Question: How to: Dot Configs

Answer:
Top-level dotfiles and `configs/` directory:

- `.*` - dot conf files for lots of common software eg. advanced `.vimrc`, `.gitconfig`, massive `.gitignore`, `.editorconfig`, `.screenrc`, `.tmux.conf` etc.
  - `.vimrc` - contains many awesome [vim](https://www.vim.org/) tweaks, plus hotkeys for linting lots of different file types in place, including Python, Perl, Bash / Shell, Dockerfiles, JSON, YAML, XML, CSV, INI / Properties files, LDAP LDIF etc without leaving the editor!
  - `.screenrc` - fancy [screen](https://www.gnu.org/software/screen/) configuration including advanced colour bar, large history, hotkey reloading, auto-blanking etc.
  - `.tmux.conf` - fancy [tmux](https://github.com/tmux/tmux/wiki) configuration include advanced colour bar and plugins, settings, hotkey reloading etc.
  - [Git](https://git-scm.com/):
    - `.gitconfig` - advanced Git configuration
    - `.gitignore` - extensive Git ignore of trivial files you shouldn't commit
    - enhanced Git diffs
    - protections against committing AWS secret keys or merge conflict unresolved files


Question: How to: Bash Environment & Libraries

Answer:
Top-level `.bashrc` and `.bash.d/` directory:

- `.bashrc` - shell tuning and sourcing of `.bash.d/*.sh`
- `.bash.d/*.sh` - thousands of lines of advanced bashrc code, aliases, functions and environment variables for:
  - [Linux](https://en.wikipedia.org/wiki/Linux) & [Mac](https://en.wikipedia.org/wiki/MacOS)
  - SCM - [Git](https://git-scm.com/), [Mercurial](https://www.mercurial-scm.org/), [Svn](https://subversion.apache.org)
  - [AWS](https://aws.amazon.com/)
  - [GCP](https://cloud.google.com/)
  - [Docker](https://www.docker.com/)
  - [Kubernetes](https://kubernetes.io/)
  - [Kafka](http://kafka.apache.org/)
  - [Vagrant](https://www.vagrantup.com/)
  - automatic GPG and SSH agent handling for handling encrypted private keys without re-entering passwords, and lazy evaluation to only prompt key load the first time SSH is called
  - and lots more - see [.bash.d/README](https://github.com/HariSekhon/DevOps-Bash-tools/blob/master/.bash.d/README.md) for a more detailed list
  - run `make bash` to link `.bashrc`/`.bash_profile` and the `.*` dot config files to your `$HOME` directory to auto-inherit everything
- `lib/*.sh` - Bash utility libraries full of functions for
  [Docker](https://www.docker.com/),
  environment,
  CI detection ([Travis CI](https://travis-ci.org/), [Jenkins](https://jenkins.io/) etc),
  port and HTTP url availability content checks etc.
  Sourced from all my other [GitHub repos](https://github.com/harisekhon) to make setting up Dockerized tests easier.


Question: How to: Installation Scripts

Answer:
- `install/install_*.sh` - various simple to use installation scripts for common technologies like:
  - [AWS CLI](https://aws.amazon.com/cli/)
  - [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest)
  - [GCloud SDK](https://cloud.google.com/sdk)
  - [GitHub CLI](https://cli.github.com/)
  - [Terraform](https://www.terraform.io/)
  - [Terragrunt](https://terragrunt.gruntwork.io/)
  - [Direnv](https://direnv.net/)
  - [Ansible](https://www.ansible.com/)
  - [K3s](https://k3s.io)
  - [MiniKube](https://kubernetes.io/docs/setup/learning-environment/minikube/) (Kubernetes)
  - [MiniShift](https://www.okd.io/minishift/)
    ([Redhat OpenShift](https://www.openshift.com/) / [OKD](https://www.okd.io/) dev VMs)
  - [Maven](https://maven.apache.org/)
  - [Gradle](https://gradle.org/)
  - [SBT](https://www.scala-sbt.org/)
  - [EPEL](https://fedoraproject.org/wiki/EPEL)
  - [RPMforge](http://repoforge.org/)
  - [Homebrew](https://brew.sh/)
  - [Travis CI](https://travis-ci.org/)
  - [Circle CI](https://circleci.com/)
  - [AppVeyor](https://www.appveyor.com/)
  - [BuildKite](https://buildkite.com)
  - [Avro Tools](https://avro.apache.org/)
  - [Parquet Tools](https://github.com/apache/parquet-mr/tree/master/parquet-tools)
  - [Prometheus](https://prometheus.io/)
  - various JDKs and RDBMS JDBC connector jars
  - and many more...


Question: How to: Linux & Mac

Answer:
`bin/` directory:

- `login.sh` - logs to major Cloud platforms if their credentials are found in the environment, CLIs such as AWS, GCP, Azure, GitHub... Docker registries: DockerHub, GHCR, ECR, GCR, GAR, ACR, Gitlab, Quay...
- `clean_caches.sh` - cleans out OS package and programming language caches - useful to save space or reduce Docker image size
- `crypto_dice_rolls.sh` - generates 100 random dice rolls to test a new crypto hardware wallet's fidelity (do not use this for your real crypto seed as your machine could be infected with malware which steals your seed phrase)
- `delete_duplicate_files.sh` - deletes duplicate files with (N) suffixes, commonly caused by web browser downloads,
  in the given or current directory. Checks they're exact duplicates of a matching basename file without the (N) suffix with
  the exact same checksum for safety. Prompts to delete per file. To auto-accept deletions, do
  `yes | delete_duplicate_files.sh`. This is a fast way of cleaning up your `~/Downloads` directory and can be put your
  user crontab
- `disk_speed_read_sequential_dd.sh` - runs a sequential read speed test from the given file using dd and bypassing filesystem cache for a more accurate test
- `disk_speed_read_random_dd.sh` - runs a random I/O read speed test from the given file using dd and bypassing filesystem cache for a more accurate test
- `disk_speed_write_sequential_dd.sh` - runs a sequential write speed test to a file in the given or current directory using dd and bypassing filesystem cache for a more accurate test
- `disk_speed_read_sequential_fio.sh` - runs a sequential read speed test in the current or given directory using fio
- `disk_speed_read_random_fio.sh` - runs a random I/O read test in the current or given directory using fio
- `disk_speed_write_sequential_fio.sh` - runs a sequential write speed test to the current or given directory using fio
- `disk_speed_write_random_fio.sh` - runs a sequential write speed test to the current or given directory using fio
- `download_url_file.sh` - downloads a file from a URL using wget with no clobber and continue support, or curl with atomic replacement to avoid race conditions. Used by `github/github_download_release_file.sh`, `github_download_release_jar.sh`, and `install/download_*_jar.sh`
- `curl_auth.sh` - shortens `curl` command by auto-loading your OAuth2 / JWT API token or username & password from environment variables or interactive starred password prompt through a ram file descriptor to avoid placing them on the command line (which would expose your credentials in the process list or OS audit log files). Used by many other adjacent API querying scripts
- `curl_with_cookies.sh` - extracts cookies for a given URL from your `\$BROWSER`'s cookie jar and passes them to the `curl` command along with the rest of the args (workaround for older curl builds and Homebrew builds that don't have the newer `--cookies-from-browser functionality)
- `find_duplicate_files*.sh` - finds duplicate files by size and/or checksum in given directory trees. Checksums are only done on files that already have matching byte counts for efficiency
- `find_broken_links.sh` - find broken links with delays to avoid tripping defenses
- `find_broken_symlinks.sh` - find broken symlinks pointing to non-existent files/directories
- `find_lock.sh` - tries to find if a lockfile is used in the given or current working directory by taking snapshots of the file list before and after a prompt in which you should open/close an application
- `foreach_path_bin.sh` - runs each binary of the given name found in `$PATH` with the args given. Useful to find all the installed versions of a program in different paths eg. `~/bin/` vs `/usr/local/bin/` eg. `foreach_path_bin.sh terraform --version`
- `http_duplicate_urls.sh` - find duplicate URLs in a given web page
- `htmldecode.sh` - decodes HTML encoding. Detects available tools such as Perl, Python or xmlstarlet and uses whatever is available
- `ldapsearch.sh` - shortens `ldapsearch` command by inferring switches from environment variables
- `ldap_user_recurse.sh` / `ldap_group_recurse.sh` - recurse Active Directory LDAP users upwards to find all parent groups, or groups downwards to find all nested users (useful for debugging LDAP integration and group-based permissions)
- `linux_distro_versions.sh` - quickly returns the list of major versions for a given Linux distro
- `diff_line_threshold.sh` - compares two files vs a line count diff threshold to determine if they are radically different. Used to avoid overwriting files which are not mere updates but completely different files
- `mv.sh` - moves directory trees resumably and removes the source files as they're copied over. Useful to migrate data from one disk to another, optionally with checksums. Uses rsync and shows the overall % of files transferred and the MB/s data transfer rate
- `organize_downloads.sh` - moves files of well-known extensions in the `$HOME/Downloads` directory older th


Question: How to: Mac & AppleScript

Answer:
Mac automation scripts to automate the Mac UI and settings

`bin/` directory:

- `mac_diff_settings.sh` - takes before and after snapshots of UI setting changes and diffs them to make it easy to find `defaults` keys to add to `setup/mac_settings.sh` to save settings
- `mac_restore_file.sh` - checks all the backup mount points for the latest backup that has a given file and then restores it
- `mac_backup_du_in_progress.sh` - find large files in the currently in-progress Time Machine backup to find out what is taking so long and racking up so many more GB of changes than you expect. This helps discover large but unnecessary files that you might want to exclude using the adjacent script `mac_backup_exclude_paths.sh`
- `mac_backup_exclude_paths.sh` - excludes many common large caches, docker and VM paths from macOS Time Machine backups
- `mac_backup_find_excluded_paths.sh` - does a deep search for macOS Time Machine excluded backup paths on file/folder attributes. See [HariSekhon/Knowledge-Base Mac page](https://github.com/HariSekhon/Knowledge-Base/blob/main/mac.md#time-machine) for why
- `mac_rmdir.sh` - safely delete a directory on Mac only if it is empty of actual data, by first removing macOS hidden metadata files and dirs such as `.fseventsd/`, `.Spotlight-V100/` and `.DS_Store` - straight `rmdir` fails otherwise
- `mac_iso_to_usb.sh` - converts a given ISO file to a USB bootable image and burns it onto a given or detected inserted USB drive
- `mac_ramdisk.sh` - creates a mac ramdisk of given MB size. Useful for performance, or even testing disk write scripts such as `disk_speed_write_*.sh` without wearing out your SSD
- `mac_delete_local_snapshots.sh` - deletes local macOS snapshots to free up disk space. When there is a substantial discrepancy between what the `df -h` command and the Finder UI shows, this is often the cause
- `copy_to_clipboard.sh` - copies stdin or string arg to system clipboard on Linux or Mac
- `paste_from_clipboard.sh` - pastes from system clipboard to stdout on Linux or Mac
- `paste_from_clipboard_upon_changes.sh` - pastes from system clipboard to stdout on Linux or Mac whenever the clipboard changes
- `paste_diff_settings.sh` - Takes snapshots of before and after clipboard changes and diffs them to show config changes

