security-study-plan

A Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps, and so on with free/paid resources, tools, and concepts to excel. It will cover but not limited to: Done 1. Common Skills for Security Study Plan 2. AWS Security...

Cybersecurity-Mastery-Roadmap

🛡️ Ultimate Cybersecurity Mastery Roadmap A comprehensive, step-by-step guide to mastering cybersecurity from beginner to expert level with curated resources, tools, and career guidance 📋 Table of Contents Introduction How to Use This Roadmap Roadmap Overview Foundation Phase Technical Skills Phas...

CyberPup

CyberPup A free, open-source cybersecurity app for everyday people. CyberPup helps non-technical users lock down their digital lives through guided checklists, bite-sized lessons, and tools like breach checking. All guidance is grounded in well-known frameworks from ACSC, CISA, and NIST -...

certificate-of-compromise

Certificate of Compromise SoK/Whitepaper on Offensive Operations against Active Directory Certificate Service v1.0.0 Living Document & Community Contributions This paper is a living document. ADCS research is not static — techniques get patched, new conditions are discovered, and community analys...

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. id: CVE-2026-25892 info: name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent Do...

1day-archive

1dayexploit - archive Technical deep-dives and root cause analyses of recently disclosed CVEs. About This repository collects technical write-ups of recently disclosed CVEs — the 1-day window between patch release and widespread exploitation. Each analysis contains: Affected product, vendor, and...

Umbrella_android

Umbrella Umbrella is an Android mobile app developed by Security First that provides human rights defenders with the information on what to do in any given security situation and the tools to do it. It allows the user to choose what they want to do, such as: protect data; securely make a...

spectre-meltdown-checker

Spectre & Meltdown Checker Un script shell autonome pour évaluer la résilience de votre système face aux multiples CVE d'exécution transitoire publiées depuis début 2018, et vous donner des conseils sur la façon de les atténuer. Liste des CVE CVE| Nom| Alias ---|---|--- CVE-2017-5753| Contourneme...

Astra Linux – Vulnerability in Tomcat9

DEPRECATED: There is a vulnerability related to authentication bypass in digest authentication in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and versions prior to 7.0.0...

EventLogging

Notice This repo is no longer maintined as of April 2024 BHIS Notice This repo is no longer maintined as of April 2024 EventLogging This repo contains guidance on setting up event logging. This guidance is broken up into sections, Defensive Readiness Condition DEFCON, and intended to be applied...

TheDefendersGuide

The Defender's Guide - It's Dangerous to Defend Alone, Take This! What is the Defender's Guide? The Defender's Guide is a project by Luke Paine and Jonathan Johnson to put all of the best defense resources for a particular aspect of an operating system into a single place. Too often as defenders ...

solarwinds-sunburst-cve-2020-10148

🔍 Vulnerability Research A curated collection of in-depth vulnerability writeups covering real-world security incidents in the software ecosystem. Each entry includes a full technical analysis, proof-of-concept, IOC listing, and remediation guidance. Purpose: Educational reference and portfolio...

PrivacySkills: How Privacy Guidance Shapes Source Selection in LLM Agents

While prior work has documented privacy failures in LLM agents, it remains unclear how the presentation of privacy guidance influences their choice of information sources. We introduce PrivacySkills, a controlled framework for evaluating how agents choose among acquisition pathways that provide t...

EUVD-2025-26599

PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is deployed to an environment, the customer has an option to configure the system to use a self-signed certificate. If the customer does not...

Astra Linux – Vulnerability in Tomcat9

The “Allocation of Resources Without Limits or Throttling” vulnerability in Apache Tomcat exists. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, and from 9.0.0.M1 through 9.0.105. The following versions were already at the end of their...

Astra Linux – Vulnerability in Tomcat9

A Session Fixation vulnerability exists in Apache Tomcat through the rewrite valve. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, and from 9.0.0.M1 through 9.0.105. Older, end-of-life versions may also be affected. Users are recommended ...

Astra Linux – Vulnerability in Tomcat9

The issue involves a vulnerability in the generation of error messages containing sensitive information in Apache Tomcat. This issue affects Apache Tomcat versions starting from 8.5.7 through 8.5.63, and from 9.0.0-M11 through 9.0.43. Other, end-of-life versions may also be affected. It is...

Astra Linux – Vulnerability in Tomcat9

Exposure of the HTTP Authentication Header to unexpected hosts during the WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, an...

Astra Linux – Vulnerability in Puma

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP requests comply with the RFC7230 standard, Puma and the frontend proxy may disagree about where the requests start and...

Astra Linux – Vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server, that malicious AJP server can send a malicious AJP message back to modproxyajp, causing it to write 4 bytes controlled by the attacker after the end of a heap-based...