HookDump

HookDump EDR関数フックダンプ 詳細については、Zeroperilのブログ記事を参照してください https://zeroperil.co.uk/hookdump/ ビルド方法 ビルドにはVisual Studio 2019（Community Editionで可）とCMakeが必要です。バッチファイルConfigure.batを実行すると、Visual Studioソリューションを含む2つのビルドディレクトリが作成されます。 正しいCMakeコマンドラインを使用すれば、MinGWでもビルドできる可能性がありますが、未テストのため結果は保証できません。...

IATelligence

IATelligence IATelligence 是一个 Python 脚本，用于从 PE 文件中提取导入地址表（IAT），并利用 OpenAI 的 GPT-3 模型提供该文件导入的每个 Windows API 的详细信息。该脚本还会搜索相关的 MITRE ATT&CK 技术，并解释攻击者可能如何利用这些 API。 它还会显示文件哈希，并估算 GPT-3 请求的成本。IATelligence 是使用 GPT-3 进行恶意软件分析并根据 IAT 快速评估恶意软件行为的概念验证。 以下是结果的一个简单示例。请注意，根据 IAT 的大小，请求可能需要更长时间。 快速开始 先决条件...

DRMBinViaOrdinalImports

DRMBinViaOrdinalImports - 创建防复制 DRM 恶意软件 快速链接 Maldev Academy 首页 Maldev Academy 课程大纲 Maldev Academy 定价 摘要 该存储库使用一种技术来修改程序的导入地址表（IAT），将导入的函数名称替换为相应的序号，从而生成一个仅通过序号导入函数的二进制文件。 由于不同系统上序号值的不匹配，该技术降低了二进制文件被沙箱系统成功分析的机会。这种差异会导致 Windows 加载程序要么无法定位正确的函数地址，要么检索到错误的函数，从而使二进制文件在沙箱环境中损坏。最后，该技术使对二进制文件进行逆向工程变得更加困...

Gray-Box Poisoning of Continuous Malware Ingestion Pipelines

Modern malware detection pipelines rely on continuous data ingestion and machine learning to counter the high volume of novel threats. This work investigates a realistic gray-box poisoning threat model targeting these pipelines. Using the secmlmalware framework, we generate problem-space...

CVE-2025-60686

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers A720R V4.1.5cu.614B20230630, LR1200GB V9.1.0u.6619B20230130, and NR1800X V9.1.0u.6681B20230703. Both programs parse the contents of /proc/net/arp using sscanf with "%s" format...

PT-2025-46856

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers A720R V4.1.5cu.614 B20230630, LR1200GB V9.1.0u.6619 B20230130, and NR1800X V9.1.0u.6681 B20230703. Both programs parse the contents of /proc/net/arp using sscanf with "%s"...

EUVD-2005-0141

Malware in sbrugna...

EUVD-2005-0116

Malware in sbrugna...

EUVD-2017-3811

Malware in sbrugna...

EUVD-2025-31030

Malicious code in bioql PyPI...

CVE-2025-20316

A vulnerability in the access control list ACL programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device. This vulnerability is due to the flooding of traffic from an...

CVE-2025-20316

A vulnerability in the access control list ACL programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device. This vulnerability is due to the flooding of traffic from an...

CVE-2025-20316

CVE-2025-20316 describes a vulnerability in the ACL programming of Cisco IOS XE Software on Cisco Catalyst 9500X and 9600X Series Switches. The issue allows an unauthenticated, remote attacker to bypass a configured egress ACL. The root cause is tied to traffic flooding from an unlearned MAC addr...

CVE-2023-46354

In the module "Orders CSV, Excel Export PRO" ordersexport 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information fro...

CVE-2023-45380

In the module "Order Duplicator " Clone and Delete Existing Order" orderduplicate in version = 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from...

PT-2023-29537 · Prestashop · Order Duplicator Module

Name of the Vulnerable Software and Affected Versions: Order Duplicator module for PrestaShop versions = 1.1.7 Description: The issue allows a guest to download personal information without restriction due to a lack of permissions control. This includes accessing data from the ps customer and ps...

PrestaShop Order Duplicator Security Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts, and product image zoom and other features. A security vulnerability exists in PrestaShop Order Duplicator - Clone and Delete Existing Order...

kernel: rtw89: ser: fix CAM leaks occurring in L2 reset

In the Linux kernel, the following vulnerability has been resolved: rtw89: ser: fix CAM leaks occurring in L2 reset The CAM, meaning address CAM and bssid CAM here, will get leaks during SER system error recover L2 reset process and ieee80211restarthw which is called by L2 reset process eventuall...

SUSE CVE-2015-6249

The dissectwccp2r1addresstableinfo function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses, which allows remote attackers to cause a denial of service application crash via a...

laZzzy - Shellcode Loader, Developed Using Different Open-Source Libraries, That Demonstrates Different Execution Techniques

laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion Encrypte...