msticpy

MSTIC Jupyter 和 Python 安全工具 Microsoft 威胁情报 Python 安全工具。 msticpy 是一个用于在 Jupyter Notebook 中进行信息安全调查和追捕的库。它提供以下功能： 从多个来源查询日志数据 使用威胁情报、地理位置和 Azure 资源数据丰富数据 从日志中提取活动指标 IoA 并解码编码数据 执行高级分析，例如异常会话检测和时间序列分解 使用交互式时间线、进程树和多维形态图可视化数据 它还包含一些节省时间的笔记本工具，例如用于设置查询时间边界、从列表中选择和显示项目以及配置笔记本环境的小部件。 msticpy 包最初是为支持...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

HELK

HELK The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was...

CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

🚨 CVE-2026-2472-Vertex-AI-SDK-Google-Cloud - Herramienta simple de prueba de concepto 🛠 Acerca de esta aplicación Esta herramienta muestra una prueba de concepto PoC técnica para el problema de seguridad CVE-2026-2472. El problema afecta al SDK de Python Vertex AI de Google Cloud Platform. Se...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Autorización faltante para una Escalada de Privilegios No Autenticada 🚀 PT Project Notebooks ≤ 1.1.3 — Escalada de Privilegios No Autenticada CVE-2025-5304 PoC y helper de explotación para PT Project Notebooks versiones 1.0.0–1.1.3 : la falta de...

EUVD-2026-57449

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked...

GHSA-V684-Q882-JGMQ SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

CVE: This vulnerability corresponds to CVE-2026-72789. Summary publishAccess.json is an opt-out list. The publish gate returns accessible for anything not explicitly listed in it. Encrypted notebooks are never written into that file, because only the administrator-gated setPublishAccess writes it...

EUVD-2026-57457

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers...

CVE-2026-85578

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal...

EUVD-2026-52277

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock publish mode : reader-reachable raw statement on read-write handle, cross-notebook read/write...

CVE-2026-82653

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

Astra Linux – Vulnerability in nbconvert

The GitHub Security Lab identified sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML, which may lead to cross-site scripting XSS vulnerabilities if...

CVE-2026-72797

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted...

CVE-2026-72789

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

CVE-2026-72797 SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted...

CVE-2026-72789

CVE-2026-72789 — SiYuan prior to v3.7.4 exposes encrypted notebooks via the publish API without authentication. The vulnerability arises from failing to properly validate publish access, causing anonymous readers to enumerate and retrieve fully decrypted content from unlocked encrypted notebooks....

CVE-2026-72789 SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

CVE-2026-72789

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...

PT-2026-71231

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation of publish access for encrypted notebooks allows them to be treated as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document...

CVE-2026-69084

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...