hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

vhosts-sieve

VHosts Sieve Searching for virtual hosts among non-resolvable domains. Installation git clone https://github.com/dariusztytko/vhosts-sieve.git pip3 install -r vhosts-sieve/requirements.txt Usage Get a list of subdomains e.g. using Amass $ amass enum -v -passive -o domains.txt -d example.com -d...

pesieve-go

pesieve-go Golang bindings for PE-sieve. Requires pe-sieve32.dll, pe-sieve64.dll of a supported version to be present in the project directory, or in a path pointed by the environment variable: PESIEVEDIR. API Exposes the following wrappers for PE-sieve API: PESieveVersion uint32 func PESieveHelp...

From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust. Compromising it can therefore expose both email and the identities and workflows built around it. During a broader assessme...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130075)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130075 advisory. An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory...

dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free

A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...

pe-sieve

Introducción PE-sieve es una herramienta que ayuda a detectar malware en ejecución en el sistema, así como a recolectar el material potencialmente malicioso para su posterior análisis. Reconoce y vuelca una variedad de implantes dentro del proceso escaneado: PE reemplazados/inyectados, shellcodes...

mal_unpack

malunpack Unpacker dinamico basato su PE-sieve 📖 Leggi altro . Distribuisce un malware packed, attende che questo esegua l'unpack del payload, esegue il dump del payload e termina il processo originale. !CAUTION Questo unpacker distribuisce il malware originale. Usalo solo su una macchina virtual...

vhosts-sieve

VHosts Sieve Búsqueda de hosts virtuales entre dominios no resolubles. Instalación git clone https://github.com/dariusztytko/vhosts-sieve.git pip3 install -r vhosts-sieve/requirements.txt Uso Obtenga una lista de subdominios por ejemplo, usando Amass $ amass enum -v -passive -o domains.txt -d...

ida_ifl

IFL - Elenco interattivo delle funzioni Licenza: CC-BY https://creativecommons.org/licenses/by/3.0/ Un piccolo plugin con l'obiettivo di fornire un modo intuitivo per navigare tra le funzioni e i loro riferimenti. Inoltre, consente di importare report generati ad esempio da PE-sieve in IDA...

dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free

A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...

CVE-2026-50055

A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address...

CVE-2026-50055

A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding restrictions. By using a Sieve notify action to send copies of email content and headers to an arbitrary address, an attacker can exfiltrate emails. This vulnerability was disco...

EUVD-2026-95098

A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address...

CVE-2026-50055 Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion

A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address...

CVE-2026-107572

Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the match...

CVE-2026-107572

Progressive Robot hMailServer versions 6.2.24 through 6.3.5 are vulnerable to a Denial of Service (DoS) condition due to inefficient complexity in Sieve filter evaluation. The vulnerability arises from a backtracking descent during :matches pattern matching, where execution time grows exponential...

CVE-2026-107572 Inefficient Regular Expression Complexity in hMailServer

Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the match...

EUVD-2026-94856

Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the match...

CVE-2026-107572 Inefficient Regular Expression Complexity in hMailServer

Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the match...