ppid-spoofing

https://www.countercept.com/blog/detecting-parent-pid-spoofing/...

Raccine

Raccine シンプルなランサムウェア対策 なぜ ランサムウェアが vssadmin を使ってすべてのシャドウコピーを削除するのをよく見かけます。その要求をインターセプトして、呼び出したプロセスを強制終了できたらどうでしょうか？シンプルなワクチンを作ってみましょう。 仕組み 私たちは、コンパイル済みの raccine.exe を vssadmin.exe（および wmic.exe）用のデバッガとして登録します。Raccine は、まず親プロセスの PID をすべて収集し、その後すべての親プロセスを強制終了しようとするバイナリです。 長所: この方法はかなり汎用的です...

CVE-2017-11882-Blocker

CVE-2017-11882-Blocker CVE-2017-11882 を無効化する Windows ドライバー : 動作の仕組み このプロジェクトは、カスタムデバイス上で 逆呼び出しモデル を使用して通信する、カーネルドライバーとユーザーモード通知コンポーネントに分かれています。 カーネルドライバー 1. プロセスコールバック - DriverEntry は PsSetCreateProcessNotifyRoutineEx コールバックを登録し、新しいプロセスの実行が開始される前に、システム全体でプロセスが作成されるたびにドライバーが同期的に呼び出されるようにします。 2...

SelectMyParent

これは何ですか これは親プロセススプーフィングのためのプロジェクトです。 使い方 ステップ1:親プロセスを選択し、pidを覚えておいてください ステップ2:以下のコマンドを実行して、親プロセススプーフィングを実施します SelectMyParent.exe notepad 928 ステップ3:プロセスエクスプローラーを使用してプロセスツリーを表示すると、スプーフィングが成功したことを確認できます 参考 https://pentestlab.blog/2020/02/24/parent-pid-spoofing...

NPM: Electron: Parent process code-sign check is spoofable

NPM: Electron: Parent process code-sign check is spoofable vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

GHSA-JM7P-CC5G-QWXX Electron: Parent process code-sign check is spoofable

Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check; a local attacker could bypas...

CVE-2026-70597

Electron on macOS had a bug where the code-sign check that verifies a launched app’s parent process could be bypassed by a local attacker. This affects Electron versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. By exploiting this, a local attacker could bypass the fuse-based hardening ...

SUSE CVE-2026-46259

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading realparent in dotaskstat When reading /proc/pid/stat, dotaskstat accesses task-realparent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- dotaskstat var =...

EUVD-2016-4992

Malware in sbrugna...

EUVD-2021-7368

Malicious code in bioql PyPI...

CVE-2024-43704

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process...

Imagination GPU Driver 安全漏洞

Imagination GPU Driver is a graphics driver from Imagination. A security vulnerability exists in Imagination GPU Driver DDK24.2 RTM1 and earlier versions, which originates from software installed and run as an unprivileged user, and may make improper GPU system calls to access the graphics buffer...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

CVE-2024-10466

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

CVE-2024-10466

By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...