linux

Linux kernel The Linux kernel is the core of any Linux operating system. It manages hardware, system resources, and provides the fundamental services for all other software. Quick Start Report a bug: See Documentation/admin-guide/reporting-issues.rst Get the latest kernel: https://kernel.org Buil...

CVE-2017-12635

CVE-2017-12635 Case study and PoC of CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Remote Privilege Escalation Presentation CouchDB Apache CouchDB is a document-oriented NoSQL database, implemented in Erlang. CouchDB uses multiple formats and protocols to store, transfer, and process it's dat...

Corelight-Ansible-Roles

Corelight-Ansible-Roles Caution: Before you run this version, if you are upgrading, some variable names and locations have changed To get started, simply run this command: source curl https://raw.githubusercontent.com/corelight/Corelight-Ansible-Roles/main/download-run-me-first.sh This product...

KubiScan

!GitHub releaserelease-imgrelease !Licenselicense-imglicense A tool for scanning Kubernetes cluster for risky permissions in Kubernetes's Role-based access control RBAC authorization model. The tool was published as part of the "Securing Kubernetes Clusters by Eliminating Risky Permissions"...

cloudsplaining

Cloudsplaining Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report. Example report Documentation For full documentation, please visit the project on ReadTheDocs. Installation Cheatsheet Example report...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

securix

SécurixOS: Base OS for a secure workstation !NOTE This project is in alpha , no support is provided at this time. Objectives SécurixOS is a NixOS distribution developed by DINUM to equip secure computers for system administration, office work, and development in order to handle Unprotected...

repokid

Repokid Repokid uses Access Advisor provided by Aardvark to remove permissions granting access to unused services from the inline policies of IAM roles in an AWS account. Getting Started Install mkvirtualenv repokid git clone [email protected]:Netflix/repokid.git cd repokid pip install -e...

PurpleCloud

Documentation Terraform code generator to create different Azure security labs. For full documentation visit: https://www.purplecloud.network Changelog 10/18/24: Updated Azure Sentinel Generator Updated AADDiagnostic Setting log categories On sentinel.py: Added more categories for logging and...

infosec-interview-questions

Information Security Interview Questions A collection for interview questions for Information Security roles Table Of Contents Application Security Architect Blue Team Encryption Forensics General Incidence Response Networking Red Team Vulnerability Management Where Credit is Due Application...

terraform-aws-secure-baseline

terraform-aws-secure-baseline Terraform Module Registry A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.4.0 and AWS Foundational Security Best Practices v1.0.0. See Benchmark...

ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-5M22-7PFQ-VP65 ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

NPM: ApostropheCMS: Import API bypasses publication roles for protected content

NPM: ApostropheCMS: Import API bypasses publication roles for protected content vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

CVE-2026-113649 ApostropheCMS: Import API bypasses publication roles for protected content

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove...

CVE-2026-113649

The ApostropheCMS Node.js content management system is vulnerable to a publication role bypass in the import-export module (prior to 3.7.1) and the core system (prior to 4.34.0). An editor capable of importing an enabled content type but lacking the required publication role can leverage import w...

PraisonAI AgentOS - Information Disclosure

PraisonAI's AgentOS FastAPI application server exposes an unauthenticated GET /api/agents endpoint that lists every registered agent's name, role and the opening of its instructions system prompt. No authentication is enforced on the route, allowing a remote attacker to enumerate agent...

LearnPress < 4.3.7 - Information Disclosure

LearnPress WordPress plugin 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests. id: CVE-2026-8383 info: name: LearnPress 4.3.7 -...

Blinko <= 1.8.3 - User Information Leak

Blinko = 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges. id: CVE-2026-23486 info: name:...