go_parser

IDAPro用のYet Another Golangバイナリパーサー 英語 |中文 注記 : 現在の最新のmasterブランチはPython3版です。以前のmasterブランチはpy2 ブランチに変更され、一時的にメンテナンスされていません 。 Python3ブランチの説明 このバージョンはmacOS/Windows、IDA7.4+、Python3.8.xで開発・テストされています。他のプラットフォームやバージョンで問題がある場合は、issueやPull Requestを送信してください。...

CVE-2026-82439

CVE-2026-82439 affects the DRPC server in Apache Storm . The root cause is an unbounded memory leak: the DRPC server maintained a map from client-supplied function names to request queues, but no code path ever removed an entry. Since function names are unconstrained by registered topologies, an ...

rust_syscalls

RUSTSYSCALLS ランタイムSSN解決を備えたWindows向けの、シングルスタブによる直接・間接syscall。 特徴: すべてのsyscallを1行で実行可能 コンパイル時に関数名をハッシュ化 直接または間接syscall x8664、WOW64、x86ネイティブ対応 カスタムSSN取得メソッドの実装を可能にする設計詳細はこのREADMEの末尾を参照 使い方: 1. gitリポジトリ / ローカルパスを依存関係としてライブラリに追加します: rustsyscalls = git = "https://github.com/janoglezcampos/rustsyscalls...

IDARustDemangler

IDA Rust Demangler このプロジェクトは、Rustの関数名をデマングルし、IDA用に正規化するスクリプトを提供します。これにより、コードが読みやすく、理解しやすくなります。 必要条件 Python 3.x IDA Pro 7.x 以降 依存関係 このスクリプトで使用されるデマングルアルゴリズムは、rs-dml バイナリに基づいています。あらかじめインストールされていることを確認してください。 インストール プラグインのインストールは簡単なプロセスです。plugin/...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pinctrl: Check the return value of pinmuxops::getfunctionname. While the API contract in the documentation does not explicitly specify this, the generic implementation of the getfunctionname callback from struct pinmuxops –...

CVE-2026-47670

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

CVE-2026-47668 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

Authenticated Remote Code Execution (RCE)

DbGate is vulnerable to authenticated Remote Code Execution RCE. The vulnerability is due to improper sanitization of the functionName parameter in the /runners/load-reader endpoint, which allows an authenticated attacker to bypass the require = null mitigation using dynamic import and execute...

CVE-2026-48017 DbGate: Remote Code Execution via functionName injection in loadReader endpoint

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

CVE-2026-48017

Summary (CVE-2026-48017) DbGate

CVE-2026-48017 DbGate: Remote Code Execution via functionName injection in loadReader endpoint

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

Exploit for CVE-2026-48017

CVE-2026-48017 — Remote Code Execution in DbGate via function...

GHSA-HV83-GGC4-V385 DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Summary The POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, no special permissions required can inject arbitrary JavaScript...

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Summary The POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, no special permissions required can inject arbitrary JavaScript...

GHSA-WM5R-5QP3-5VXF Authenticated Remote Code Execution via loadReader functionName code injection in DbGate

Summary DbGate is vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed v...

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

Summary DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The...

Insecure Default Initialization of Resource

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScrip...

PT-2026-47062

Name of the Vulnerable Software and Affected Versions DbGate versions prior to 7.1.9 Description The unzipDirectory function in packages/api/src/shell/unzipDirectory.js fails to validate that extracted file paths remain within the designated output directory. This allows a malicious ZIP archive...