policy_sentry

Policy Sentry IAM Least Privilege Policy Generator. Tutorial Installation Package managers Shell completion Step 1: Create the Template Step 2: Copy/paste ARNs Step 3: Write-policy command Cheat sheets Policy Writing cheat sheet IAM Database Query Cheat Sheet Local Initialization Optional Other...

poc_salesforce_lightning

PoC for Salesforce lightning Academic purposes Only. This tool dumps the data of Salesforce object through Aura lightning endpoint with the guest privilege. 雑なコードだけど許してくれい Requirement Python3 Usage $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a AURACONTEXT -r...

cirrusgo

CirrusGo A fast tool to scan SAAS,PAAS App written in Go SAAS App Support : salesforce contentful next version Note flag -o output not working install : golang 1.18Ver go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or go install -v github.com/Ph33rr/CirrusGo/cmd/cirrusgo@latest Help...

aura-inspector

aura-inspector This is not an officially supported Google product. This project is not eligible for the Google Open Source Software Vulnerability Rewards Program. Introduction aura-inspector is a Swiss Army knife of Salesforce Experience Cloud testing. It facilitates in discovering misconfigured...

raccoon

Raccoon: Salesforce object access auditor Released as open source by NCC Group Plc - https://www.nccgroup.com/ Developed by Jerome Smith @exploresecurity with thanks to Viktor Gazdag @wucpi https://www.github.com/nccgroup/raccoon Released under AGPL - refer to LICENSE for more information...

SFPolDevChk

Salesforce Policy Deviation Checker Released as open source by NCC Group Plc - https://www.nccgroup.com/ Developed by Jerome Smith @exploresecurity With thanks to Stephen Tomkinson @neonbunny9 https://www.github.com/nccgroup/SFPolDevChk Released under AGPL - refer to LICENSE for more information...

cloudsplaining

Cloudsplaining Cloudsplaining es una herramienta de evaluación de seguridad de AWS IAM que identifica violaciones del principio de mínimo privilegio y genera un informe HTML priorizado por riesgo. Informe de ejemplo Documentación Para la documentación completa, visite el proyecto en ReadTheDocs...

Merlion

Merlion: A Machine Learning Library for Time Series Table of Contents 1. Introduction 2. Comparison with Related Libraries 3. Installation 4. Documentation 5. Getting Started 1. Anomaly Detection 2. Forecasting 6. Evaluation and Benchmarking 7. Technical Report and Citing Merlion Introduction...

CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

CLEANSTART-2026-VC78529 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component

Security vulnerability affects the apache-nifi package. Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component...

vulnreport

Proyecto Abandonado Este proyecto no recibe mantenimiento actualmente y ha sido abandonado. Vulnreport Plataforma de gestión y automatización de pentesting Vulnreport es una plataforma para gestionar pruebas de penetración y generar informes de hallazgos bien formateados y procesables sin la...

CLEANSTART-2026-CV55977 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component

Security vulnerability affects the apache-nifi package. Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component...

CVE-2026-94384

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

EUVD-2026-84568

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

CVE-2026-94384

The Amazon amazon-connect-salesforce-lambda component (versions before 5.26 ) is vulnerable to privilege escalation due to missing authorization in the sfExecuteAWSService function. This allows any IAM principal with lambda:InvokeFunction permissions to perform restricted AWS API operations becau...

CVE-2026-94384: Missing Authorization

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

PT-2026-96855

Name of the Vulnerable Software and Affected Versions Amazon amazon-connect-salesforce-lambda versions prior to 5.26 Description Missing authorization in the Amazon Connect Salesforce integration allows an IAM principal with lambda:InvokeFunction permission to escalate privileges. The...