arkime

Arkime Arkime es un sistema de análisis de red y captura de paquetes de código abierto a gran escala. Arkime aumenta tu infraestructura de seguridad actual para almacenar e indexar el tráfico de red en formato PCAP estándar, proporcionando acceso indexado rápido. Se proporciona una interfaz web...

Malcolm

Malcolm Malcolm은 다음과 같은 목표를 염두에 두고 설계된 강력한 네트워크 트래픽 분석 도구 모음입니다: 사용하기 쉬움 – Malcolm은 전체 패킷 캡처PCAP 파일, Zeek 로그, Suricata 알림 형태의 네트워크 트래픽 데이터를 수용합니다. 이러한 아티팩트는 간단한 브라우저 기반 인터페이스를 통해 업로드하거나 경량 포워더를 사용하여 수동적으로 캡처하여 Malcolm으로 전달할 수 있습니다. 두 경우 모두 데이터는 자동으로 정규화, 강화 및 상관 분석됩니다. 강력한 트래픽 분석 – 네트워크 통신에 대한 가시...

EUVD-2026-61160

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

PT-2026-62010

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script extracts uploaded archives without imposing limits on the number of entries, directory depth, total entries, or output size. An attacker can use a small malicious archive...

PT-2026-62011

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script fails to implement traversal protection when creating directory entries using the os.makedirsos.path.joindest, entry.pathname function. An attacker can upload a malicious...

JA4+ - Suite Of Network Fingerprinting Standards

JA4+ is a suite of network Fingerprinting methods that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for threat actors, malware detection, session...

Malicious code in arkime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e6853d07fc7ca8efb0ffc45302b6b677a4b83c2e2de0e773616d9009f9b0ad8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1281 Malicious code in arkime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e6853d07fc7ca8efb0ffc45302b6b677a4b83c2e2de0e773616d9009f9b0ad8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

S1EM - This Project Is A SIEM With SIRP And Threat Intel, All In One

Today, cyber attacks are more numerous and cause damage in companies. Nevertheless, many software products exist to detect cyber threats. The S1EM solution is based on the principle of bringing together the best products in their field, free of charge, and making them quickly interoperable. S1EM ...