Faraday 5.16.0

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...

Linux Distros Unpatched Vulnerability : CVE-2022-3767

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless ...

Linux Distros Unpatched Vulnerability : CVE-2022-28070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A null pointer deference in coreanalfcn function in radare2 5.4.2 and 5.4.0. CVE-2022-28070 Note that Nessus relies on the presence of the package as reported b...

Zeek 8.0.1

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek ha...

Malicious code in uitk_i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc864b28374d03fb38eaeac8bc4b8479334114789acb4be7c5f43a9a738d990c The OpenSSF Package Analysis project identified 'uitki18n' @ 99.99.1 npm as malicious. It is considered malicious because: - The package execute...

MAL-2025-41434 Malicious code in uitk_i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc864b28374d03fb38eaeac8bc4b8479334114789acb4be7c5f43a9a738d990c The OpenSSF Package Analysis project identified 'uitki18n' @ 99.99.1 npm as malicious. It is considered malicious because: - The package execute...

Malicious Package

Overview time-server-analysis is a malicious package. This package contains malicious code intended to exfiltrate data, and its contents have been removed from the official package manager. Although it appears to be a time-related utility, its main function is to collect system information and se...

INVT VT-Designer and HMITool

RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code in the context of the current process. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:...

SIExVulTS: Sensitive Information Exposure Vulnerability Detection System Using Transformer Models and Static Analysis

Sensitive Information Exposure SIEx vulnerabilities CWE-200 remain a persistent and under-addressed threat across software systems, often leading to serious security breaches. Existing detection tools rarely target the diverse subcategories of CWE-200 or provide context-aware analysis of code-lev...

PT-2026-33168

Name of the Vulnerable Software and Affected Versions AMD Platform Configuration Blob APCB SMM driver affected versions not specified Description Incorrect use of boot service in the AMD Platform Configuration Blob APCB SMM driver could allow a privileged attacker with local access Ring 0 to...

Collaborative Intelligence: Topic Modelling of Large Language Model Use in Live Cybersecurity Operations

Objective: This work describes the topic modelling of Security Operations Centre SOC use of a large language model LLM, during live security operations. The goal is to better understand how these specialists voluntarily use this tool. Background: Human-automation teams have been extensively...

Aligning Core Aspects: Improving Vulnerability Proof-Of-Concepts Via Cross-Source Insights

For vulnerabilities, Proof-of-Concept PoC plays an irreplaceable role in demonstrating the exploitability. PoC reports may include critical information such as specific usage, test platforms, and more, providing essential insights for researchers. However, in reality, due to various PoC templates...

MalLoc: toward Fine-Grained Android Malicious Payload Localization Via LLMs

The rapid evolution of Android malware poses significant challenges to the maintenance and security of mobile applications apps. Traditional detection techniques often struggle to keep pace with emerging malware variants that employ advanced tactics such as code obfuscation and dynamic behavior...

Linux Distros Unpatched Vulnerability : CVE-2018-12322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a heap out of bounds read in radare2 2.6.0 in 6502op in libr/anal/p/anal6502.c via a crafted iNES ROM binary file. CVE-2018-12322 Note that Nessus reli...

MAL-2025-41348 Malicious code in byresfsdfdsdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0b1380ef63b7b2c52e98cf7f5aebaa23316da368c8a3f7a00faf0e36b8fa8472 The OpenSSF Package Analysis project identified 'byresfsdfdsdf' @ 2.3.2 npm as malicious. It is considered malicious because: - The package...

Trust Me, I Know This Function: Hijacking LLM Static Analysis Using Bias

Large Language Models LLMs are increasingly trusted to perform automated code review and static analysis at scale, supporting tasks such as vulnerability detection, summarization, and refactoring. In this paper, we identify and exploit a critical vulnerability in LLM-based code analysis: an...

Malicious code in prettier-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dd4a56ce83136ba0c08709c38d11bee44b0351d7dd9c5bca68b457fcb1b44be9 The OpenSSF Package Analysis project identified 'prettier-v2' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-41345 Malicious code in prettier-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dd4a56ce83136ba0c08709c38d11bee44b0351d7dd9c5bca68b457fcb1b44be9 The OpenSSF Package Analysis project identified 'prettier-v2' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in typescript-5.6 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a01fda83028ac81fadc186832f18036fcd0c30fdddd56887177a977e57ad5e1 The OpenSSF Package Analysis project identified 'typescript-5.6' @...

Malicious code in suppressions (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9e3b924c14ff9c22bdc7afa4f89f7d776286be2e98bbbf1554f47af0a5944dc9 The OpenSSF Package Analysis project identified 'suppressions' @ 99.0...