`applescript/` directory:

- `keystrokes.sh` - send N keystroke combinations
- `mouse_clicks.sh` - send N mouse click combinations to sequence of screen coordinates
  - `get_mouse_coordinates.sh` - print the current mouse coordinates - to know what to pass to above script
- `mouse_clicks_remote_desktop.sh` - switches to Microsoft Remote Desktop, waits 10 seconds and then clicks the mouse
  once a minute to prevent the screensaver from coming on. Workaround to Active Directory Group Policies that don't let
  you disable the screensaver. Point your mouse to an area that will have no mouse click effect, the Cmd-Tab to Terminal
  and run this
- `get_frontmost_process_title.scpt` - detect the frontmost window
  - to detect if you should send keystrokes / mouse clicks)
- `set_frontmost_process.scpt` - switch to bring the given app to the foreground to send keystrokes / mouse clicks to it
  - `browser_get_default.scpt` - get the default configured browser in format passable to Applescript (for  above script)
- `is_screen_locked.py` - detect if the screen is locked to stop sending keystrokes or mouse clicks
- `is_screensaver_running.scpt` - detect if the screensaver is running to stop sending keystrokes or mouse clicks
- `reopen_app.sh` - relaunch a given app
  (used to reload Shazam to detect DB changes after removing tracks programmatically from its DB)
- `spotify_app_search.sh` - runs a search in the Spotify App on Mac using Applescript
- `shazam_app_dump_tracks.sh` - dumps `artist - track` one per line from the Shazam local sqlite DB
- `shazam_app_delete_track.sh` - deletes a given `"artist" "track"` from the Shazam local sqlite DB
- `shazam_search_spotify_then_delete_track.sh` - searches for each Shazam'd track in the local Spotify desktop app,
  then prompts to delete each track from the local Shazam DB once you've saved it in Spotify.
  Useful to migrate Shazam'd tracks to Spotify after Apple removed the integration
- `screensaver_activate.scpt` - activate screensaver
- `shorten_text_selection.scpt` - shortens the selected text in the prior window. Replaces `and` with `&` and crushes
  out multiple blank lines. I use this for LinkedIn comments due to the short 1250 character limit
- `start_app_at_login.sh` - adds an app to the Login items to auto-start

Hammerspoon code has been moved to its own repo:

[![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=HariSekhon&repo=Hammerspoon&theme=ambient_gradient&description_lines_count=3)](https://github.com/HariSekhon/Hammerspoon)

See also [Mac](https://github.com/HariSekhon/Knowledge-Base/blob/main/mac.md) page
in [HariSekhon/Knowledge-Base](https://github.com/HariSekhon/Knowledge-Base).


Question: How to: Monitoring

Answer:
`monitoring/` directory:

- `dump_stats.sh` - dumps common command outputs to text files in a local tarball. Useful to collect support information
  for vendor support cases
- `grafana_api.sh` - queries the [Grafana](https://grafana.com/) API with authentication
- `log_timestamp_large_intervals.sh` - finds log lines whose timestamp intervals exceed the given number of seconds and
  outputs those log lines with the difference between the last and current timestamps. Useful to find actions that are
  taking a long time from log files such as CI/CD logs
- `prometheus.sh` - starts [Prometheus](https://prometheus.io/) locally, downloading it if not found in `$PATH`
- `prometheus_docker.sh` - starts [Prometheus](https://prometheus.io/) in Docker using `docker-compose`
- `prometheus_node_exporter.sh` - starts Prometheus `node_exporter` locally, downloading it if not found in `$PATH`
- `ssh_dump_stats.sh` - uses SSH and `dump_stats.sh` to dump common command outputs from remote servers to a local
  tarball. Useful for vendor support cases
- `ssh_dump_logs.sh` - Uses SSH to dump logs from server to local text files for uploading to vendor support cases

See doc pages in [HariSekhon/Knowledge-Base](https://github.com/HariSekhon/Knowledge-Base) on Grafana,
Prometheus, OpenTSDB, InfluxDB etc.


Question: How to: AWS - Amazon Web Services

Answer:
`aws/` directory:

- [AWS](https://aws.amazon.com/) scripts - `aws_*.sh`:
  - `aws_profile.sh` - switches to an AWS Profile selected from a convenient interactive menu list of AWS profiles from `$AWS_CONFIG_FILE` - useful when you have lots of AWS work profiles
    - see also [HariSekhon/Environments](https://github.com/HariSekhon/Environments) for automated switching using direnv when `cd`ing into relevant directories
  - `aws_cli_create_credential.sh` - creates an AWS service account user for CI/CD or CLI with Admin permissions (or other group or policy), creates an AWS Access Key, saves a credentials CSV and even prints the shell export commands and aws credentials file config to configure your environment to start using it. Useful trick to avoid CLI reauth to `aws sso login` every day.
  - `aws_terraform_create_credential.sh` - creates a AWS terraform service account with Administrator permissions for Terraform Cloud or other CI/CD systems to run Terraform plan and apply, since no CI/CD systems can work with AWS SSO workflows. Stores the access key as both CSV and prints shell export commands and credentials file config as above
  - `.envrc-aws` - copy to `.envrc` for [direnv](https://direnv.net/) to auto-load AWS configuration settings such as AWS Profile, Compute Region, EKS cluster kubectl context etc.
    - calls `.envrc-kubernetes` to set the `kubectl` context isolated to current shell to prevent race conditions between shells and scripts caused by otherwise naively changing the global `~/.kube/config` context
  - `aws_sso_ssh.sh` - launches local AWS SSO authentication pop-up (if not already authenticated), then scp's the latest resultant `~/.aws/sso/cache/` file to the remote server and SSH's there so that you can use AWS CLI or kubectl to EKS remotely on that server easily, without having to copy and paste the token from remote aws sso login to your local web browser
  - `aws_terraform_create_s3_bucket.sh` - creates a Terraform S3 bucket for storing the backend state, locks out public access, enables versioning, encryption, and locks out Power Users role and optionally any given user/group/role ARNs via a bucket policy for safety
  - `aws_terraform_create_dynamodb_table.sh` - creates a Terraform locking table in DynamoDB for use with the S3 backend, plus custom IAM policy which can be applied to less privileged accounts
  - `aws_terraform_create_all.sh` - runs all of the above, plus also applies the custom DynamoDB IAM policy to the user to ensure if the account is less privileged it can still get the Terraform lock (useful for GitHub Actions environment secret for a read only user to generate Terraform Plans in Pull Request without needing approval)
  - `aws_terraform_iam_grant_s3_dynamodb.sh` - creates IAM policies to access any S3 buckets and DynamoDB tables with `terraform-state` or `tf-state` in their names, and attaches them to the given user. Useful for limited permissions CI/CD accounts that run Terraform Plan eg. in GitHub Actions pull requests
  - `aws_account_summary.sh` - prints AWS account summary in `key = value` pairs for easy viewing / grepping of things like `AccountMFAEnabled`, `AccountAccessKeysPresent`, useful for checking whether the root account has MFA enabled and no access keys, comparing number of users vs number of MFA devices etc. (see also `check_aws_root_account.py` in [Advanced Nagios Plugins](https://github.com/HariSekhon/Nagios-Plugins))
  - `aws_billing_alarm.sh` - creates a [CloudWatch](https://aws.amazon.com/cloudwatch/) billing alarm and [SNS](https://aws.amazon.com/sns/) topic with subscription to email you when you incur charges above a given threshold. This is often the first thing you want to do on an account
  - `aws_budget_alarm.sh` - creates an [AWS Budgets](https://aws.amazon.com/cloudwatch/) billing alarm and [SNS](https://aws.amazon.com/sns/) topic with subscription to email you when both when you start incurring forecasted charges of over 80% of your budget, and 90% actual usage. This is often the first thing you want to do on an account
  - `aws_batch_stale_jobs.sh` - lists [AWS Batch](https://aws.amazon.com/batch/) jobs that are older than N hours in a given queue
  - `aws_batch_kill_stale_jobs.sh` - finds and kills [AWS Batch](https://aws.amazon.com/batch/) jobs that are older than N hours in a given queue
  - `aws_cloudfront_distribution_for_origin.sh` - returns the AWS CloudFront ARN of the distribution which serves origins containing a given substring. Useful for quickly finding the CloudFront ARN needed to give permissions to a private S3 bucket exposed via CloudFront
  - `aws_cloudtrails_cloudwatch.sh` - lists [Cloud Trails](https://aws.amazon.com/cloudtrail/) and their last delivery to [CloudWatch](https://aws.amazon.com/cloudwatch/features/) Logs (should be recent)
  - `aws_cloudtrails_event_selectors.sh` - lists [Cloud Trails](https://aws.amazon.com/cloudtrail/) and their event selectors to check each one has at least one event selector


Question: How to: GCP - Google Cloud Platform

Answer:
`gcp/` directory:

