11 matches found
CVE-2025-61301
CVE-2025-61301 - CAPEv2: Negazione dell'analisi tramite fork ricorsivo di processi Descrizione Una vulnerabilità di gravità alta di negazione dell'analisi interessa reporting/mongodb.py e reporting/jsondump.py in CAPEv2 commit 52e4b43, del 2025-05-17 e consente agli attaccanti che possono inviare...
CVE-2025-61303
CVE-2025-61303 - RecordedFuture Triage: रिकर्सिव प्रोसेस फोर्किंग के माध्यम से विश्लेषण-अस्वीकार विवरण RecordedFuture Triage Sandbox Windows 10 build 2004 और Windows 10 LTSC 2021 में अपने Windows व्यवहारिक विश्लेषण इंजन में एक गंभीर कमजोरी है, जो प्रस्तुत किए गए मैलवेयर नमूने को पहचान से बचने और...
Split
Descrizione Divide et Impera è un algoritmo comunemente applicato in programmazione per risolvere un problema complesso dividendolo in molti sottoproblemi più semplici. Possiamo applicare questo approccio alla sicurezza offensiva con un obiettivo diverso: confondere gli EDR in modo che perdano...
LsassReflectDumping
LsassReflectDumping यह टूल RtlCreateProcessReflection API का उपयोग करके Process Forking तकनीक का लाभ उठाता है, ताकि lsass.exe प्रक्रिया का क्लोन बनाया जा सके। क्लोन बनने के बाद, यह क्लोन की गई प्रक्रिया का मेमोरी डंप उत्पन्न करने के लिए MINIDUMPCALLBACKINFORMATION कॉलबैक का उपयोग करता है। चरण...
CVE-2026-11625
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced...
CVE-2025-7394
In CVE-2025-7394, the OpenSSL compatibility layer’s RAND_poll() misbehavior can yield predictable random values from RAND_bytes() when fork() occurs, affecting only applications that call RAND_bytes() after forking (not internal TLS operations). WolfSSL implemented a complementary change so RAND_...
Nanodump - A Crappy LSASS Dumper With No ASCII Art
A flexible tool that creates a minidump of the LSASS process. 1. Features It uses syscalls with SysWhispers2 for most operations. Syscalls are called from an ntdll address to bypass some syscall detections. It sets the syscall callback hook to NULL. Windows APIs are called using dynamic invoke...
CVE-2017-17053
The initnewcontext function in arch/x86/include/asm/mmucontext.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a...
CVE-2017-17053
The initnewcontext function in arch/x86/include/asm/mmucontext.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a...
CVE-2016-2143
It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit o...
