csaf

The Cyber Security Awareness Framework CSAF is a structured approach aimed at enhancing cybersecurity awareness and understanding among individuals, organizations, and communities. It provides guidance for the development of effective cybersecurity awareness programs, covering key areas such as...

Aaia

참고 이 저장소는 현재 활발히 개발되고 있지 않습니다. 그러나 PR을 수락할 의향이 있습니다. Aaia는 데이터 수집에 사용하는 AWS API에 큰 변화가 없었기 때문에 여전히 작동합니다. Aaia A아이덴티티 및 Access 분A석Analysis of Identity and Access 참고: 약어는 이름이 정해진 후에 만들어졌습니다 :P Aaia가 하는 일은? Aaia발음은 여기에서 확인는 Neo4j를 활용하여 AWS IAM 및 Organizations를 그래프 형태로 시각화하는 데 도움을 줍니다. 이는 이상값outlier...

CVE-2022-24124

서문 Casdoor는 OAuth 2.0/OIDC 기반의 중앙 집중식 SSOSingle Sign-On 인증 플랫폼입니다. 번호 CVE 번호: CVE-2022-24124 CNPD 번호: CNPD-202201-7304 영향을 받는 버전 위험 등급: 높음 7.5 HIGH POC/EXP: 공개됨 Casdoor POC: /api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml1,version,3 원클릭 검증 스크립트 고지: 이 도구는 ...

trape

trape stable v2.0 People tracker on the Internet: Learn to track the world, to avoid being traced. Trape is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how larg...

reconspider

Most Advanced Open Source Intelligence OSINT Framework ReconSpider ReconSpider is most Advanced Open Source Intelligence OSINT Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers,...

octosuite

Terminal-based toolkit for GitHub data analysis. $ octosuite user torvalds from pprint import pprint import octosuite user = octosuite.Username="torvalds" exists, profile = user.exists if exists: pprintprofile Installation pip install octosuite Usage TUI Interactive Launch the interactive termina...

WS_FTP-CVE-2023-40044

WSFTP-CVE-2023-40044 WSFTP CVE-2023-40044의 영향을 추적하는 모든 것을 포함한 저장소 영향을 받을 가능성이 있는 조직 및 헤더 방법을 사용하는 도메인을 포함합니다. 또한 MOVEit 및 WSFTP에 대한 새로운 기사를 추적하는 뉴스 티커를 구축했으며, https://firehose.kenbuckler.com/moveit 에서 확인할 수 있습니다...

BiBi-Windows-Wiper-Analysis

이스라엘 조직을 표적으로 한 BiBi-Windows Wiper 기술 분석 10월 30일, Security Joes 사고 대응 팀은 친親하마스 핵티비스트 그룹이 인프라를 파괴하기 위해 배포한 "BiBi-Linux" Wiper라는 새로운 Linux Wiper를 발견했습니다. 그리고 2023년 11월 1일, ESET Research는 2023년 이스라엘-하마스 분쟁 기간에 처음 등장한 하마스 지원 핵티비스트 그룹 BiBiGun이 배포한 Windows 버전의 BiBi Wiper에 대해 트윗했습니다. 이 글에서는 "BiBi-Window...

MOVEit-Transfer-Data-Breach-Analysis.

MOVEit-Transfer-Data-Breach-Analysis. ​CS50 Cybersecurity 과정을 위한 2023년 MOVEit Transfer 데이터 침해 사고CVE-2023-34362에 대한 상세 분석입니다. 이 프로젝트는 인증되지 않은 SQL 인젝션의 기술적 영향과 전 세계 데이터 프라이버시에 미치는 결과를 탐구하며, 2,700개 이상의 조직에 영향을 미쳤습니다. David J. Malan 교수님과 CS50 스태프에게 특별한 감사를 드립니다...

CVE-2026-92764

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intende...

EUVD-2026-81032

OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolati...

CVE-2026-92764 OpenCVE 2.4.0 < 3.1.0 Organization API Ignores Token Scope

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intende...

CVE-2026-92764: Incorrect Authorization

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intende...

SUSE CVE-2026-25712

Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations...

BIT-KEYCLOAK-2026-18201 Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

CVE-2026-58417 REST API exposes organization membership of private organizations to public

REST API exposes organization membership of private organizations to public...

EUVD-2026-58152

REST API exposes organization membership of private organizations to public...

CVE-2026-58417 REST API exposes organization membership of private organizations to public

REST API exposes organization membership of private organizations to public...

CVE-2026-58417

The Gitea REST API contains an information disclosure vulnerability where it exposes organization membership of private organizations to the public. Specifically, the GET endpoint /orgs/{org}/public_members/{username} reveals whether a specific user belongs to a private organization, even though ...

CVE-2025-14779

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation o...