- [Google Cloud](https://cloud.google.com/) scripts - `gcp_*.sh` / `gce_*.sh` / `gke_*.sh` / `gcr_*.sh` / `bigquery_*.sh`:
  - `.envrc-gcp` - copy to `.envrc` for [direnv](https://direnv.net/) to auto-load GCP configuration settings such as Project, Region, Zone, GKE cluster kubectl context or any other GCloud SDK settings to shorten `gcloud` commands. Applies to the local shell environment only to avoid race conditions caused by naively changing the global gcloud config at `~/.config/gcloud/active_config`
    - calls `.envrc-kubernetes` to set the `kubectl` context isolated to current shell to prevent race conditions between shells and scripts caused by otherwise naively changing the global `~/.kube/config` context
  - `gcp_terraform_create_credential.sh` - creates a service account for [Terraform](https://www.terraform.io/) with full permissions, creates and downloads a credential key json and even prints the `export GOOGLE_CREDENTIALS` command to configure your environment to start using Terraform immediately. Run once for each project and combine with [direnv](https://direnv.net/) for fast easy management of multiple GCP projects
  - `gcp_ansible_create_credential.sh` - creates an [Ansible](https://www.ansible.com/) service account with permissions on the current project, creates and downloads a credential key json and prints the environment variable to immediately use it
  - `gcp_cli_create_credential.sh` - creates a GCloud SDK CLI service account with full owner permissions to all projects, creates and downloads a credential key json and even prints the `export GOOGLE_CREDENTIALS` command to configure your environment to start using it. Avoids having to reauth to `gcloud auth login` every day.
  - `gcp_spinnaker_create_credential.sh` - creates a [Spinnaker](https://spinnaker.io/) service account with permissions on the current project, creates and downloads a credential key json and even prints the Halyard CLI configuration commands to use it
  - `gcp_info.sh` - huge [Google Cloud](https://cloud.google.com/) inventory of deployed resources within the current project - Cloud SDK info plus all of the following (detects which services are enabled to query):
    - `gcp_info_compute.sh` - [GCE](https://cloud.google.com/compute/) Virtual Machine instances, [App Engine](https://cloud.google.com/appengine) instances, [Cloud Functions](https://cloud.google.com/functions), [GKE](https://cloud.google.com/kubernetes-engine) clusters, all [Kubernetes](https://kubernetes.io/) objects across all GKE clusters (see `kubernetes_info.sh` below for more details)
    - `gcp_info_storage.sh` - [Cloud SQL](https://cloud.google.com/sql) info below, plus: [Cloud Storage](https://cloud.google.com/storage) Buckets, [Cloud Filestore](https://cloud.google.com/filestore), [Cloud Memorystore Redis](https://cloud.google.com/memorystore), [BigTable](https://cloud.google.com/bigtable) clusters and instances, [Datastore](https://cloud.google.com/datastore) indexes
    - `gcp_info_cloud_sql.sh` - [Cloud SQL](https://cloud.google.com/sql) instances, whether their backups are enabled, and all databases on each instance
      - `gcp_info_cloud_sql_databases.sh` - lists databases inside each [Cloud SQL](https://cloud.google.com/sql) instance. Included in `gcp_info_cloud_sql.sh`
      - `gcp_info_cloud_sql_backups.sh` - lists backups for each [Cloud SQL](https://cloud.google.com/sql) instance with their dates and status. Not included in `gcp_info_cloud_sql.sh` for brevity. See also `gcp_sql_export.sh` further down for more durable backups to [GCS](https://cloud.google.com/storage)
      - `gcp_info_cloud_sql_users.sh` - lists users for each running [Cloud SQL](https://cloud.google.com/sql) instance. Not included in `gcp_info_cloud_sql.sh` for brevity but useful to audit users
    - `gcp_info_networking.sh` - VPC Networks, Addresses, Proxies, Subnets, Routers, Routes, VPN Gateways, VPN Tunnels, Reservations, Firewall rules, Forwarding rules, [Cloud DNS](https://cloud.google.com/dns) managed zones and verified domains
    - `gcp_info_bigdata.sh` - [Dataproc](https://cloud.google.com/dataproc) clusters and jobs in all regions, [Dataflow](https://cloud.google.com/dataflow) jobs in all regions, [PubSub](https://cloud.google.com/pubsub) messaging topics, [Cloud IOT](https://cloud.google.com/iot-core) registries in all regions
    - `gcp_info_tools.sh` - [Cloud Source Repositories](https://cloud.google.com/source-repositories), [Cloud Builds](https://cloud.google.com/cloud-build), [Container Registry](https://cloud.google.com/container-registry) images across all major repos (`gcr.io`, `us.gcr.io`, `eu.gcr.io`, `asia.gcr.io`), [Deployment Manager](https://cloud.google.com/deployment-manager) deployments
    - `gcp_info_auth_config.sh` - Auth Configurations, Organizations & Current Config
    - `gcp_info_projects.sh` - Projects names and IDs
    - `gcp_info_services.sh` - Services & APIs enabled
      - `gcp_service_apis.sh` - lis


Question: How to: Kubernetes

Answer:
`kubernetes/` directory:

- `.envrc-kubernetes` - copy to `.envrc` for [direnv](https://direnv.net/) to auto-load the right Kubernetes `kubectl` context isolated to current shell to prevent race conditions between shells and scripts caused by otherwise naively changing the global `~/.kube/config` context
- `aws/eksctl_cluster.sh` - quickly spins up an [AWS EKS](https://aws.amazon.com/eks/) cluster using `eksctl` with some sensible defaults
- `kubernetes_info.sh` - huge [Kubernetes](https://kubernetes.io/) inventory listing of deployed resources across all namespaces in the current cluster / kube context:
  - cluster-info
  - master component statuses
  - nodes
  - namespaces
  - deployments, replicasets, replication controllers, statefulsets, daemonsets, horizontal pod autoscalers
  - storage classes, persistent volumes, persistent volume claims
  - service accounts, resource quotas, network policies, pod security policies
  - container images running
  - container images running counts descending
  - pods  (might be too much detail if you have high replica counts, so done last, comment if you're sure nobody has deployed pods outside deployments)
- `kubectl.sh` - runs kubectl commands safely fixed to a given context using config isolation to avoid concurrency race conditions
- `kubectl_diff_apply.sh` - generates a kubectl diff and prompts to apply
- `kustomize_diff_apply.sh` - runs Kustomize build, precreates any namespaces, shows a kubectl diff of the proposed changes, and prompts to apply
- `kustomize_diff_branch.sh` - runs Kustomize build against the current and target base branch for current or all given directories, then shows the diff for each directory. Useful to detect differences when refactoring, such as switching to tagged bases
- `kubectl_create_namespaces.sh` - creates any namespaces in yaml files or stdin, a prerequisite for a diff on a blank install, used by adjacent scripts for safety
- `kubernetes_check_objects_namespaced.sh` - checks Kubernetes yaml(s) for objects which aren't explicitly namespaced, which can easily result in deployments to the wrong namespace. Reads the API resources from your current Kubernetes cluster and if successful excludes cluster-wide objects
- `kustomize_check_objects_namespaced.sh` - checks Kustomize build yaml output for objects which aren't explicitly namespaced (uses above script)
- `kubectl_deployment_pods.sh` - gets the pod names with their unpredictable suffixes for a given deployment by querying the deployment's selector labels and then querying pods that match those labels
- `kubectl_get_all.sh` - finds all namespaced Kubernetes objects and requests them for the current or given namespace. Useful because `kubectl get all` misses a lof of object types
- `kubectl_get_annotation.sh` - find a type of object with a given annotation
- `kubectl_restart.sh` - restarts all or filtered deployments/statefulsets in the current or given namespace. Useful when debugging or clearing application problems
- `kubectl_logs.sh` - tails all containers in all pods or filtered pods in the current or given namespace. Useful when debugging a distributed set of pods in live testing
- `kubectl_kv_to_secret.sh` - creates a Kuberbetes secret from `key=value` or shell export format, as args or via stdin (eg. piped from `aws_csv_creds.sh`)
- `kubectl_secret_values.sh` - prints the keys and base64 decoded values within a given Kubernetes secret for quick debugging of Kubernetes secrets. See also: `gcp_secrets_to_kubernetes.sh`
- `kubectl_secrets_download.sh` - downloads all secrets in current or given namespace to local files of the same name, useful as a backup before migrating to Sealed Secrets
- `kubernetes_secrets_compare_gcp_secret_manager.sh` - compares each Kubernetes secret to the corresponding secret in GCP Secret Manager. Useful to safety check GCP Secret Manager values align before enabling [External Secrets](https://external-secrets.io/latest/) to replace them
- `kubernetes_secret_to_external_secret.sh` - generates an [External Secret](https://external-secrets.io/latest/) from an existing Kubernetes secret
- `kubernetes_secrets_to_external_secrets.sh` - generates [External Secrets](https://external-secrets.io/latest/) from all existing Kubernetes secrets found in the current or given namespace
- `kubernetes_secret_to_sealed_secret.sh` - generates a [Bitnami Sealed Secret](https://github.com/bitnami-labs/sealed-secrets) from an existing Kubernetes secret
- `kubernetes_secrets_to_sealed_secrets.sh` - generates [Bitnami Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets) from all existing Kubernetes secrets found in the current or given namespace
- `kubectl_secrets_annotate_to_be_sealed.sh` - annotates secrets in current or given namespace to allow being overwritten by Sealed Secrets (useful to sync ArgoCD health)
- `kubectl_secrets_not_sealed.sh` - finds secrets with no SealedSecret ownerReferences
- `kubectl_secrets_to_be_sealed.sh` - finds secrets pending overwr


Question: How to: Big Data & NoSQL

Answer:
`bigdata/` and `kafka/` directories:

