rbac

PHP-RBAC v2.x PHP-RBAC est une bibliothèque d'autorisation pour PHP. Elle offre aux développeurs un contrôle d'accès hiérarchique basé sur les rôles de niveau 2 NIST et plus encore, dans l'implémentation la plus rapide à ce jour. Version stable actuelle : PHP-RBAC v2.0 Nous contacter Page d'accue...

jailer

Jailer - eBPF-basierte obligatorische Zugriffskontrolle MAC Warnung : Dieses Projekt befindet sich in intensiver Entwicklung und ist NICHT bereit für den Produktionseinsatz. APIs, Richtlinienformate und Verhalten können sich ohne Vorankündigung ändern. Nur zu Test- und Experimentierzwecken...

CVE-2025-24999

CVE-2025-24999 prova di concetto per CVE-2025-24999 https://databasesecurityninja.wordpress.com/2026/04/02/microsoft-sql-server-privilege-elevation-through-msdatabasemanager-role-cve-2025-24999/...

authz0

Authz0 ist ein automatisiertes Autorisierungstest-Tool. Unautorisierte Zugriffe können anhand von URLs und Rollen & Anmeldedaten identifiziert werden. URLs und Rollen werden über YAML-basierte Vorlagen verwaltet, die mit authz0 automatisch erstellt und hinzugefügt werden können. Sie können auch a...

conjur

Conjur Manutenibilità Copertura dei test Conjur fornisce gestione dei segreti e identità delle applicazioni per l'infrastruttura moderna: Linguaggio di markup delle autorizzazioni per macchine "MAML" , un linguaggio di policy di accesso basato sui ruoli per definire i componenti di sistema e i lo...

jackhammer

Jackhammer: One Security vulnerability assessment/management tool to solve all the security team problems. What is Jackhammer? Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and trac...

red-kube

Red Team K8S Adversary Emulation Based on kubectl Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing...

CVE-2026-80194

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). Authorization guards are attached to the sibling __invoke method rather than at the class level, leaving the export route without any authorization checks. As...

Flowise < 3.0.1 - Remote Command Execution

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

CVE-2026-39914

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export...

bulwark

Ein Tool zur Verwaltung von organisatorischen Assets und Schwachstellen, mit Jira-Integration, entwickelt für die Erstellung von Anwendungssicherheitsberichten. Funktionen Multi-Client-Schwachstellenverwaltung Erstellung von Sicherheitsberichten Jira-Integration Rollenbasierte Teamautorisierung...

raspberrypi-setup

Configurazione Raspberry Pi Questo playbook di Ansible è progettato per configurare rapidamente il tuo Raspberry Pi. È compatibile con tutti i modelli. È stato testato con successo su diversi modelli, tra cui Pi Zero W, Pi Zero 2W e Pi 4B, tra gli altri. Il playbook dovrebbe funzionare bene sia s...

otto-support

Otto Support Kundensupport-MCP-Server für KI-Codierungsassistenten. Eine Go-Binary, abgestufte Authentifizierung, 19 Tools auf 4 Rollenebenen. Erstellt mit mcp-go. Schnellstart Option A: Docker-Container empfohlen Führen Sie alles in einem isolierten Container aus. Claude Code ist vorinstalliert...

CVE-2026-14949 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access control

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application...

EUVD-2026-62935

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer REST API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not...

EUVD-2026-62929

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database...

EUVD-2026-62911

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...

CVE-2026-76388

In Splunk Enterprise Security versions below 8.6.1, a user who holds the essanalyst Splunk Enterprise Security role could change User and Entity Behavior Analytics UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system...

CVE-2026-76342

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

CVE-2026-76315

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect syste...