AutoPiff

AutoPiff 自动化补丁情报与发现框架 一个用于检测 Windows 内核驱动程序补丁中漏洞修复的语义分析引擎。AutoPiff 使用保守的 YAML 规则，以高精度和可解释性识别安全相关的代码变更。 概述 AutoPiff 分析易受攻击版本与已修补版本之间的差异，自动检测： 释放后使用修复 ExFreePool 后的空值赋值 边界检查添加 memcpy 前的长度校验 用户/内核边界加固 ProbeForRead/ProbeForWrite 整数溢出保护 安全数学辅助函数 状态加固 互锁引用计数 IOCTL 输入校验 、池损坏防护 、权限检查 等 主要特性 高精度...

nuvola

nuvola nuvola（小写 n）是一款工具，用于转储 AWS 环境配置和服务，并利用预定义、可扩展的自定义规则（通过简单 Yaml 语法创建）执行自动和手动安全分析。 该项目背后的核心理念是为云平台创建一个抽象的数字化孪生。举个更具体的例子：nuvola 借鉴了用于 Active Directory 分析的 BloodHound 特性，但应用于云环境（目前仅限 AWS）。 使用图数据库还增加了发现不同创新攻击路径的可能性，并可将其用作离线、集中且轻量级的数字化孪生。 快速开始 前提条件 已安装 docker-compose 配置了与 awscli 配合使用的 AWS...

erebus

基于简单YAML规则的快速可定制参数化漏洞扫描器 工作原理 • 安装 • 模板 • 拦截器 • 使用 • 加入Discord Erebus用于基于Yaml模板测试每个参数，实现零误报并提供对大量主机的快速扫描。Erebus提供许多有用的功能，包括一个拦截代理，允许研究人员浏览网页、点击链接，Erebus将测试通过代理的每个参数。 我们有一个专门的仓库，存放着各种类型的漏洞模板。 模板工作原理 安装Erebus ▶ GO111MODULE=off go get -u -v github.com/ethicalhackingplayground/erebus/erebus 安装模板 ▶...

sigmalite

github.com/runreveal/sigmalite sigmalite 包提供了 Sigma 检测格式 的解析器和执行引擎。 rule, err := sigmalite.ParseRulebyte title: My example rule detection: keywords: - foo - bar selection: EventId: 1234 condition: keywords and selection if err != nil return err entry := &sigmalite.LogEntry Message: "Hello foo",...

EUVD-2022-1367

Malicious code in bioql PyPI...

CVE-2021-30180

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...

GHSA-7WFC-X4F7-GG2X Code injection in Apache Dubbo

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...

GHSA-R577-4HQ7-73QH Remote Code Execution in Apache Dubbo

Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...

Unspecified Vulnerability in Apache Dubbo

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability previousl...

CVE-2021-30180

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...

CVE-2021-30180: Inconsistent Interpretation of HTTP Requests

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...