- `kafka_*.sh` - scripts to make [Kafka](http://kafka.apache.org/) CLI usage easier including auto-setting Kerberos to source TGT from environment and auto-populating broker and zookeeper addresses. These are auto-added to the `$PATH` when `.bashrc` is sourced. For something similar for [Solr](https://lucene.apache.org/solr/), see `solr_cli.pl` in the [DevOps Perl Tools](https://github.com/HariSekhon/DevOps-Perl-tools) repo.
- `zookeeper*.sh` - [Apache ZooKeeper](https://zookeeper.apache.org/) scripts:
  - `zookeeper_client.sh` - shortens `zookeeper-client` command by auto-populating the zookeeper quorum from the environment variable `$ZOOKEEPERS` or else parsing the zookeeper quorum from `/etc/**/*-site.xml` to make it faster and easier to connect
  - `zookeeper_shell.sh` - shortens Kafka's `zookeeper-shell` command by auto-populating the zookeeper quorum from the environment variable `$KAFKA_ZOOKEEPERS` and optionally `$KAFKA_ZOOKEEPER_ROOT` to make it faster and easier to connect
- `hive_*.sh` / `beeline*.sh` - [Apache Hive](https://hive.apache.org/) scripts:
  - `beeline.sh` - shortens `beeline` command to connect to [HiveServer2](https://cwiki.apache.org/confluence/display/Hive/HiveServer2+Overview) by auto-populating Kerberos and SSL settings, zookeepers for HiveServer2 HA discovery if the environment variable `$HIVE_HA` is set or using the `$HIVESERVER_HOST` environment variable so you can connect with no arguments (prompts for HiveServer2 address if you haven't set `$HIVESERVER_HOST` or `$HIVE_HA`)
    - `beeline_zk.sh` - same as above for [HiveServer2](https://cwiki.apache.org/confluence/display/Hive/HiveServer2+Overview) HA by auto-populating SSL and ZooKeeper service discovery settings (specify `$HIVE_ZOOKEEPERS` environment variable to override). Automatically called by `beeline.sh` if either `$HIVE_ZOOKEEPERS` or `$HIVE_HA` is set (the latter parses `hive-site.xml` for the ZooKeeper addresses)
  - `hive_foreach_table.sh` - executes a SQL query against every table, replacing `{db}` and `{table}` in each iteration eg. `select count(*) from {table}`
  - `hive_list_databases.sh` - list Hive databases, one per line, suitable for scripting pipelines
  - `hive_list_tables.sh` - list Hive tables, one per line, suitable for scripting pipelines
  - `hive_tables_metadata.sh` - lists a given DDL metadata field for each Hive table (to compare tables)
  - `hive_tables_location.sh` - lists the data location per Hive table (eg. compare external table locations)
  - `hive_tables_row_counts.sh` - lists the row count per Hive table
  - `hive_tables_column_counts.sh` - lists the column count per Hive table
- ` impala*.sh` - [Apache Impala](https://impala.apache.org/) scripts:
  - `impala_shell.sh` - shortens `impala-shell` command to connect to [Impala](https://impala.apache.org/) by parsing the Hadoop topology map and selecting a random datanode to connect to its Impalad, acting as a cheap CLI load balancer. For a real load balancer see [HAProxy config for Impala](https://github.com/HariSekhon/HAProxy-configs) (and many other Big Data & NoSQL technologies). Optional environment variables `$IMPALA_HOST` (eg. point to an explicit node or an HAProxy load balancer) and `IMPALA_SSL=1` (or use regular impala-shell `--ssl` argument pass through)
  - `impala_foreach_table.sh` - executes a SQL query against every table, replacing `{db}` and `{table}` in each iteration eg. `select count(*) from {table}`
  - `impala_list_databases.sh` - list Impala databases, one per line, suitable for scripting pipelines
  - `impala_list_tables.sh` - list Impala tables, one per line, suitable for scripting pipelines
  - `impala_tables_metadata.sh` - lists a given DDL metadata field for each Impala table (to compare tables)
  - `impala_tables_location.sh` - lists the data location per Impala table (eg. compare external table locations)
  - `impala_tables_row_counts.sh` - lists the row count per Impala table
  - `impala_tables_column_counts.sh` - lists the column count per Impala table
- `hdfs_*.sh` - Hadoop [HDFS](https://en.wikipedia.org/wiki/Apache_Hadoop#Hadoop_distributed_file_system) scripts:
  - `hdfs_checksum*.sh` - walks an HDFS directory tree and outputs HDFS native checksums (faster) or portable externally comparable CRC32, in serial or in parallel to save time
  - `hdfs_find_replication_factor_1.sh` / `hdfs_set_replication_factor_3.sh` - finds HDFS files with replication factor 1 / sets HDFS files with replication factor <=2 to replication factor 3 to repair replication safety and avoid no replica alarms during maintenance operations (see also Python API version in the [DevOps Python Tools](https://github.com/HariSekhon/DevOps-Python-tools) repo)
  - `hdfs_file_size.sh` / `hdfs_file_size_including_replicas.sh` - quickly differentiate HDFS files raw size vs total replicated size
  - `hadoop_random_node.sh` - picks a random Hadoop cluster worker node, like a cheap CLI load balancer, useful in s


Question: How to: Git - GitHub, GitLab, Bitbucket, Azure DevOps

Answer:
`git/`, `github/`, `gitlab/`, `bitbucket/` and `azure_devops/` directories:

- `git/*.sh` - [Git](https://git-scm.com/) scripts:
  - `precommit_run_changed_files.sh` - runs pre-commit on all files changed on the current branch vs the default branch. Useful to reproduce `pre-commit` checks that are failing in pull requests to get your PRs to pass
  - `git_diff_commit.sh` - quickly commits added or updated files to Git, showing a diff and easy enter prompt for each file. Super convenient for fast commits on the command line, and in vim and IDEs via hotkeys
  - `git_review_push.sh` - shows diff of what would be pushed upstream and prompts to push. Convenient for fast reviewed pushes via vim or IDEs hotkeys
  - `git_branch_delete_squash_merged.sh` - carefully detects if a squash merged branch you want to delete has no changes with the default trunk branch before deleting it.
     See [Squash Merges](https://github.com/HariSekhon/Knowledge-Base/blob/main/git.md#squash-merges-require-force-deleting-branches) in knowledge-base about why this is necessary.
  - `git_tag_release.sh` - creates a Git tag, auto-incrementing a `.N` suffix on the year/month/day date format if no exact version given
  - `git_foreach_branch.sh` - executes a command on all branches (useful in heavily version branched repos like in my [Dockerfiles](https://github.com/HariSekhon/Dockerfiles) repo)
  - `git_foreach_repo.sh` - executes a command against all adjacent repos from a given repolist (used heavily by many adjacent scripts)
  - `git_foreach_modified.sh` - executes a command against each file with git modified status
  - `git_foreach_repo_replace_readme_actions.sh` - updates the `README.md` badges for GitHub Actions to match the local repo name. Useful to bulk fix copied badges quickly and easily
  - `git_foreach_repo_update_readme.sh` - git-diff-commits the `README.md` for each Git repo checkout using adjacent `git_foreach_repo.sh` and `git_diff_commit.sh` scripts. Useful to quickly bulk update `README.md` in all your projects, such as when references need updating
  - `git_push_stats.sh` - shows the Git push stats to the remote origin for the current branch - number of commits and lines of diff, using the following `git_origin_*.sh` scripts:
  - `git_origin_log_to_push.sh` - shows the Git log in local branch that would be pushed to remote origin
  - `git_origin_files_to_push.sh` - shows the Git files in local branch that would be pushed to remote origin
  - `git_origin_diff_to_push.sh` - shows the Git diff of lines in local branch that would be pushed to remote origin
  - `git_origin_commit_count_to_push.sh` - shows the number of Git commits in local branch that would be pushed to remote origin
  - `git_origin_line_count_to_push.sh` - shows the Git number of lines changed in local branch that would be pushed to remote origin. These are lines actually added / changed / removed without surrounding context lines
  - `git_merge_all.sh` / `git_merge_master.sh` / `git_merge_master_pull.sh` - merges updates from master branch to all other branches to avoid drift on longer lived feature branches / version branches (eg. [Dockerfiles](https://github.com/HariSekhon/Dockerfiles) repo)
  - `git_remotes_add_origin_providers.sh` - auto-creates remotes for the 4 major public repositories ([GitHub](https://github.com/)/[GitLab](https://gitlab.com/)/[Bitbucket](https://bitbucket.org)/[Azure DevOps](https://dev.azure.com/)), useful for `git pull -all` to fetch and merge updates from all providers in one command
  - `git_remotes_set_multi_origin.sh` - sets up multi-remote origin for unified push to automatically keep the 4 major public repositories in sync (especially useful for [Bitbucket](https://bitbucket.org) and [Azure DevOps](https://dev.azure.com/) which don't have [GitLab](https://gitlab.com/)'s auto-mirroring from [GitHub](https://github.com/) feature)
  - `git_remotes_set_https_to_ssh.sh` - converts local repo's remote URLs from https to ssh (more convenient with SSH keys instead of https auth tokens, especially since Azure DevOps expires personal access tokens every year)
  - `git_remotes_set_ssh_to_https.sh` - converts local repo's remote URLs from ssh to https (to get through corporate firewalls or hotels if you travel a lot)
  - `git_remotes_set_https_creds_helpers.sh` - adds Git credential helpers configuration to the local git repo to use http API tokens dynamically from environment variables if they're set
  - `git_repos_pull.sh` - pull multiple repos based on a source file mapping list - useful for easily sync'ing lots of Git repos among computers
  - `git_repos_update.sh` - same as above but also runs the `make update` build to install the latest dependencies, leverages the above script
  - `git_grep_env_vars.sh` - find environment variables in the current git repo's code base in the format `SOME_VAR` (useful to find undocumented environment variables in internal or open source projects such as ArgoCD eg. [argoproj/argocd-cd #8680](http


Question: How to: CI/CD - Continuous Integration / Continuous Deployment

Answer:
`jenkins/`, `terraform/`, `teamcity/`, `buildkite/`, `circlci/`, `travis/`, `azure_devops/`, ...,  `cicd/` directories:

