winevt_logs_analysis

Winevt logs analysis Remote connections Simple script for the purpose of finding remote connections to Windows machine and ideally some public IPs. It checks for some EventIDs regarding remote logins and sessions. You should pip install -r requirements.txt so the script can work and parse some of...

winevt_logs_analysis

Winevt 로그 분석 원격 연결 Windows 머신에 대한 원격 연결 및 가급적 공용 IP를 찾기 위한 간단한 스크립트입니다. 원격 로그인 및 세션과 관련된 일부 EventID를 확인합니다. 스크립트가 작동하고 winevt 폴더 내의 일부 .evtx 파일을 파싱하려면 pip install -r requirements.txt 를 실행해야 합니다. winevt/Logs 폴더와 스크립트는 동일한 파일 경로를 가져야 합니다. 실행 예제 결과 예제...

CyberDefense-Lab

Cyber Security Lab: ブルーチーム基盤とネットワーク防御 このラボプロジェクトは、集中型ネットワークセキュリティ、侵入検知・防御システム（IDS/IPS）、およびセキュリティ情報イベント管理（SIEM）に焦点を当てた、統合型「ブルーチーム」インフラの構築を実証します。pfSense を使用します。 1. 環境設定とネットワークアーキテクチャ ラボ環境は、仮想化環境（VMware）内でネットワークセグメンテーションの原則を用いて設計されています。 仮想マシン仕様 pfSense（ファイアウォール）: 1 GB RAM、4 vCPU | ネットワークアダプタ: Bridge...

dmz-security-monitoring-hardening

DMZセキュリティ監視とハードニング CY376: ネットワーク監視・セキュリティ・監査 — 学期末プロジェクト ブルーチーム | タルクワ鉱山技術大学 著者: Kennedy Kumi Holomah インデックス番号: FCM.41.018.148.23 学生ID: 9013004623 概要 このプロジェクトは、隔離されたVMware Workstationラボ内で、pfSenseファイアウォールの背後に公開用Ubuntu/Apache...

CVE-2026-63450

A flaw was found in Suricata, a network Intrusion Detection System IDS and Intrusion Prevention System IPS. A remote attacker can exploit a vulnerability in the FTP parser where sending a RETR or STOR command before PORT or PASV negotiation is incorrectly treated as a fatal error. This error...

CVE-2026-63449

A flaw was found in Suricata, a network Intrusion Detection System IDS and Intrusion Prevention System IPS. The Session Initiation Protocol SIP parser incorrectly handles large SIP message bodies. When a SIP message body exceeds 65,536 bytes, the parser truncates its length, preventing the full...

CVE-2007-3831

CVE-2007-3831 ISS Proventia Network IPS GX5108 1.3およびGX5008 1.5のmain.phpにおけるPHPリモートファイルインクルージョン Exploit-db公開先: https://www.exploit-db.com/exploits/30290/ Exploit-dbペーパー : https://www.exploit-db.com/docs/english/13081-having-fun-with-proventia-gx5108-&-gx5008-insecurities.pdf Gitリポジトリ:...

-CVE-2024-6095

主な強化点: 1. ランダム文字列による難読化 : パスを難読化するためにランダム文字列生成を導入し、検出を困難にしました。 2. 高度なペイロード : セキュリティ機構を回避するために、さまざまな難読化技術を備えたより洗練されたペイロードを追加しました。 3. カスタムヘッダー : 異なる正規のトラフィックを模倣し、追加の難読化層を提供するためにカスタムヘッダーを含めました。 4. ランダムな遅延 : 不正侵入検知・防御システム（IDS/IPS）のトリガーを避けるために、リクエスト間にランダムな遅延を組み込みました。 5. 強化されたレスポンス処理 :...

CVE-2018-15365

Deep Discovery Inspector 3.8 における反射型 XSS Deep Discovery Inspector 3.8 Service Pack 5 Build: 3.85.1165 の管理用 Web インターフェイスに、反射型 XSS 脆弱性を発見しました。 脆弱なスクリプトのパスは /php/detectiondetailfilter.php です。このスクリプトは認証されたユーザーのみアクセス可能ですが、後述の攻撃シナリオを考慮すると、このことが脆弱性の深刻さを軽減するわけではありません。 以下の POST リクエストペイロードは JavaScript...

CVE-2026-46387

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

UBUNTU-CVE-2026-45747

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic...

CVE-2026-73844: Generation of Error Message Containing Sensitive Information

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...

SUSE CVE-2026-53935

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespa...

SUSE CVE-2026-55428

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...

SUSE CVE-2026-55671

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...

EUVD-2026-51164

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link...

CVE-2026-6089 WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

CVE-2026-48013

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-48013

CVE-2026-48013 (Shopware) is an SSRF in the media external-link flow. Authenticated admins can cause server-side HEAD requests from the endpoint /api/_action/media/external-link to arbitrary internal IPs, bypassing the existing depth of IP checks used by the parallel uploadFromURL flow. The vulne...

CVE-2025-71398

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to acce...