AIF360

AI Fairness 360 AIF360 AI Fairness 360 ツールキットは、研究コミュニティによって開発された、AIアプリケーションのライフサイクル全体を通じて機械学習モデルのバイアスを検出および軽減するための技術を含む、拡張可能なオープンソースライブラリです。AI Fairness 360 パッケージは Python と R の両方で利用できます。 AI Fairness 360 パッケージには、以下が含まれます。 1. データセットとモデルのバイアスをテストするための包括的なメトリクス一式、 2. これらのメトリクスの説明、および 3...

http-desync-guardian

Overview HTTP/1.1 went through a long evolution since 1991 to 2014: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 RFC 7230 - 2014 This means there is a variety of servers and clients, which might have different views on request boundaries, creating opportunities for...

scorecard

OpenSSF Scorecard Overview What Is Scorecard? Prominent Scorecard Users View a Project's Score Scorecard's Public Data Using Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard Command Line Interface Prerequisites Installation Authentication Basic Usage Checks Default...

essh

ESSH 지속적인 세션과 실시간 상태 대시보드를 갖춘 SSH 워크스페이스. 연결이 끊겨도 원격 셸을 계속 실행하고, 키보드나 마우스로 호스트를 전환하며, 터미널을 벗어나지 않고 시스템 상태를 확인하세요. ESSH는 연결에 OpenSSH를 사용하고, 작업을 유지하기 위해 tmux를 사용합니다. 실제 동작 보기 42초 데모 보기 · 브라우저 리플레이 다운로드 df와 lsblk로 디스크를 검사하고, ps로 사용 중인 프로세스를 찾고, vmstat으로 시스템 활동을 샘플링하며, ss와 ip로 소켓과 인터페이스를 확인하세요. 데모에서는...

AIX360

AI Explainability 360 v0.3.0 ✨ 新着: IBM Research は、LLM 、特に LLM に与えられる入力に関して説明可能性を拡張する新しい In-Context Explainability 360 ICX360 ツールキットを公開しました。ぜひチェックしてみてください! 🚀✨ AI Explainability 360 ツールキットは、データセットと機械学習モデルの解釈可能性と説明可能性をサポートするオープンソースライブラリです。AI Explainability 360 Python...

CVE-2019-10475

CVE-2019-10475 2019年10月23日に報告されたJenkins CVE-2019-10475 / SECURITY-1490 の簡易PoCです。問題は、基本的なビルドメトリクスを生成する build-metrics プラグインにあります。このプラグインはJenkinsのサイドバーリンクプラグインとよく組み合わせて使用されます。 これは単純で一般的な反射型XSS脆弱性です。問題は、プラグインが label クエリパラメータを適切にエスケープしていないことです。 セットアップ PoCはDebian 10（Buster）、Jenkins...

suricata_exporter

Suricata Prometheus エクスポーター これは、dump-counters を使用して UNIX ソケット 経由でメトリクスを照会する、Suricata 用の Prometheus エクスポーターです。 使い方 $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default "/var/run/suricata.socket" -version Output version...

ayaFlow

ayaFlow ayaFlow는 Aya로 구축된 Rust + eBPF 네트워크 트래픽 분석기입니다. 각 Linux 노드에 하나의 에이전트를 실행하고, 수신 및 송신에 TC 분류기를 연결하며, 실시간 트래픽 데이터, SQLite 기반 기록, 그리고 Prometheus 메트릭을 제공합니다. 기능 eBPF TC 분류기로 IPv4, IPv6, TCP 및 UDP 트래픽을 캡처합니다. 메모리 내 실시간 연결 통계와 SQLite의 기록 데이터를 유지합니다. 선택적으로 역방향 DNS, DNS 쿼리 도메인, TLS SNI로 트래픽을 보강합니다...

popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

Milvus - Unauthenticated Metrics API Access

Milvus 2.5.27 and 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091. id: CVE-2026-26190 info: name: Milv...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

11in1 CMS 1.2.1 - Local File Inclusion (LFI)

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php. id: CVE-2012-0996 info: name: 11in1 CMS 1.2.1 - Local File Inclusion LFI author: daffainfo...

CVE-2024-32030-Nuclei-Template

CVE-2024-32030 Nuclei テンプレート 説明 このリポジトリには、CVE-2024-32030 脆弱性を検出するための Nuclei テンプレートが含まれています。この脆弱性は、JMX Metrics Collection JNDI Resolution を介したリモートコード実行を許可します。 脆弱性の詳細 ID: CVE-2024-32030 名前: JMX Metrics Collection JNDI RCE 作者: Hüseyin TINTAŞ 深刻度: 重大 説明: このテンプレートは、悪意のある JMX...

Why CISOs Struggle to Answer the Board's Three Hardest Questions, and How to Fix the Report

The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides...

quarantyne

=== THIS PROJECT IS ARCHIVED === Quarantyne · Modern Web Firewall 🛃 Automated web security made simple TL;DR Quarantyne is a reverse-proxy that protects web applications and APIs from fraudulent behavior, misuse, bots and cyber-attacks in real-time. Requirements Presentation Features Coverage...

Apache Solr - Host Environment Variables Leak via Metrics API

Exposure of Sensitive Information to an Unauthorized Actor Vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users can specify which environment variables to hide, however, the default list is designed to wor...

BIT-RABBITMQ-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

CLEANSTART-2026-RX76391 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-TD83938 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

Security vulnerability affects the kube-state-metrics-fips package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...

CLEANSTART-2026-AI26012 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the kube-state-metrics-fips package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...