- `appveyor_api.sh` - queries [AppVeyor](https://www.appveyor.com/)'s API with authentication
- `azure_devops/*.sh` - [Azure DevOps](https://dev.azure.com/) scripts:
  - `azure_devops_api.sh` - queries Azure DevOps's API with authentication
  - `azure_devops_foreach_repo.sh` - executes a templated command for each Azure DevOps repo, replacing `{user}`, `{org}`, `{project}` and `{repo}` in each iteration
  - `azure_devops_to_github_migration.sh` - migrates one or all Azure DevOps git repos to GitHub, including all branches and sets the default branch to match via the APIs to maintain the same checkout behaviour
  - `azure_devops_disable_repos.sh` - disables one or more given Azure DevOps repos (to prevent further pushes to them after migration to GitHub)
- `circleci/*.sh` - [CircleCI](https://circleci.com/) scripts:
  - `circleci_api.sh` - queries CircleCI's API with authentication
  - `circleci_project_set_env_vars.sh` - adds / updates CircleCI project-level environment variable(s) via the API from `key=value` or shell export format, as args or via stdin (eg. piped from `aws_csv_creds.sh`)
  - `circleci_context_set_env_vars.sh` - adds / updates CircleCI context-level environment variable(s) via the API from `key=value` or shell export format, as args or via stdin (eg. piped from `aws_csv_creds.sh`)
  - `circleci_project_delete_env_vars.sh` - deletes CircleCI project-level environment variable(s) via the API
  - `circleci_context_delete_env_vars.sh` - deletes CircleCI context-level environment variable(s) via the API
  - `circleci_local_execute.sh` - installs CircleCI CLI and executes `.circleci/config.yml` locally
  - `circleci_public_ips.sh` - lists [CircleCI](https://circleci.com) public IP addresses via dnsjson.com
- `codeship_api.sh` - queries [CodeShip](https://codeship.com/)'s API with authentication
- `drone_api.sh` - queries [Drone.io](https://drone.io/)'s API with authentication
- `shippable_api.sh` - queries [Shippable](https://www.shippable.com/)'s API with authentication
- `wercker_app_api.sh` - queries [Wercker](https://app.wercker.com/)'s Applications API with authentication
- `gocd_api.sh` - queries [GoCD](https://www.gocd.org/)'s API
- `gocd.sh` - one-touch [GoCD CI](https://www.gocd.org/):
  - launches in Docker
  - (re)creates config repo (`$PWD/setup/gocd_config_repo.json`) from which to source pipeline(s) (`.gocd.yml`)
  - detects and enables agent(s) to start building
  - call from any repo top level directory with a `.gocd.yml` config (all mine have it), mimicking structure of fully managed CI systems
- `concourse.sh` - one-touch [Concourse CI](https://concourse-ci.org/):
  - launches in Docker
  - configures pipeline from `$PWD/.concourse.yml`
  - triggers build
  - tails results in terminal
  - prints recent build statuses at end
  - call from any repo top level directory with a `.concourse.yml` config (all mine have it), mimicking structure of fully managed CI systems
- `fly.sh` - shortens [Concourse](https://concourse-ci.org/) `fly` command to not have to specify target all the time
- `jenkins/*.sh` - [Jenkins CI](https://jenkins.io/) scripts:
  - `jenkins.sh` - one-touch [Jenkins CI](https://jenkins.io/):
    - launches Docker container
    - installs plugins
    - validates `Jenkinsfile`
    - configures job from `$PWD/setup/jenkins-job.xml`
    - sets Pipeline to git remote origin's `Jenkinsfile`
    - triggers build
    - tails results in terminal
    - call from any repo top level directory with a `Jenkinsfile` pipeline and `setup/jenkins-job.xml` (all mine have it)
  - `jenkins_api.sh` - queries the Jenkins Rest API, handles authentication, pre-fetches CSFR protection token crumb, supports many environment variables such as `$JENKINS_URL` for ease of use
    - `jenkins_jobs.sh` - lists Jenkins jobs (pipelines)
    - `jenkins_foreach_job.sh` - runs a templated command for each Jenkins job
    - `jenkins_jobs_download_configs.sh` - downloads all Jenkins job configs to xml files of the same name
    - `jenkins_job_config.sh` - gets or sets a Jenkins job's config
    - `jenkins_job_description.sh` - gets or sets a Jenkins job's description
    - `jenkins_job_enable.sh` - enables a Jenkins job by name
    - `jenkins_job_disable.sh` - disables a Jenkins job by name
    - `jenkins_job_trigger.sh` - triggers a Jenkins job by name
    - `jenkins_job_trigger_with_params.sh` - triggers a Jenkins job with parameters which can be passed as `--data KEY=VALUE`
    - `jenkins_jobs_enable.sh` - enables all Jenkins jobs/pipelines with names matching a given regex
    - `jenkins_jobs_disable.sh` - disables all Jenkins jobs/pipelines with names matching a given regex
    - `jenkins_builds.sh` - lists Jenkins latest builds for every job
    - `jenkins_cred_add_cert.sh` - creates a Jenkins certificate credential from a PKCS#12 keystore
    - `jenkins_cred_add_kubernetes_sa.sh` -


Question: How to: AI & IPaaS

Answer:
`ai/` and `ipaas/` directories:

- `openai_api.sh` - queries the [OpenAI](https://openai.com/) (ChatGPT) API with authentication
- `make_api.sh` - queries the [Make.com](https://www.make.com) API with authentication


Question: How to: Internet Services

Answer:
`internet/`, `cloudflare/`, `pingdom/`, `terraform/` directories:

- Pastebins - uploads files and copies the resulting URL to your clipboard:
  - code / text only - prompts to approve text / code before upload for safety:
    - `pastebin.sh` - uploads a file to
, script auto-determines which syntax highlighting to add since API doesn't auto infer
    - `dpaste.sh` - uploads a file to
, script auto-determines which syntax highlighting to add since API doesn't auto infer
    - `termbin.sh` - uploads a file to
(site has no syntax highlighting)
  - all files, multimedia or text / code - prompts to approve text / code before upload for safety:
    - `0x0.sh` - uploads a file to
(fast)
    - `imgur.sh` - uploads an image file to
- `file.io.sh` - uploads a file to
with 2 weeks, single download retention
    - `catbox.sh` - uploads a file to
with permanent retention (slow)
    - `litterbox.sh` - uploads a file to
with temporary retention (slow)
- `digital_ocean_api.sh` / `doapi.sh` - queries the [Digital Ocean](https://www.digitalocean.com/) API with authentication
  - see also the Digital Ocean CLI `doctl` (`install/install_doctl.sh`)
- `atlassian_ip_ranges.sh` - lists [Atlassian](https://www.atlassian.com/)'s IPv4 and/or IPv6 cidr ranges via its API
- `circleci_public_ips.sh` - lists [CircleCI](https://circleci.com) public IP addresses via dnsjson.com
- `cloudflare_*.sh` - [Cloudflare](https://www.cloudflare.com/) API queries and reports:
  - `cloudflare_api.sh` - queries the Cloudflare API with authentication
  - `cloudflare_ip_ranges.sh` - lists Cloudflare's IPv4 and/or IPv6 cidr ranges via its API
  - `cloudflare_custom_certificates.sh` - lists any custom SSL certificates in a given Cloudflare zone along with their status and expiry date
  - `cloudflare_dns_records.sh` - lists any Cloudflare DNS records for a zone, including the type and ttl
  - `cloudflare_dns_records_all_zones.sh` - same as above but for all zones
  - `cloudflare_dns_record_create.sh` - creates a DNS record in the given domain
  - `cloudflare_dns_record_update.sh` - updates a DNS record in the given domain
  - `cloudflare_dns_record_delete.sh` - deletes a DNS record in the given domain
  - `cloudflare_dns_record_details.sh` - lists the details for a DNS record in the given domain in JSON format for further pipe processing
  - `cloudflare_dnssec.sh` - lists the Cloudflare DNSSec status for all zones
  - `cloudflare_firewall_rules.sh` - lists Cloudflare Firewall rules, optionally with filter expression
  - `cloudflare_firewall_access_rules.sh` - lists Cloudflare Firewall Access rules, optionally with filter expression
  - `cloudflare_foreach_account.sh` - executes a templated command for each Cloudflare account, replacing the `{account_id}` and `{account_name}` in each iteration (useful for chaining with `cloudflare_api.sh`)
  - `cloudflare_foreach_zone.sh` - executes a templated command for each Cloudflare zone, replacing the `{zone_id}` and `{zone_name}` in each iteration (useful for chaining with `cloudflare_api.sh`, used by adjacent `cloudflare_*_all_zones.sh` scripts)
  - `cloudflare_purge_cache.sh` - purges the entire Cloudflare cache
  - `cloudflare_ssl_verified.sh` - gets the Cloudflare zone SSL verification status for a given zone
  - `cloudflare_ssl_verified_all_zones.sh` - same as above for all zones
  - `cloudflare_zones.sh` - lists Cloudflare zone names and IDs (needed for writing Terraform Cloudflare code)
- `datadog_api.sh` - queries the [DataDog](https://www.datadoghq.com/) API with authentication
- `dnsjson.sh` - queries dnsjson.com for DNS records
- `domains_subdomains_environments.sh` - for a given list of domains, deduplicate and print dev / staging subdomains as well as root domain for prod. Used to generate a whole bunch of Ad Tech domains and pixel tracker subdomains for a project. Combine with `markdown_columns_to_table.sh` to generate the markdown documentation for your domains and subomains per project and environment
- `gitguardian_api.sh` - queries the [GitGuardian](https://www.gitguardian.com/) API with authentication
- `google_maps_link.sh` - queries for a search string, returns the first hit and then generates a stable fixed place ID url to the result. Useful for sharing in documentation links to places like [HariSekhon/Knowledge-Base](https://github.com/HariSekhon/Knowledge-Base) Travel pages
- `jira_api.sh` - queries [Jira](https://www.atlassian.com/software/jira) API with authentication
- `kong_api.sh` - queries the [Kong API Gateway](https://docs.konghq.com/gateway/latest/)'s Admin API, handling authentication if enabled
- `traefik_api.sh` - queries the [Traefik](https://traefik.io/) API, handling authentication if enabled
- `ngrok_api.sh` - queries the [NGrok](https://ngrok.com/) API with authentication
- `pingdom_*.sh` - [Pingdom](h


Question: How to: More Linux & Mac

Answer:
`bin/`, `install/`, `packages/`, `setup/` directories:

