IDAssistMCP

IDAssistMCP Servidor plugin MCP Model Context Protocol independente para IDA Pro 9.x que expõe as capacidades de análise do IDA para clientes LLM como o Claude Desktop. Funcionalidades 41 ferramentas MCP cobrindo análise binária, descompilação, referências cruzadas, gerenciamento de símbolos,...

ampa.sys-exp

ampa.sys-exp मेरा कोड नहीं है। केवल सहेजने के लिए https://zeifan.my/Ampa-Driver-Analysis/...

001-Malware-Analysis-CVE-2017-11882

इस रिपॉजिटरी में README नहीं है।...

sandbox-attacksurface-analysis-tools

sandbox-attacksurface-analysis-tools version 2. c Google LLC. 2015 - 2024 Développé par James Forshaw Il s'agit d'une petite suite d'outils PowerShell pour tester diverses propriétés des sandbox sur Windows. Plusieurs outils prennent un flag -ProcessId qui permet de spécifier le PID d'un processu...

CVE-2015-10034

CVE-2015-10034 यह रिपॉजिटरी J-TAS Action के प्रदर्शन के लिए बनाई गई थी। workout-organizer-2aaedb7f69ea398a0217493fefe8f19b31ee0775 फ़ोल्डर में CVE-2015-10034 से संबंधित भेद्य एप्लिकेशन शामिल है। हमने J-TAS Action द्वारा किए गए विश्लेषण के परिणामों वाली SARIF फ़ाइल शामिल की है।...

CVE-2023-38039

CVE-Analysis لجميع تحليلات vicarius.io/vsoviety...

The Hardest Fork

Mythos is real. I know a big chunk of the industry thinks it's a marketing stunt, and I get why. I get it. But I've seen the findings, and they're bad. These aren't "whoops, this line right here is wrong, and that's RCE." They're novel combinations of a few dozen issues out of thousands of things...

PT-2026-37315

Name of the Vulnerable Software and Affected Versions ciguard versions 0.6.0 through 0.8.1 Description Both SCA HTTP clients in src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py call the function json.loads on response data without a maximum-bytes cap. A hostile or...

RealVuln: Benchmarking Rule-Based, General-Purpose LLM, and Security-Specialized Scanners on Real-World Code

How do security scanners perform on real-world code? We present RealVuln, the first open-source benchmark comparing Rule-Based SAST, General-Purpose LLMs, and Security-Specialized scanners on 26 intentionally vulnerable Python repositories educational and Capture-The-Flag applications with 796...

Security Assessment of Intel TDX with Support for Live Migration

In the second and third quarters of 2025, Google collaborated with Intel to conduct a security assessment of Intel Trust Domain Extensions TDX, extending Google's previous review and covering major changes since Intel TDX Module 1.0 - namely support for Live Migration and Trusted Domain TD...

Persistent Human Feedback, LLMs, and Static Analyzers for Secure Code Generation and Vulnerability Detection

Existing literature heavily relies on static analysis tools to evaluate LLMs for secure code generation and vulnerability detection. We reviewed 1,080 LLM-generated code samples, built a human-validated ground-truth, and compared the outputs of two widely used static security tools, CodeQL and...

Reading between the Code Lines: On the Use of Self-Admitted Technical Debt for Security Analysis

Static Analysis Tools SATs are central to security engineering activities, as they enable early identification of code weaknesses without requiring execution. However, their effectiveness is often limited by high false-positive rates and incomplete coverage of vulnerability classes. At the same...

AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection

Secure code review is critical at the pre-commit stage, where vulnerabilities must be caught early under tight latency and limited-context constraints. Existing SAST-based checks are noisy and often miss immature, context-dependent vulnerabilities, while standalone Large Language Models LLMs are...

An Empirical Study on Remote Code Execution in Machine Learning Model Hosting Ecosystems

Model-sharing platforms, such as Hugging Face, ModelScope, and OpenCSG, have become central to modern machine learning development, enabling developers to share, load, and fine-tune pre-trained models with minimal effort. However, the flexibility of these ecosystems introduces a critical security...

PBFuzz: Agentic Directed Fuzzing for PoV Generation

Proof-of-Vulnerability PoV input generation is a critical task in software security and supports downstream applications such as path generation and validation. Generating a PoV input requires solving two sets of constraints: 1 reachability constraints for reaching vulnerable code locations, and ...

EUVD-2017-17348

Malware in sbrugna...

Security Vulnerabilities in Software Supply Chain for Autonomous Vehicles

The interest in autonomous vehicles AVs for critical missions, including transportation, rescue, surveillance, reconnaissance, and mapping, is growing rapidly due to their significant safety and mobility benefits. AVs consist of complex software systems that leverage artificial intelligence AI,...

Systematic Timing Leakage Analysis of NIST PQDSS Candidates: Tooling and Lessons Learned

The PQDSS standardization process requires cryptographic primitives to be free from vulnerabilities, including timing and cache side-channels. Resistance to timing leakage is therefore an essential property, and achieving this typically relies on software implementations that follow constant-time...

Towards Effective Complementary Security Analysis Using Large Language Models

A key challenge in security analysis is the manual evaluation of potential security weaknesses generated by static application security testing SAST tools. Numerous false positives FPs in these reports reduce the effectiveness of security analysis. We propose using Large Language Models LLMs to...

react-native-keys insecurely stores encryption cipher and Base64 chunks

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure remote as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools...