33 matches found
zeek-community-id
Zeek 向け "Community ID" フローハッシュ この Zeek パッケージは、Community ID フローハッシュのサポートを提供します。これは、ネットワークモニターでトラフィックフローにラベルを付ける標準化された方法です。このパッケージを読み込むと、conn.log に communityid 文字列フィールドが追加されます。 メモ Zeek 6 以降のバージョンには Community ID のサポートが含まれています。 これらの Zeek バージョンを使用する場合、このパッケージは必要ありません。 詳細については、ドキュメント を参照してください。...
zeek-spicy-stun
STUN Session Traversal Utilities for NAT STUN This is a Zeek protocol analyzer that detects STUN based on Spicy. You must install Spicy to use this package. This package will create two logs: stun.log - This log has every STUN message. stunnat.log - This log has NAT detections from mapped...
zeek-plugin-roca
Johanna::ROCA This plugin implements detection of CVE-2017-15361 keys; it is a reimplementation of the source available at https://github.com/crocs-muni/roca. This plugin provides two new BIFs that can check public keys: rocavulnerablecert checks if a certificate is vulnerable rocavulnerablemod...
community-id-spec
コミュニティIDフローハッシング ZeekやSuricataなどのさまざまな監視アプリケーションからのフローデータを処理する際、あるデータセットから別のデータセットへすばやくピボットできることが望ましい場合がよくあります。必要なフロータプル情報は通常データセットに含まれていますが、そのような「結合」の詳細は、特にコーナーケースでは厄介なことがあります。この仕様は「コミュニティID」フローハッシングを説明するもので、特定のネットワークフローを表す文字列識別子の生成を標準化し、ピボットを単純な文字列比較にまで簡素化します。 疑似コード root@kitploit: function...
zeek-spicy-ospf
zeek-spicy-ospf これは、Zeek用のSpicyベースのOSPF v2 & v3パケットアナライザです。 このパッケージを使用するには、Spicy をインストールする必要があります。 リンク: オリジナルのロジックは、作者の許可を得て https://github.com/s-wells/spicyparsers/tree/main/ospf からインポートしたものです。 https://datatracker.ietf.org/doc/html/rfc2328 https://datatracker.ietf.org/doc/html/rfc2740...
zeek-elf
A Zeek ELF Package This package implements: ELF TLDR! If you have zkg and you have already run... root@kitploit: zkg autoconfig ... then you can install this package as so: root@kitploit: sudo zkg install zeek-elf Now in any Zeek script, just load the plugin and it "just works": root@kitploit:...
PT-2026-62010
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...
PT-2026-62011
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
EUVD-2023-59424
Malicious code in bioql PyPI...
EUVD-2023-59425
Malicious code in bioql PyPI...
EUVD-2023-59423
Malicious code in bioql PyPI...
The vulnerability of the Zeek plugin for industrial system management protocols ICSNPP-Ethercat, which involves reading data beyond the buffer in memory, allows attackers to cause service failures or gain unauthorized access to protected information.
The vulnerability of the Zeek plugin for industrial system management protocols ICSNPP-Ethercat relates to the reading of data beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or gain unauthorized access to protected information...
The vulnerability of the Zeek plugin for industrial control systems’ network protocols (ICSNPP-Ethercat) relates to writing beyond the buffer boundaries in memory, allowing a hacker to execute arbitrary code.
The vulnerability of the Zeek plugin for industrial control systems’ network protocols ICSNPP-Ethercat is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the Zeek plugin for industrial system control protocols (ICSNPP-Ethercat) relates to writing beyond the buffer boundaries in memory, allowing a hacker to execute arbitrary code.
The vulnerability of the Zeek plugin for industrial control systems’ network protocols ICSNPP-Ethercat is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2023-7242
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds read during the process of analyzing a specific Ethercat packet. This could allow an attacker to crash the Zeek process and leak some information in memory...
CVE-2023-7243
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution...
CVE-2023-7244
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write in their primary analyses function for Ethercat communication packets. This could allow an attacker to cause arbitrary code execution...
CVE-2023-7243
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution...
Out-of-bounds
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution...
CVE-2023-7242 Ethercat Zeek Plugin Out-of-bounds Read
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds read during the process of analyzing a specific Ethercat packet. This could allow an attacker to crash the Zeek process and leak some information in memory...