GHSA-R3RM-QPHW-HH76 Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Root Cause File: internal/bodyprocessors/multipart.go since commit 3347961b, PR 1453 "feat: ignore unexpected EOF in MIME multipart request body processor", merged 2026-03-06, first shipped in v3.4.0. The multipart body processor treats io.ErrUnexpectedEOF as a benign condition. Three sites are...

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Root Cause File: internal/bodyprocessors/multipart.go since commit 3347961b, PR 1453 "feat: ignore unexpected EOF in MIME multipart request body processor", merged 2026-03-06, first shipped in v3.4.0. The multipart body processor treats io.ErrUnexpectedEOF as a benign condition. Three sites are...

GHSA-PRPW-WWV7-XJJR Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping \r or \n: go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte'\n'...

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping \r or \n: go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte'\n'...

BackupOperatorToDA

De Operador de Copias de Seguridad a Administrador de Dominio Si comprometes una cuenta miembro del grupo Operadores de Copias de Seguridad, puedes convertirte en Administrador de Dominio sin necesidad de RDP o WinRM en el Controlador de Dominio. Todo el crédito para filipdragovic con su POC...

CVE-2026-106456 Backstage: Inconsistent credential enforcement for overlapping proxy routes

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential...

CVE-2026-106456

The Backstage open framework for developer portals is affected by a vulnerability in the @backstage/plugin-proxy-backend package (versions 0.5.0 through 0.6.18 ). The root cause is inconsistent credential enforcement for overlapping proxy routes; if a parent path allows unauthenticated access whi...

EUVD-2026-93989

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential...

sightline

Sightline 地理空间基础设施情报平台，用于利用 OpenStreetMap 数据发现和分析物理世界资产。 概述 Sightline 支持搜索、监控和分析现实世界的基础设施，包括： 电信基站和数据中心 发电厂、变电站和储能设施 机场、直升机停机坪和缆车运输（缆车、索道缆车） 港口、海港、码头和海事设施 仓库和工业设施 管道、炼油厂和能源基础设施 军事设施 医院、监狱、大使馆和政府设施 监控摄像头和应急基础设施 交通枢纽（火车站、公交站、出租车候客点） 以及超过 30 个类别的更多资产类型，拥有 200 多种可搜索的基础设施类型。 架构 flowchart TB classDef...

injectAmsiBypass

Cobalt Strike BOF - 注入AMSI绕过 Cobalt Strike Beacon对象文件BOF，通过代码注入绕过远程进程中的AMSI。 从CobaltStrike运行inject-amsiBypass BOF 它的作用是什么？ 1. 使用提供的PID参数获取远程进程的句柄 hProc = KERNEL32$OpenProcessPROCESSVMOPERATION | PROCESSVMWRITE, FALSE, DWORDpid; 2. 将AMSI.DLL加载到Beacon的内存中，并获取AMSI.AmsiOpenSession的地址 hProc =...

flowinspect

flowinspect Una herramienta de inspección de tráfico de red Descripción: Utiliza libnids a través de sus bindings de Python de Jon Oberheide: pynids para desfragmentar IP y reensamblar paquetes TCP UDP se inspecciona por paquete para generar flujos de red. Estos flujos se inspeccionan a...

Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes

Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence AI chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The products, which claim to offer campai...

CVE-2018-4416-exploit

Prefacio :PROPERTIES: :CUSTOMID: preface :END: De acuerdo, la seguridad binaria no solo se trata de /heap/ y /stack/, todavía tenemos mucho por descubrir más allá de los desafíos CTF habituales. El navegador, la máquina virtual y el kernel juegan un papel importante en la seguridad binaria. Y...

Inline-Execute-PE

Inline-Execute-PE DISCLAIMER: This project is complex and failure to understand how it works and adequately test it can result in you crashing Beacons and losing access! I highly encourage you to read all of the documentation up until the "Design Considerations and Commentary" section! Introducti...

maldev-for-dummies

Malware Development for Dummies In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will sho...

secpub

Cisco Nexus OS NX-OS - Problemas de "inyección" de comandos / saneamiento. Descubierto por: Peter Adkins [email protected] Acceso: Local; se requiere acceso autenticado. Seguimiento e identificadores: CVE - CVE-2011-2569 Sistemas operativos afectados: Cisco Nexus OS NX-OS Participación del...

jboss-autopwn

jboss-autopwn JBoss Autopwn tal como se presentó en BlackHat Europe 2010: esta versión incorpora CVE-2010-0738, la vulnerabilidad de omisión de autenticación de JBoss mediante manipulación de verbos descubierta por Minded Security C. Papathanasiou 2010 INTRODUCCIÓN Este script de JBoss despliega ...

aisecplus-week01-danielossai

🔐 AISec Plus — Week 1: Map the Threat Researcher: Daniel Ossai Repo: aisecplus-week01-danielossai Submitted: Week 1 · AISec Plus Bootcamp 📌 Incident Name & Date EchoLeak CVE-2025-32711 Discovered: January 2025 · Disclosed: June 2025 · Patched: June 2025 📝 What Happened Researchers at Aim Security...

CVE-2026-26287

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

xz-utils-backdoor-case-study

Puerta trasera de XZ Utils Caso de estudio técnico — Cómo la confianza en el mantenedor se convirtió en una ruta de ejecución en la cadena de suministro Cuando la confianza en el mantenedor se convirtió en la ruta de ataque. Descripción general CASE-002 reconstruye la puerta trasera de XZ Utils /...