kube-linter

Kubernetes 静态分析 什么是 KubeLinter？ KubeLinter 分析 Kubernetes YAML 文件、Helm Chart 和 Kustomize 清单，并根据各种最佳实践（重点关注生产就绪性和安全性）对其进行检查。 KubeLinter 运行合理的默认检查，旨在为你提供有关 Kubernetes YAML 文件、Helm Chart 和 Kustomize 清单的有用信息。这有助于团队尽早且频繁地检查安全错误配置和 DevOps 最佳实践。一些常见的示例包括以非 root 用户运行容器、强制最小权限原则，以及仅将敏感信息存储在 Secret 中。...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

gixy

GIXY 概要 Gixy は Nginx 設定を分析するためのツールです。 Gixy の主な目的は、セキュリティ設定ミスを防ぎ、脆弱性の検出を自動化することです。 現在サポートされている Python のバージョンは、2.7、3.5、3.6、3.7 です。 免責事項：Gixy は GNU/Linux でのみ十分にテストされています。他の OS では問題が発生する可能性があります。 できること 現在 Gixy は以下を検出できます： ssrf Server Side Request Forgery（サーバーサイドリクエストフォージェリ） httpsplitting HTTP...

red-detector

Red-Detector 説明 Vuls https://vuls.io/en/ を使用して EC2 インスタンスの脆弱性をスキャンします。 Lynis https://cisofy.com/solutions/lynis を使用して EC2 インスタンスのセキュリティ設定ミスを監査します。 Chkrootkit http://www.chkrootkit.org/ を使用して EC2 インスタンスにルートキットの兆候がないかスキャンします。 要件 1. 以下に示す EC2 アクションが設定された AWS アカウント。これらの要件を含むポリシーは...

azure-security-auditor

Azure Security Posture Auditor 一款轻量级、生产级风格的 CLI 工具，用于审计 Azure 安全配置并暴露常见错误配置 — 复现 Microsoft Defender for Cloud 在内部执行的检查。 检查 ID| 类别| 检查项| 严重程度 ---|---|---|--- AZ-001| RBAC| 在订阅范围内分配了 Owner / Contributor 角色| CRITICAL AZ-002| RBAC| 在资源组范围内分配了 Owner / Contributor 角色| HIGH AZ-003| 网络| 包含 0.0.0.0/0...

CVE-2023-38873-G1

🚨 G1 = A05:2021 – Security Misconfiguration ClickJacking ⚠️ Base Score: 6.5 MEDIUM Scale: CVSS ⚠️ 📌 Description This repository demonstrates a Clickjacking security flaw present on the G1 website. The vulnerability allows an attacker to load the site inside an iframe , overlaying malicious elements...

CVE-2026-21848

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries...

CVE-2026-21848

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability stemming from improper access controls. An authenticated attacker with low privileges can exploit this to view restricted data elements across tenant boundaries , indicating a cross-tenant information disclosur...

CVE-2026-21848 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries...

EUVD-2026-82773

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries...

CVE-2026-21848 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries...

CVE-2026-21848: Improper Access Control

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries...

nerva v1.69.6

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...

PT-2026-88063

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-86420

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service...

CVE-2026-55513

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...

EUVD-2022-56032

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

CVE-2022-35497

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

PT-2026-85665

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

The vulnerability of the AuthLdap::create() method in the phpMyFAQ web application allows a hacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the AuthLdap::create method in the phpMyFAQ web application is related to security configuration errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...