osquery

osquery osquery es un framework de instrumentación, monitoreo y análisis de sistemas operativos impulsado por SQL. Disponible para Linux, macOS y Windows. Información y recursos Página principal: osquery.io Descargas: osquery.io/downloads Documentación: ReadTheDocs Stack Overflow: Preguntas en...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

Fennec

Fennec 🦊 fennec es una herramienta de recolección de artefactos escrita en Rust para ser utilizada durante la respuesta a incidentes en sistemas basados en nix. fennec permite escribir un archivo de configuración que contiene cómo recolectar artefactos. Características 🌟 🦀 Un único binario...

osquery_cve-2024-23443

Proof of Concept POC CVE-2024-23443 hpbiososquery Add osqery extension HP BIOS WMI to Elastic Agent Dependencies pip install pywin32 pip install osquery pip install pyinstaller Build pyinstaller --onefile hpbiosenumeration.py Install 1. Copy extension to Elastic agent location copy...

osquery-defense-kit

osquery-defense-kit osquery queries for Detection & Incident Response, containing 250+ production-ready queries. ODK osquery-defense-kit is unique in that the queries are designed to be used as part of a production detection & response pipeline. The detection queries are formulated to return zero...

Kibana 9.4.x < 9.4.4 Information Disclosure (ESA-2026-161)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-161 advisory. - Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for...

SUSE CVE-2026-48786

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-78584

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

EUVD-2026-70063

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584

CVE-2026-78584 is an Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature that allows an authenticated user with Osquery live-query privileges to determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. The vulnerability affects...

PT-2026-84729

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78584: Observable Response Discrepancy

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

Kibana 9.4.4 Security Update (ESA-2026-161)

Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges...

CVE-2026-46371

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-54245

Fleet (open-source device management platform built on osquery) has a SQL injection in the Okta conditional access integration available in Fleet Premium. A value reported by a host's own agent is stored verbatim and then used in a database query without proper parameterization on an unauthentica...

CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...

EUVD-2026-66667

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...