selezionate, strumenti e indicazioni di carriera 📋 Indice dei Contenuti Introduzione Come Usare Questa Roadmap...

CyberPup

CyberPup Eine kostenlose, quelloffene Cybersicherheits-App für den Alltag. CyberPup hilft nicht-technischen Nutzern, ihr digitales Leben mit geführten Checklisten, häppchenweisen Lektionen und Werkzeugen wie der Überprüfung auf Datenlecks zu sichern. Alle Anleitungen basieren auf bekannten...

Astra Linux – Vulnerability in Tomcat9

DEPRECATED: There is a vulnerability related to authentication bypass in digest authentication in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and versions prior to 7.0.0...

EventLogging

Avviso Questo repository non è più mantenuto da aprile 2024 BHIS Avviso Questo repository non è più mantenuto da aprile 2024 EventLogging Questo repository contiene indicazioni sulla configurazione della registrazione degli eventi. Queste indicazioni sono suddivise in sezioni, Defensive Readiness...

TheDefendersGuide

O Guia do Defensor - É Perigoso Defender Sozinho, Leve Isto! O que é o Guia do Defensor? O Guia do Defensor é um projeto de Luke Paine e Jonathan Johnson para reunir todos os melhores recursos de defesa para um aspecto específico de um sistema operacional em um único lugar. Muitas vezes, como...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

[SECURITY] Fedora 43 Update: perl-Devel-Cover-1.51-4.fc43

This module provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code. By using Devel::Cover you can discover areas of code not exercised by your tests and determine which tests to create to increase coverage. Code coverage can be considered as an...

metasploitable2-pentest-series

Metasploitable2 Penetration Testing Series A series of vulner...

Security Bulletin: Uncontrolled resource consumption in the Consul Connect authorization endpoint

Summary Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

Exposure of Resource to Wrong Sphere

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the elementId parameter, which allows interpolation of environment variables and secrets into a Twig template even when the Twig sandbox is enabled. A...

Important: Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image

A new satellite/iop-advisor-frontend-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services...

CVE-2026-61466 Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...

CVE-2026-63687

Apache CXF JwtRequestCodeFilter exposes PKCE and OIDC replay protections by copying all claims from a signed request JWT into the authorization parameter map without excluding sensitive parameters. A adversary who can produce a validly-signed JWT (e.g., with a known/compromised client_secret) can...