- [Linux](https://en.wikipedia.org/wiki/Linux) / [Mac](https://en.wikipedia.org/wiki/MacOS) systems administration scripts:
  - `install/` - installation scripts for various OS packages (RPM, Deb, Apk) for various Linux distros ([Redhat RHEL](https://www.redhat.com/en/technologies/linux-platforms/enterprise-linux) / [CentOS](https://www.centos.org/) / [Fedora](https://getfedora.org/), [Debian](https://www.debian.org/) / [Ubuntu](https://ubuntu.com/), [Alpine](https://alpinelinux.org/))
  - install if absent scripts for Python, Perl, Ruby, NodeJS and Golang packages - good for minimizing the number of source code installs by first running the OS install scripts and then only building modules which aren't already detected as installed (provided by system packages), speeding up builds and reducing the likelihood of compile failures
  - install scripts for tarballs, Golang binaries, random 3rd party installers, [Jython](https://www.jython.org/) and build tools like [Gradle](https://gradle.org/) and [SBT](https://www.scala-sbt.org/) for when Linux distros don't provide packaged versions or where the packaged versions are too old
  - `packages/` - OS / Distro Package Management:
    - `install_packages.sh` - installs package lists from arguments, files or stdin on major linux distros and Mac, detecting the package manager and invoking the right install commands, with `sudo` if not root. Works on [RHEL](https://www.redhat.com/en) / [CentOS](https://www.centos.org/) / [Fedora](https://getfedora.org/), [Debian](https://www.debian.org/) / [Ubuntu](https://ubuntu.com/), [Alpine](https://alpinelinux.org/), and [Mac Homebrew](https://brew.sh/). Leverages and supports all features of the distro / OS specific install scripts listed below
    - `install_packages_if_absent.sh` - installs package lists if they're not already installed, saving time and minimizing install logs / CI logs, same support list as above
    - Redhat RHEL / CentOS:
      - `yum_install_packages.sh` / `yum_remove_packages.sh` - installs RPM lists from arguments, files or stdin. Handles Yum + Dnf behavioural differences, calls `sudo` if not root, auto-attempts variations of python/python2/python3 package names. Avoids yum slowness by checking if rpm is installed before attempting to install it, accepts `NO_FAIL=1` env var to ignore unavailable / changed package names (useful for optional packages or attempts for different package names across RHEL/CentOS/Fedora versions)
      - `yum_install_packages_if_absent.sh` - installs RPMs only if not already installed and not a metapackage provided by other packages (eg. `vim` metapackage provided by `vim-enhanced`), saving time and minimizing install logs / CI logs, plus all the features of `yum_install_packages.sh` above
      - `rpms_filter_installed.sh` / `rpms_filter_not_installed.sh` - pipe filter packages that are / are not installed for easy script piping
    - Debian / Ubuntu:
      - `apt_install_packages.sh` / `apt_remove_packages.sh` - installs Deb package lists from arguments, files or stdin. Auto calls `sudo` if not root, accepts `NO_FAIL=1` env var to ignore unavailable / changed package names (useful for optional packages or attempts for different package names across Debian/Ubuntu distros/versions)
      - `apt_install_packages_if_absent.sh` - installs Deb packages only if not already installed, saving time and minimizing install logs / CI logs, plus all the features of `apt_install_packages.sh` above
      - `apt_wait.sh` - blocking wait on concurrent apt locks to avoid failures and continue when available, mimicking yum's waiting behaviour rather than error'ing out
      - `debs_filter_installed.sh` / `debs_filter_not_installed.sh` - pipe filter packages that are / are not installed for easy script piping
    - Alpine:
      - `apk_install_packages.sh` / `apk_remove_packages.sh` - installs Alpine apk package lists from arguments, files or stdin. Auto calls `sudo` if not root, accepts `NO_FAIL=1` env var to ignore unavailable / changed package names (useful for optional packages or attempts for different package names across Alpine versions)
      - `apk_install_packages_if_absent.sh` - installs Alpine apk packages only if not already installed, saving time and minimizing install logs / CI logs, plus all the features of `apk_install_packages.sh` above
      - `apk_filter_installed.sh` / `apk_filter_not_installed.sh` - pipe filter packages that are / are not installed for easy script piping
    - Mac:
      - `brew_install_packages.sh` / `brew_remove_packages.sh` - installs Mac Hombrew package lists from arguments, files or stdin. Accepts `NO_FAIL=1` env var to ignore unavailable / changed package names (useful for optional packages or attempts for different package names across versions)
      - `brew_install_packages_if_absent.sh` - installs Mac Homebrew packages only if not already installed, saving time and minimizing install logs / CI


Question: How to: Builds, Languages & Linting

Answer:
`bin/`, `checks/`, `cicd/` or language specific directories:

- `lint.sh` - lints one or more files, auto-determines the file types, parses lint headers and calls appropriate scripts and tools. Integrated with my custom `.vimrc`
- `run.sh` - runs one or more files, auto-determines the file types, any run or arg headers and executes each file using the appropriate script or CLI tool. Integrated with my custom `.vimrc`
- `check_*.sh` - extensive collection of generalized tests - these run against all my GitHub repos via [CI](https://harisekhon.github.io/CI-CD/). Some examples:

  - Programming language linting:

    - [Python](https://www.python.org/) (syntax, pep8, byte-compiling, reliance on asserts which can be disabled at runtime, except/pass etc.)
    - [Perl](https://www.perl.org/)
    - [Java](https://www.java.com/en/)
    - [Scala](https://www.scala-lang.org/)
    - [Ruby](https://www.ruby-lang.org/en/)
    - [Bash](https://www.gnu.org/software/bash/) / Shell
    - Misc (whitespace, custom code checks etc.)

  - Build System, Docker & CI linting:

    - [Make](https://www.gnu.org/software/make/)
    - [Maven](https://maven.apache.org/)
    - [SBT](https://www.scala-sbt.org/)
    - [Gradle](https://gradle.org/)
    - [Travis CI](https://travis-ci.org/)
    - [Circle CI](https://circleci.com/)
    - [GitLab CI](https://docs.gitlab.com/ee/ci/)
    - [Concourse CI](https://concourse-ci.org/)
    - [Codefresh CI](https://codefresh.io/)
    - [Dockerfiles](https://docs.docker.com/engine/reference/builder/)
    - [Docker Compose](https://docs.docker.com/compose/)
    - [Vagrantfiles](https://www.vagrantup.com/docs/vagrantfile)


Question: How to: Individual Setup Parts

Answer:
Optional, only if you don't do the full `make install`.

Install only OS system package dependencies and [AWS CLI](https://aws.amazon.com/cli/) via Python Pip (doesn't symlink anything to `$HOME`):

```shell
make
```

Adds sourcing to `.bashrc` and `.bash_profile` and symlinks dot config files to `$HOME` (doesn't install OS system package dependencies):

```shell
make link
```

undo via

```shell
make unlink
```

Install only OS system package dependencies (doesn't include [AWS CLI](https://aws.amazon.com/cli/) or Python packages):

```shell
make system-packages
```

Install [AWS CLI](https://aws.amazon.com/cli/):

```shell
make aws
```

Install [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/):

```shell
make azure
```

Install [GCP GCloud SDK](https://cloud.google.com/sdk) (includes CLI):

```shell
make gcp
```

Install [GCP GCloud Shell](https://cloud.google.com/shell) environment (sets up persistent OS packages and all home directory configs):

```shell
make gcp-shell
```

Install generically useful Python CLI tools and modules (includes [AWS CLI](https://aws.amazon.com/cli/), autopep8 etc):

```shell
make python
```


Question: How to: Star History

Answer:
[![Star History Chart](https://api.star-history.com/svg?repos=HariSekhon/DevOps-Bash-tools&type=Date)](https://star-history.com/#HariSekhon/DevOps-Bash-tools&Date)

[git.io/bash-tools](https://git.io/bash-tools)


Question: How to: DevOps Code


Question: How to: Containerization


Question: How to: Databases - DBA - SQL


Question: How to: DevOps Reloaded


Question: How to: CVE-2026-0628 (2026-01-06)

Answer:
```
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
```
- [fevar54/CVE-2026-0628-POC](https://github.com/fevar54/CVE-2026-0628-POC)


Question: How to: CVE-2026-0842 (2026-01-11)

Answer:
```
A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulation causes missing authentication. The attack can only be done within the local network. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
```
- [davidrxchester/smart-sketcher-upload](https://github.com/davidrxchester/smart-sketcher-upload)


Question: How to: CVE-2026-666

Answer: - [adriangigliotti/CVE-2026-666](https://github.com/adriangigliotti/CVE-2026-666)


Question: How to: CVE-2026-5000

Answer: - [Perl-Code/CVE-2026-5000](https://github.com/Perl-Code/CVE-2026-5000)


Question: How to: CVE-2026-20805 (2026-01-13)

Answer:
```
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
```
- [fevar54/CVE-2026-20805-POC](https://github.com/fevar54/CVE-2026-20805-POC)


Question: How to: CVE-2026-20856 (2026-01-13)

Answer:
```
Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
```
- [b1gchoi/poc-CVE-2026-20856](https://github.com/b1gchoi/poc-CVE-2026-20856)


Question: How to: CVE-2026-21436 (2026-01-01)

Answer:
```
eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be installed in the path given by `--destdir`, but on a different location on the host. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.
```
- [osmancanvural/CVE-2026-21436](https://github.com/osmancanvural/CVE-2026-21436)


Question: How to: CVE-2026-21437 (2026-01-01)

Answer:
```
eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by `lseopkg` and related tools. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.
```
- [osmancanvural/CVE-2026-21437](https://github.com/osmancanvural/CVE-2026-21437)


Question: How to: CVE-2026-21440 (2026-01-02)

Answer:
```
AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.
```
- [Ashwesker/Ashwesker-CVE-2026-21440](https://github.com/Ashwesker/Ashwesker-CVE-2026-21440)
- [you-ssef9/CVE-2026-21440](https://github.com/you-ssef9/CVE-2026-21440)
- [k0nnect/cve-2026-21440-writeup-poc](https://github.com/k0nnect/cve-2026-21440-writeup-poc)


Question: How to: CVE-2026-21445 (2026-01-02)

Answer:
```
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.
```
- [chinaxploiter/CVE-2026-21445-PoC](https://github.com/chinaxploiter/CVE-2026-21445-PoC)


Question: How to: CVE-2026-21450 (2026-01-02)

Answer:
```
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.
```
- [Ashwesker/Ashwesker-CVE-2026-21450](https://github.com/Ashwesker/Ashwesker-CVE-2026-21450)


Question: How to: CVE-2026-21451 (2026-01-02)

Answer:
```
Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution. Version 2.3.10 fixes the issue.
```
- [Ashwesker/Ashwesker-CVE-2026-21451](https://github.com/Ashwesker/Ashwesker-CVE-2026-21451)


Question: How to: CVE-2026-21858 (2026-01-07)

Answer:
```
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
```
- [eduardorossi84/CVE-2026-21858-POC](https://github.com/eduardorossi84/CVE-2026-21858-POC)
- [Chocapikk/CVE-2026-21858](https://github.com/Chocapikk/CVE-2026-21858)
- [Ashwesker/Ashwesker-CVE-2026-21858](https://github.com/Ashwesker/Ashwesker-CVE-2026-21858)
- [cropnet/ni8mare-scanner](https://github.com/cropnet/ni8mare-scanner)
- [sastraadiwiguna-purpleeliteteaming/SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit](https://github.com/sastraadiwiguna-purpleeliteteaming/SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit)


Question: How to: CVE-2026-21876 (2026-01-08)

Answer:
```
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
```
- [daytriftnewgen/CVE-2026-21876](https://github.com/daytriftnewgen/CVE-2026-21876)


