cloudsplaining

Cloudsplaining Cloudsplaining एक AWS IAM सुरक्षा मूल्यांकन उपकरण है जो न्यूनतम विशेषाधिकार के उल्लंघनों की पहचान करता है और जोखिम-प्राथमिकता वाली HTML रिपोर्ट तैयार करता है। उदाहरण रिपोर्ट ' custom-guidance.html ' custom-appendices.html कस्टम सामग्री के साथ रिपोर्ट तैयार करें cloudsplaining scan...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...

CVE-2025-62506

CVE-2025-62506 Vulnerability Verification Script Overview This repository contains a verification script for CVE-2025-62506, a privilege escalation vulnerability in MinIO service accounts and STS Security Token Service accounts. Vulnerability Description CVE-2025-62506 is a privilege escalation...

CVE-2026-82860

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

CVE-2026-82857

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

EUVD-2026-68448

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

CVE-2026-82857

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy . The root cause is insufficient boundary restrictions on role lifecycle operations targeting af-e2e-* roles, allowing an attacker with the documented principal to create persistent hig...

CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

EUVD-2026-68445

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

CVE-2026-73289 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

CVE-2026-73289 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

CVE-2026-55189 RustFS: FTP frontend skips IAM authorization on object reads

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM authorization function that the FTP write/list handlers and t...

CVE-2023-5077

A flaw was found in HashiCorp Vault and Vault Enterprise. This issue could allow a remote authenticated attacker to bypass security restrictions, due to a flaw in the Google Cloud secrets engine when creating or updating rolesets. By sending a specially crafted request, an attacker could exploit...

GHSA-Q4PP-J36H-3GQG Minimal `basti` IAM Policy Allows Shell Access

Summary The provided Minimal IAM Policy for bastic connect does not include ssm:SessionDocumentAccessCheck. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding. Details basti connect is designed to "securely connect to your...

Minimal `basti` IAM Policy Allows Shell Access

Summary The provided Minimal IAM Policy for bastic connect does not include ssm:SessionDocumentAccessCheck. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding. Details basti connect is designed to "securely connect to your...

New InsightCloudSec Compliance Pack for CIS AWS Benchmark 2.0.0

The Center for Internet Security CIS recently released version two of their AWS Benchmark. CIS AWS Benchmark 2.0.0 brings two new recommendations and eliminates one from the previous version. The update also includes some minor formatting changes to certain recommendation descriptions. In this...

S3-Account-Search - S3 Account Search

This tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket s3:getObject. Permission to list the contents of the bucket s3:ListBucket. Additionally, you will need a role...