71 matches found
pixload
pixload -- Image Payload Creating tools DESCRIPTION Set of tools for hiding backdoors creating/injecting payload into images. The following image types are currently supported: BMP, GIF, JPG, PNG, WebP. about Useful references for better understanding of pixload and its use-cases: Bypassing CSP...
SnipRecover-CLI
SnipRecover CLI Detection and restoration of Windows Snipping Tool PNG captures vulnerable to CVE-2023-28303 SnipRecover CLI is a minimal, dependency-free command-line utility designed to: Detect PNG files modified by the Windows Snipping Tool vulnerability CVE‑2023‑28303. Restore the original...
EmbedPayloadInPng
EmbedPayloadInPng Embed a payload within a PNG file by splitting the payload across multiple IDAT sections. Each section is encrypted individually using its own 16-byte key with the RC4 encryption algorithm. Quick Links Maldev Academy Home Maldev Academy Syllabus Maldev Academy Pricing...
CVE-2026-91186
A vulnerability exists in the PNG decoder because the chunk reader fails to enforce chunk ordering, allowing a second IHDR chunk to be processed. If an attacker provides a PNG file with a second IHDR chunk positioned after the IDAT chunk, the decoder rewrites the image dimensions (width, height, ...
EUVD-2026-105034
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...
CVE-2026-91186 PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...
Crater-CVE-2023-46865-RCE
Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 Post-Auth RCE Superadmin Vulnerability Description Crater Invoice is vulnerable to unrestricted file upload with dangerous type due to lack of proper input validation. The Base64Mime checking class can be bypassed by embedding a valid PHP...
Malicious code in aciaiu-idat-doauuufa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a04fd8ceb07f68905b6b564ead35751f4ec780f05289a5c5340725230257445d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in aciaiaggu-idat-doa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 849e03658b49e80038659ab32879cc230db9f8f6e83573ab7614772db652ec73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-151700 Malicious code in aciaiaggu-idat-gfada (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d74d306962df7e169c02ec92a35be8f6cb9dff3e92350c248ae4b3de0c51a6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in aciaiaggu-idat-doua (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bef65c85e4bdc244783d3bfcb740bdba2402fd4b48963ffee6e36c2d8d6c23c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2014-9142
Malware in sbrugna...
EUVD-2017-7972
Malware in sbrugna...
EUVD-2015-0981
Malware in sbrugna...
EUVD-2014-0371
Malware in sbrugna...
opencv:core_fuzzer: Heap-buffer-overflow in png_combine_row
Project: https://github.com/opencv/opencv.git Detailed Report: https://oss-fuzz.com/testcase?key=6096791281139712 Project: opencv Fuzzing Engine: afl Fuzz Target: corefuzzer Job Type: aflasanopencv Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x7c194d0e0a08 Crash State...
Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service
...
Stories from the SOC Part 2: MSIX Installer Utilizes Telegram Bot to Execute IDAT Loader
Rapid7’s Managed Detection and Response MDR team continuously monitors our customers' environments, identifying emerging threats and developing new detections. In August 2023, Rapid7 identified a new malware loader named the IDAT Loader. Malware loaders are a type of malicious software designed t...
Stories from the SOC Part 1: IDAT Loader to BruteRatel
Rapid7’s Managed Detection and Response MDR team continuously monitors our customers' environments, identifying emerging threats and developing new detections. In August 2023, Rapid7 identified a new malware loader named the IDAT Loader. Malware loaders are a type of malicious software designed t...
New IDAT Loader Attacks Using Steganography to Deploy Remcos RAT
Ukrainian entities based in Finland have been targeted as part of a malicious campaign distributing a commercial remote access trojan known as Remcos RAT using a malware loader called IDAT Loader. The attack has been attributed to a threat actor tracked by the Computer Emergency Response Team of...