Question: How to: CVE-2026-21877 (2026-01-08)

Answer:
```
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.
```
- [Ashwesker/Ashwesker-CVE-2026-21877](https://github.com/Ashwesker/Ashwesker-CVE-2026-21877)


Question: How to: CVE-2026-22241 (2026-01-08)

Answer:
```
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system. The main cause of the issue is that no validation or sanitization of the file's present inside the zip archive. This leads to remote code execution on the web server. Version 4.2 patches the issue.
```
- [Ashifcoder/CVE-2026-22241](https://github.com/Ashifcoder/CVE-2026-22241)


Question: How to: CVE-2026-22686 (2026-01-13)

Answer:
```
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor. An attacker can intentionally trigger a host error, then climb the prototype chain. Using the host Function constructor, arbitrary JavaScript can be compiled and executed in the host context, fully bypassing the sandbox and granting access to sensitive resources such as process.env, filesystem, and network. This breaks enclave-vm’s core security guarantee of isolating untrusted code. This vulnerability is fixed in 2.7.0.
```
- [amusedx/CVE-2026-22686](https://github.com/amusedx/CVE-2026-22686)


Question: How to: CVE-2026-22804 (2026-01-12)

Answer:
```
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 to 1.9.0, Stored Cross-Site Scripting (XSS) vulnerability exists in the Termix File Manager component. The application fails to sanitize SVG file content before rendering it. This allows an attacker who has compromised a managed SSH server to plant a malicious file, which, when previewed by the Termix user, executes arbitrary JavaScript in the context of the application. The vulnerability is located in src/ui/desktop/apps/file-manager/components/FileViewer.tsx. This vulnerability is fixed in 1.10.0.
```
- [ThemeHackers/CVE-2026-22804](https://github.com/ThemeHackers/CVE-2026-22804)


Question: How to: CVE-2026-22812 (2026-01-12)

Answer:
```
OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.
```
- [Udyz/CVE-2026-22812-Exp](https://github.com/Udyz/CVE-2026-22812-Exp)
- [rohmatariow/CVE-2026-22812-exploit](https://github.com/rohmatariow/CVE-2026-22812-exploit)


Question: How to: CVE-2026-23478 (2026-01-13)

Answer:
```
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.
```
- [Ashwesker/Ashwesker-CVE-2026-23478](https://github.com/Ashwesker/Ashwesker-CVE-2026-23478)


Question: How to: CVE-2026-23550 (2026-01-14)

Answer:
```
Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.
```
- [cyberdudebivash/CYBERDUDEBIVASH-Modular-DS-CVE-2026-23550-Detector](https://github.com/cyberdudebivash/CYBERDUDEBIVASH-Modular-DS-CVE-2026-23550-Detector)


Question: How to: CVE-2025-0054 (2025-02-11)

Answer:
```
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.
```
- [z3usx01/CVE-2025-0054](https://github.com/z3usx01/CVE-2025-0054)


Question: How to: CVE-2025-0087 (2025-09-04)

Answer:
```
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
```
- [SpiralBL0CK/CVE-2025-0087-](https://github.com/SpiralBL0CK/CVE-2025-0087-)
- [SpiralBL0CK/CVE-2025-0087](https://github.com/SpiralBL0CK/CVE-2025-0087)


Question: How to: CVE-2025-0108 (2025-02-12)

Answer:
```
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.\n\nYou can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue does not affect Cloud NGFW or Prisma Access software.
```
- [iSee857/CVE-2025-0108-PoC](https://github.com/iSee857/CVE-2025-0108-PoC)
- [FOLKS-iwd/CVE-2025-0108-PoC](https://github.com/FOLKS-iwd/CVE-2025-0108-PoC)
- [fr4nc1stein/CVE-2025-0108-SCAN](https://github.com/fr4nc1stein/CVE-2025-0108-SCAN)
- [barcrange/CVE-2025-0108-Authentication-Bypass-checker](https://github.com/barcrange/CVE-2025-0108-Authentication-Bypass-checker)
- [sohaibeb/CVE-2025-0108](https://github.com/sohaibeb/CVE-2025-0108)
- [becrevex/CVE-2025-0108](https://github.com/becrevex/CVE-2025-0108)
- [Ashwesker/Ashwesker-CVE-2025-0108](https://github.com/Ashwesker/Ashwesker-CVE-2025-0108)


Question: How to: CVE-2025-0133 (2025-05-14)

Answer:
```
A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN.\n\nThere is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing and credential-stealing links that appear to be hosted on the GlobalProtect portal.\n\n\n\nFor GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in the informational bulletin  PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005   https://security.paloaltonetworks.com/PAN-SA-2025-0005 . There is no impact to confidentiality for GlobalProtect users if you did not enable (or you disable) Clientless VPN.
```
- [dodiorne/cve-2025-0133](https://github.com/dodiorne/cve-2025-0133)
- [ynsmroztas/-CVE-2025-0133-GlobalProtect-XSS](https://github.com/ynsmroztas/-CVE-2025-0133-GlobalProtect-XSS)
- [wiseep/CVE-2025-0133](https://github.com/wiseep/CVE-2025-0133)
- [INTELEON404/CVE-2025-0133](https://github.com/INTELEON404/CVE-2025-0133)
- [shawarkhanethicalhacker/CVE-2025-0133-exploit](https://github.com/shawarkhanethicalhacker/CVE-2025-0133-exploit)
- [adhamelhansye/CVE-2025-0133](https://github.com/adhamelhansye/CVE-2025-0133)


Question: How to: CVE-2025-0184 (2025-03-20)

Answer:
```
A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrf_proxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0.
```
- [m0d0ri205/wargame_Re-LS](https://github.com/m0d0ri205/wargame_Re-LS)


Question: How to: CVE-2025-0282 (2025-01-08)

Answer:
```
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
```
- [absholi7ly/CVE-2025-0282-Ivanti-exploit](https://github.com/absholi7ly/CVE-2025-0282-Ivanti-exploit)
- [AnonStorks/CVE-2025-0282-Full-version](https://github.com/AnonStorks/CVE-2025-0282-Full-version)
- [rxwx/pulse-meter](https://github.com/rxwx/pulse-meter)
- [watchtowrlabs/CVE-2025-0282](https://github.com/watchtowrlabs/CVE-2025-0282)
- [sfewer-r7/CVE-2025-0282](https://github.com/sfewer-r7/CVE-2025-0282)
- [Hexastrike/Ivanti-Connect-Secure-Logs-Parser](https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser)
- [almanatra/CVE-2025-0282](https://github.com/almanatra/CVE-2025-0282)
- [AdaniKamal/CVE-2025-0282](https://github.com/AdaniKamal/CVE-2025-0282)
- [44xo/CVE-2025-0282](https://github.com/44xo/CVE-2025-0282)
- [punitdarji/Ivanti-CVE-2025-0282](https://github.com/punitdarji/Ivanti-CVE-2025-0282)
- [Ashwesker/Ashwesker-CVE-2025-0282](https://github.com/Ashwesker/Ashwesker-CVE-2025-0282)


Question: How to: CVE-2025-0288 (2025-03-03)

Answer:
```
Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.
```
- [barhen12/CVE-2025-0288](https://github.com/barhen12/CVE-2025-0288)
- [MeisamEb/CVE-2025-0288](https://github.com/MeisamEb/CVE-2025-0288)


Question: How to: CVE-2025-0309 (2025-08-14)

Answer:
```
An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges.
```
- [AmberWolfCyber/UpSkope](https://github.com/AmberWolfCyber/UpSkope)


Question: How to: CVE-2025-0316 (2025-02-08)

Answer:
```
The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
```
- [MrPayloadC/CVE-2025-0316-Exploit](https://github.com/MrPayloadC/CVE-2025-0316-Exploit)


Question: How to: CVE-2025-0364 (2025-02-04)

Answer:
```
BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticated remote attacker can create an administrative user through the default exposed SaaS registration mechanism. Once an administrator, the attacker can upload and execute arbitrary PHP code using the "Cloud Storage Addin," leading to unauthenticated code execution.
```
- [vulncheck-oss/cve-2025-0364](https://github.com/vulncheck-oss/cve-2025-0364)


Question: How to: CVE-2025-0411 (2025-01-25)

Answer:
```
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
```
- [dhmosfunk/7-Zip-CVE-2025-0411-POC](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC)
- [iSee857/CVE-2025-0411-PoC](https://github.com/iSee857/CVE-2025-0411-PoC)
- [ishwardeepp/CVE-2025-0411-MoTW-PoC](https://github.com/ishwardeepp/CVE-2025-0411-MoTW-PoC)
- [cesarbtakeda/7-Zip-CVE-2025-0411-POC](https://github.com/cesarbtakeda/7-Zip-CVE-2025-0411-POC)
- [betulssahin/CVE-2025-0411-7-Zip-Mark-of-the-Web-Bypass](https://github.com/betulssahin/CVE-2025-0411-7-Zip-Mark-of-the-Web-Bypass)
- [RustMacrosRecoil/7-Zip-CVE-2025-0411-POC](https://github.com/RustMacrosRecoil/7-Zip-CVE-2025-0411-POC)
- [Ashwesker/Ashwesker-CVE-2025-0411](https://github.com/Ashwesker/Ashwesker-CVE-2025-0411)


Question: How to: CVE-2025-0851 (2025-01-29)

Answer:
```
A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
```
- [skrkcb2/CVE-2025-0851](https://github.com/skrkcb2/CVE-2025-0851)


Question: How to: CVE-2025-0868 (2025-02-20)

Answer:
```
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0.
```
- [aidana-gift/CVE-2025-0868](https://github.com/aidana-gift/CVE-2025-0868)


Question: How to: CVE-2025-0886 (2025-07-17)

Answer:
```
An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges.
```
- [JNDataRT/VirtualLockSensorLPE](https://github.com/JNDataRT/VirtualLockSensorLPE)


Question: How to: CVE-2025-0924 (2025-02-17)

Answer:
```
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
```
- [skrkcb2/CVE-2025-0924-different](https://github.com/skrkcb2/CVE-2025-0924-different)


Question: How to: CVE-2025-0994 (2025-02-06)

Answer:
```
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
```
- [rxerium/CVE-2025-0994](https://github.com/rxerium/CVE-2025-0994)


Question: How to: CVE-2025-1015 (2025-02-04)

