pharos

Pharos Static Binary Analysis Framework The Pharos static binary analysis framework is a project of the Software Engineering Institute at Carnegie Mellon University. The framework is designed to facilitate the automated analysis of binary programs. It uses the ROSE compiler infrastructure develop...

dynmx

dynmx 原型 dynmx （读作 dynamics ）是一种基于签名的检测方法，用于基于Windows API调用序列的行为恶意软件特征。简而言之，你可以将 dynmx 视为用于API调用跟踪（所谓的函数日志）的YARA，这些跟踪来自恶意软件沙箱。因此，检测方法的数据基础不是静态分析的恶意软件样本本身，而是在恶意软件沙箱中对恶意软件样本进行动态分析期间生成的数据。目前， dynmx 支持以下恶意软件沙箱的函数日志： VMRay（函数日志，文本和XML格式） CAPEv2（report.json文件） Cuckoo（report.json文件） 该检测方法在硕士论文《基于Windows...

aws-enumerator

AWS 服务枚举 免责声明 该工具处于测试阶段（正在测试中），未使用破坏性 API 调用（仅含读取操作）。 希望该工具不会出现问题。如果遇到任何问题，请提交工单。 描述 AWS Enumerator 旨在为渗透测试人员在黑盒测试期间进行服务枚举和信息收集。该工具旨在加速云审查过程，当安全研究人员获取了 AWS 账户凭证时尤为有用。 AWS Enumerator 支持超过 600 个 API 调用（读取操作 Get、List、Describe 等），并将持续扩展。 该工具提供了结果分析界面。所有结果均保存为 JSON 文件（一次性“数据库”）。 安装 如果你已安装并配置了 Go（即...

-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – 通过原生 API 调用实现 svchost 注入 以下 Binary Ninja 代码片段揭示了 Remcos 将其载荷注入 svchost.exe 的核心注入机制。 代码功能说明： CreateProcessW 使用 CREATESUSPENDED 标志启动一个处于挂起状态的 svchost 进程。 VirtualAlloc 在目标进程内使用 MEMCOMMIT 和 PAGEREADWRITE 标志分配内存，允许将载荷直接写入进程内存。 WriteProcessMemory 将载荷写入挂起的 svchost 进程的已分配内存区域。...

iac-scan-runner

IaC Scan Runner Service that scans your Infrastructure as Code for common vulnerabilities. Aspect| Information ---|--- Tool name| IaC Scan Runner Docker image| xscanner/runner PyPI package| iac-scan-runner Documentation| docs Contact us| [email protected] Table of Contents Description Runnin...

Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis

1. Native API & APC Injection The x64dbg memory dump reveals that Agent Tesla uses Native API NT API calls for low-level operations, including APC Asynchronous Procedure Call injection. Key Functions Observed: NtQueueApcThread – Injects code into a target thread via APC. NtReadVirtualMemory –...

drltrace

Drltrace Windows test build Linux test build Drltrace is a dynamic API calls tracer for Windows and Linux applications. Drltrace is built on top of DynamoRIO dynamic binary instrumentation framework. Drltrace was initialy implemented by Derek Bruening and distributed with DynamoRIO and DrMemory...

Get-PDInvokeImports

Get-PDInvokeImports 描述： Get-PDInvokeImports 是一个工具（PowerShell 模块），能够自动检测程序集中 P/Invoke、动态 P/Invoke 和 D/Invoke 的使用情况。它显示所有引用这些调用的位置，并将所有内容导出为 DnSpyBookmarks.xml。 该 PS 模块在逆向 .NET 程序集时非常有用，可快速揭示程序集中使用的非托管 API 函数调用。有时恶意软件程序集充满垃圾代码，其主要功能通过直接调用 WIN API 或 NTAPI 实现。 Get-PDInvokeImports 让您快速概览程序集中使用了哪些...

CVE-2026-103257

The automation platform n8n is vulnerable to a path traversal vulnerability in versions prior to 1.123.80, 2.39.6, and 2.40.1. The root cause is a failure to validate resource identifiers within the n8n node. An attacker can craft malicious resource IDs to redirect API calls to unintended targets...

EUVD-2026-72692

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

DEBIAN-CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

UBUNTU-CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

EUVD-2026-70516

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

EUVD-2026-56552

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

GHSA-H5V5-8746-G7MM JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins. Impact Users could workaround the plugin...

PYSEC-2026-2695 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Summary The chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthoriz...

Missing Authentication

SiYuan is vulnerable to Missing Authentication. The vulnerability is due to the kernel HTTP server unconditionally trusting all chrome-extension:// origins without authentication and the default empty AccessAuthCode on desktop installations, which allows an attacker controlling a malicious or...

CVE-2026-56776: Incorrect Authorization

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/workflowId/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real...

CVE-2026-50744

Revive Adserver 6.0.7 is affected by a bypass of the admin‑only restriction in the XML‑RPC API. The ox.login method returned a session ID cookie in HTTP headers and, although it reported an error, the session was not invalidated, allowing a leaked session ID to be reused for subsequent API calls ...