attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

oneiromancer

oneiromancer "A large fraction of the flaws in software development are due to programmers not fully understanding all the possible states their code may execute in." -- John Carmack "Can it run Doom?" -- https://canitrundoom.org/ Oneiromancer is a reverse engineering assistant that uses a locall...

CVE-2026-93861

A flaw was found in OpenStack Mistral. An authenticated project that has been granted and accepted access to another project's private workflow can further delegate that access to a third, arbitrary project without the workflow owner's knowledge or consent. The unauthorized delegation succeeds...

CVE-2026-93860

A flaw was found in OpenStack Mistral. The maintenance API endpoint is missing an authorization check, allowing any authenticated user to activate global maintenance mode on the Mistral service. When an attacker triggers maintenance mode, all write operations workflow execution creation,...

CVE-2026-93858

A flaw was found in OpenStack Mistral. The std.sshproxied built-in action accepts a user-supplied proxycommand parameter that is passed without validation to a system subprocess call on the Mistral executor host. An authenticated attacker can craft a malicious workflow that supplies an arbitrary...

CVE-2026-97147

A flaw was found in OpenStack Mistral. Due to a missing authorization check in the action definition and environment update paths, an authenticated user can modify or overwrite another project's publicly-scoped action definitions and environments. An attacker with a valid account in any project c...

CVE-2026-97147

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

DEBIAN-CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

DEBIAN-CVE-2026-93858

In OpenStack Mistral through 23.0.0, the std.sshproxied action passes a caller-supplied proxycommand value directly to paramiko.ProxyCommand before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an...

CVE-2026-93860

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenanc...

CVE-2026-93858

In OpenStack Mistral through 23.0.0, the std.sshproxied action passes a caller-supplied proxycommand value directly to paramiko.ProxyCommand before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an...

CVE-2026-97147

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

EUVD-2026-95132

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

CVE-2026-97147

The OpenStack Mistral service (through version 23.0.0 ) contains an incorrect authorization vulnerability in several v2 API write paths . The root cause is that these paths resolve target objects using a query that can return resources belonging to different projects, subsequently allowing unauth...

CVE-2026-97147

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

CVE-2026-93861

In OpenStack Mistral through version 23.0.0 , a vulnerability exists in the workflow membership API due to an incorrect authorization issue (CWE-863). A project that has accepted a share of another project's private workflow can create a membership for a third project. This new membership row inc...

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

EUVD-2026-95131

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...