Answer:
```
The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135.
```
- [r3m0t3nu11/CVE-2025-1015](https://github.com/r3m0t3nu11/CVE-2025-1015)


Question: How to: CVE-2025-1055 (2025-06-10)

Answer:
```
A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected by the operating system. This flaw stems from missing access control in the driver's IOCTL handler, enabling unprivileged users to perform privileged actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical services or privileged applications.
```
- [diego-tella/CVE-2025-1055-poc](https://github.com/diego-tella/CVE-2025-1055-poc)


Question: How to: CVE-2025-1094 (2025-02-13)

Answer:
```
Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns.  Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal.  Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL.  Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.
```
- [soltanali0/CVE-2025-1094-Exploit](https://github.com/soltanali0/CVE-2025-1094-Exploit)
- [ishwardeepp/CVE-2025-1094-PoC-Postgre-SQLi](https://github.com/ishwardeepp/CVE-2025-1094-PoC-Postgre-SQLi)
- [aninfosec/CVE-2025-1094](https://github.com/aninfosec/CVE-2025-1094)
- [Ashwesker/Ashwesker-CVE-2025-1094](https://github.com/Ashwesker/Ashwesker-CVE-2025-1094)


Question: How to: CVE-2025-1097 (2025-03-24)

Answer:
```
A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
```
- [hakaioffsec/IngressNightmare-PoC](https://github.com/hakaioffsec/IngressNightmare-PoC)
- [lufeirider/IngressNightmare-PoC](https://github.com/lufeirider/IngressNightmare-PoC)


Question: How to: CVE-2025-1122 (2025-04-15)

Answer:
```
Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0  stable on Cr50 Boards allows an attacker with root access to gain persistence and \nBypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.
```
- [FWNavy/RMASmoke](https://github.com/FWNavy/RMASmoke)


Question: How to: CVE-2025-1219 (2025-03-30)

Answer:
```
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
```
- [BreadSquad/ediop3PHP](https://github.com/BreadSquad/ediop3PHP)


Question: How to: CVE-2025-1302 (2025-02-15)

Answer:
```
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.\r\r**Note:**\r\rThis is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
```
- [EQSTLab/CVE-2025-1302](https://github.com/EQSTLab/CVE-2025-1302)
- [abrewer251/CVE-2025-1302_jsonpath-plus_RCE](https://github.com/abrewer251/CVE-2025-1302_jsonpath-plus_RCE)


Question: How to: CVE-2025-1306 (2025-03-04)

Answer:
```
The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
```
- [Nxploited/CVE-2025-1306](https://github.com/Nxploited/CVE-2025-1306)


Question: How to: CVE-2025-1323 (2025-03-08)

Answer:
```
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
```
- [p33d/cve-2025-1323](https://github.com/p33d/cve-2025-1323)


Question: How to: CVE-2025-1461 (2025-05-28)

Answer:
```
Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the page. This can lead to a  Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  attack. The vulnerability occurs because the default Vuetify translator will return the translation key as the translation, if it can't find an actual translation.\n\nThis issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .
```
- [neverendingsupport/nes-vuetify-cve-2025-1461](https://github.com/neverendingsupport/nes-vuetify-cve-2025-1461)


Question: How to: CVE-2025-1562 (2025-06-18)

Answer:
```
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.
```
- [gmh5225/CVE-2025-1562](https://github.com/gmh5225/CVE-2025-1562)


Question: How to: CVE-2025-1661 (2025-03-11)

Answer:
```
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
```
- [gbrsh/CVE-2025-1661](https://github.com/gbrsh/CVE-2025-1661)
- [MuhammadWaseem29/CVE-2025-1661](https://github.com/MuhammadWaseem29/CVE-2025-1661)
- [shahwarshah/CVE-2025-1661](https://github.com/shahwarshah/CVE-2025-1661)


Question: How to: CVE-2025-1716 (2025-02-26)

Answer:
```
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.
```
- [shybu9/poc_CVE-2025-1716](https://github.com/shybu9/poc_CVE-2025-1716)
- [0xDaeras/POC_CVE-2025-1716](https://github.com/0xDaeras/POC_CVE-2025-1716)


Question: How to: CVE-2025-1868 (2025-03-03)

Answer:
```
Vulnerability of unauthorized exposure of confidential information affecting Advanced IP Scanner and Advanced Port Scanner. It occurs when these applications initiate a network scan, inadvertently sending the NTLM hash of the user performing the scan. This vulnerability can be exploited by intercepting network traffic to a legitimate server or by setting up a fake server, in both local and remote scenarios. This exposure is relevant for both HTTP/HTTPS and SMB protocols.
```
- [itres-labs/CVE-2025-1868](https://github.com/itres-labs/CVE-2025-1868)


Question: How to: CVE-2025-1910 (2025-12-04)

Answer:
```
The WatchGuard Mobile VPN with SSL Client on Windows allows a locally \nauthenticated non-administrative Windows user to escalate their \nprivileges to NT AUTHORITY/SYSTEM on the Windows machine where the VPN \nClient is installed.This issue affects the Mobile VPN with SSL Client 12.0 up to and including 12.11.2.
```
- [lutrasecurity/CVE-2025-1910-WatchGuard-Privilege-Escalation](https://github.com/lutrasecurity/CVE-2025-1910-WatchGuard-Privilege-Escalation)


Question: How to: CVE-2025-1913 (2025-03-26)

Answer:
```
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
```
- [S0haib518-KSA/CVE-2025-1913-PoC](https://github.com/S0haib518-KSA/CVE-2025-1913-PoC)


Question: How to: CVE-2025-1974 (2025-03-24)

Answer:
```
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
```
- [sandumjacob/IngressNightmare-POCs](https://github.com/sandumjacob/IngressNightmare-POCs)
- [yoshino-s/CVE-2025-1974](https://github.com/yoshino-s/CVE-2025-1974)
- [yanmarques/CVE-2025-1974](https://github.com/yanmarques/CVE-2025-1974)
- [Esonhugh/ingressNightmare-CVE-2025-1974-exps](https://github.com/Esonhugh/ingressNightmare-CVE-2025-1974-exps)
- [dttuss/IngressNightmare-RCE-POC](https://github.com/dttuss/IngressNightmare-RCE-POC)
- [zwxxb/CVE-2025-1974](https://github.com/zwxxb/CVE-2025-1974)
- [m-q-t/ingressnightmare-detection-poc](https://github.com/m-q-t/ingressnightmare-detection-poc)
- [hi-unc1e/CVE-2025-1974-poc](https://github.com/hi-unc1e/CVE-2025-1974-poc)
- [0xBingo/CVE-2025-1974](https://github.com/0xBingo/CVE-2025-1974)
- [tuladhar/ingress-nightmare](https://github.com/tuladhar/ingress-nightmare)
- [rjhaikal/POC-IngressNightmare-CVE-2025-1974](https://github.com/rjhaikal/POC-IngressNightmare-CVE-2025-1974)
- [zulloper/CVE-2025-1974](https://github.com/zulloper/CVE-2025-1974)
- [Rubby2001/CVE-2025-1974-go](https://github.com/Rubby2001/CVE-2025-1974-go)
- [chhhd/CVE-2025-1974](https://github.com/chhhd/CVE-2025-1974)
- [salt318/CVE-2025-1974](https://github.com/salt318/CVE-2025-1974)
- [abrewer251/CVE-2025-1974_IngressNightmare_PoC](https://github.com/abrewer251/CVE-2025-1974_IngressNightmare_PoC)
- [Rickerd12/exploit-cve-2025-1974](https://github.com/Rickerd12/exploit-cve-2025-1974)
- [Ashwesker/Ashwesker-CVE-2025-1974](https://github.com/Ashwesker/Ashwesker-CVE-2025-1974)
- [Armand2002/Exploit-CVE-2025-1974-Lab](https://github.com/Armand2002/Exploit-CVE-2025-1974-Lab)
- [BiiTts/POC-IngressNightmare-CVE-2025-1974](https://github.com/BiiTts/POC-IngressNightmare-CVE-2025-1974)
- [iteride/CVE-2025-1974](https://github.com/iteride/CVE-2025-1974)
- [gunyakit/CVE-2025-1974-PoC-exploit](https://github.com/gunyakit/CVE-2025-1974-PoC-exploit)
- [BoianEduard/CVE-2025-1974](https://github.com/BoianEduard/CVE-2025-1974)


Question: How to: CVE-2025-2005 (2025-04-02)

Answer:
```
The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
```
- [Nxploited/CVE-2025-2005](https://github.com/Nxploited/CVE-2025-2005)
- [h4ckxel/CVE-2025-2005](https://github.com/h4ckxel/CVE-2025-2005)
- [mrmtwoj/CVE-2025-2005](https://github.com/mrmtwoj/CVE-2025-2005)


Question: How to: CVE-2025-2011 (2025-05-06)

Answer:
```
The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
```
- [datagoboom/CVE-2025-2011](https://github.com/datagoboom/CVE-2025-2011)
- [X3RX3SSec/CVE-2025-2011](https://github.com/X3RX3SSec/CVE-2025-2011)
- [Ashwesker/Ashwesker-CVE-2025-2011](https://github.com/Ashwesker/Ashwesker-CVE-2025-2011)
- [zsy107u/CVE-2025-2011-poc](https://github.com/zsy107u/CVE-2025-2011-poc)


Question: How to: CVE-2025-2025 (2025-03-15)

Answer:
```
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
```
- [SuJing-cy/CVE-2025-2025-52691-SmarterMail-Exp](https://github.com/SuJing-cy/CVE-2025-2025-52691-SmarterMail-Exp)


Question: How to: CVE-2025-2082 (2025-04-30)

Answer:
```
Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the VCSEC module. By manipulating the certificate response sent from the Tire Pressure Monitoring System (TPMS), an attacker can trigger an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the VCSEC module and send arbitrary messages to the vehicle CAN bus. Was ZDI-CAN-23800.
```
- [Burak1320demiroz/cve-2025-2082](https://github.com/Burak1320demiroz/cve-2025-2082)
- [shirabo/cve-2025-2082-POV](https://github.com/shirabo/cve-2025-2082-POV)


Question: How to: CVE-2025-2135 (2025-03-10)

Answer:
```
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
```
- [Wa1nut4/CVE-2025-2135](https://github.com/Wa1nut4/CVE-2025-2135)
- [sangnguyenthien/CVE-2025-2135](https://github.com/sangnguyenthien/CVE-2025-2135)