sift

SIFT 이 저장소는 주로 토론과 이슈 추적을 위한 메타데이터 저장소입니다. cast -- 설치 CLI saltstack -- 실제 작업을 수행하는 상태 파일 packer -- 위 도구를 사용하여 머신 이미지를 빌드합니다. package-scripts -- SIFT PPA에서 호스팅되는 특정 패키지를 빌드합니다. 지원되는 배포판 20.04 Ubuntu Focal 22.04 Ubuntu Jammy 설치 Cast는 SIFT CLI를 대체합니다. SIFT CLI는 계속 작동해야 하지만 2023년 3월 1일부로 공식적으로 더 이상...

sift

Sift Secrets 파일 공유에서의 자격 증명 및 민감 데이터 노출 트리아지. 공개 공유open share가 발견되면, 질문은 절대 "이 저장소에 유출된 키가 있나요"가 아니다. 진짜 질문은 "방금 무엇이 노출되었고, 오늘 업무 종료 전에 무엇을 교체해야 하나?" 이다. sift는 바로 그 질문을 위해 만들어졌다: 높은 재현율, 빠른 검토 대기열, 그리고 눈으로 발견한 모든 것이 나머지 200개 복사본을 찾아내는 규칙이 되는 피드백 루프. Python 3.11+, 표준 라이브러리만 사용. pip 설치, 인터넷, 빌드 단계...

sift-kg

sift-kg 모든 문서 컬렉션을 지식 그래프로 변환하세요. 코드, 데이터베이스, 인프라 없이 — CLI와 문서만 있으면 됩니다. PDF, 논문, 기사, 기록을 넣으면 — 모든 것이 어떻게 연결되어 있는지 보여주는 탐색 가능한 지식 그래프를 몇 분 만에 얻을 수 있습니다. sift-kg는 LLM을 통해 엔티티와 관계를 추출하고, 승인을 받아 중복을 제거한 후, 브라우저에서 탐색할 수 있는 대화형 뷰어를 생성합니다. 모든 것에 대한 개념 지도를 손끝에서 만나보세요. 시각화를 구동하는 동일한 그래프는 AI 두 번째 뇌로도 작동합니...

CVE-2026-55094

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

EUVD-2026-90208

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094

Taskcluster, a task execution framework used by Mozilla, is vulnerable to unauthenticated remote code execution (RCE) in versions prior to 100.3.0 . The vulnerability exists in the web-server component when an anonymous role is present that exposes the GraphQL endpoint . Specifically, the applica...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

sift-hardened

sift-hardened sift 17.1.3의 드롭인 대체품으로, CVE-2026-85625를 해결합니다. crcn/sift.js와 관련이 없습니다. 17.1.3에서 변경된 사항 쿼리 키는 Object.keys고유 속성만로 열거되므로, 오염된 Object.prototype.$where는 연산자로 처리되지 않습니다. 문자열 $where 값은 거부됩니다. 함수 $where는 여전히 작동합니다. 설치npm alias "overrides": "sift": "github:lgranadoi/sift-hardened17.1.4"...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625: Improperly Controlled Modification of Object Prototype Attributes

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-28676

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file...

CVE-2026-28677

OpenSift prior to v1.6.3-alpha exposed an SSRF vulnerability in the URL ingest pipeline due to incomplete destination restrictions on user-controlled URLs. In non-localhost deployments, credentialed URLs, non-standard ports, and cross-host redirects created abuse paths. The issue has been patched...

CVE-2026-28676 OpenSift: Insufficient path containment checks in storage helpers could allow path traversal-style file operations

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file...

CVE-2026-27189

OpenSift: A race-prone local persistence issue in versions ≤ 1.1.2-alpha due to non-atomic and insufficiently synchronized JSON persistence flows. This can cause concurrent operations to lose updates or corrupt local state across sessions (study/quiz/flashcard/wellness/auth stores). The vulnerabi...

EUVD-2008-0679

Malware in sbrugna...

CVE-2008-0669

Cross-site scripting XSS vulnerability in search.cgi in Sift Unity allows remote attackers to inject arbitrary web script or HTML via the qt parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...