GHSA-X6JW-M9V5-85VH simple-git unsafe-operation guard does not block trailer command configuration

Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...

simple-git unsafe-operation guard does not block trailer command configuration

Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...

kern

kern: デーモン不要の rootless コンテナランタイム兼サンドボックス。エージェントのツール呼び出しや LLM が生成したコードを、カーネルで強制されたコンテナ内で実行します。 本物のカーネル強制コンテナを、単一の静的バイナリから、デーモンなしで、数ミリ秒で。 MCP 対応 : Claude Code、Cursor、Claude Desktop、LM Studio に対応。Kern Sandbox 経由。 待機時 RAM 0 · デーモンなし、ソケットなし、起動するものなし · 単一の静的バイナリ、Rust の依存は libc のみ Linux. Windows and mac...

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

GHSA-54P9-H82J-F925 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

CVE-2024-6678

CVE-2024-6678 - GitLab: パイプラインスケジュールの任意ユーザートリガー CVE-2024-6678 の PoC 脆弱性の説明 GitLab では、ユーザーは「Play」ボタンを使って CI/CD パイプラインのスケジュール（Pipeline Schedules）を手動で起動できます。この脆弱性は、「play」機能がDeveloper 権限を持つすべてのユーザー （スケジュールの所有者だけでなく）にスケジュールの起動を許可することです。これにより、次の 2 つの結果が生じます： 1. 開発者が、より特権を持つユーザー（Maintainer /...

openvz-cve-patch-2026

GhostLock - CVE-2026-43499 backport patch for openVZ 7 CVE-2026-43499 backport patch for openVZ 7 kernel vzkernel-3.10.0-1160.129.1.ovz7.226.2 Since OpenVZ team didnt deploy patch for OpenVZ kernel yet with help of Claude i've created this one and it seems to work! ive tested it on two servers in...

copyfail-deconstructed

copyfail-deconstructed 이해하기 쉬운 버전의 CVE-2026-31431입니다. 이는 누구나 root가 될 수 있게 하는 권한 상승 기법입니다. 원본 개념 증명 코드는 https://github.com/theori-io/copy-fail-CVE-2026-31431 에서 찾을 수 있지만, 가능한 한 작은 설치 공간footprint을 갖도록 고도로 압축되고 축소되어 있습니다. 이 저장소는 해당 코드가 수행하는 작업, 페이로드가 로드되는 방식, 다양한 아키텍처를 대상으로 지정하는 방법을 포함하여 그 코드를 보다 읽기...

gradient-untangler

gradient-untangler A local research harness that searches for the exact tokens that make an open-weight language model start its answer the way you specify. Open-weight models ship as ordinary files: config.json, a tokenizer, and one or more .safetensors or .bin shards. A Hugging Face id is only ...

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Summary vm2's current host-intrinsic prototype protection is incomplete. The fix for GHSA-vwrp-x96c-mhwq blocks sandbox writes into classic host intrinsics such as Object.prototype, Array.prototype, and Function.prototype, but current head still lets sandbox code in a default VM reach and mutate...

GHSA-3VGF-8M4Q-Q4QR vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Summary vm2's current host-intrinsic prototype protection is incomplete. The fix for GHSA-vwrp-x96c-mhwq blocks sandbox writes into classic host intrinsics such as Object.prototype, Array.prototype, and Function.prototype, but current head still lets sandbox code in a default VM reach and mutate...

sshelf

sshelf Fuzzy-search your SSH hosts and connect in two keystrokes. sshelf keeps its own host list, builds the ssh command for you, and then gets out of the way. It hands the terminal to real OpenSSH and never touches /.ssh/config. Install macOS and Linux, x8664 and arm64. The prebuilt packages nee...

mxc

Microsoft eXecution Container MXC MXC は、Windows、Linux、macOS 上で信頼できないコード（モデル出力、プラグイン、ツール）を実行するためのサンドボックス化されたコード実行システム です。OS ネイティブのプロセスサンドボックスから完全な VM まで、複数の隔離バックエンドを、統一された JSON 構成スキーマと TypeScript SDK の背後で提供します。 !WARNING このリポジトリには、Microsoft Execution Containers...

CVE-2026-43499-T807D

T807D 最終成果物—ソースコード一対一対応復元パッケージ 生成日：2026-08-08 結論 本ディレクトリには、現在のプロジェクトで復元可能な完全な popsicle ソースツリー、必要なヘッダーファイル、埋め込み su ペイロード、本番バイナリ、および実行スクリプトが整理されています。 区別する必要があります： 1. r562 SO と r557 helper の本番バイナリは完全に保持されており、ハッシュは検証可能です。 2. プロジェクトには、これら2つの本番バイナリのコンパイル前の旧ソーススナップショット、オブジェクトファイル、または DWARF...

lighthouse

Lighthouse - リバースエンジニアのためのカバレッジエクスプローラー 概要 Lighthouseは、IDA ProおよびBinary Ninja向けの強力なコードカバレッジエクスプローラーであり、シンボルやソースコードを必要とせずにネイティブアプリケーションの実行マップを調査するための、独自のインタラクティブな操作機能をソフトウェアリサーチャーに提供します。 本プロジェクトはIDAの2017 Plug-In Contestで2位に入賞し、その後、セキュリティリサーチ業界への貢献により2021年Pwnie Awardsにノミネートされました。...

lighthouse

Lighthouse - A Coverage Explorer for Reverse Engineers Overview Lighthouse is a powerful code coverage explorer for IDA Pro and Binary Ninja, providing software researchers with uniquely interactive controls to study execution maps for native applications without requiring symbols or source. This...

Learn-about-cve-2025-31133-poc

CVE-2025-31133-PoC 학습하기 개요 CVE-2025-31133 에 대한 개념 증명 데모 및 학습 환경입니다. 이는 runc의 보안 취약점으로, 경쟁 조건을 통해 maskedPaths 보호를 우회할 수 있습니다. maskedPaths는 컨테이너가 민감한 호스트 파일 시스템 경로에 접근하는 것을 방지하도록 설계되었습니다. https://github.com/user-attachments/assets/d7b4ea43-6cab-4ac5-bb07-08bc46479910 👉 이 저장소는 Black Hat 트레이닝에서 가르치는...

asm-copyfail

CVE-2026-31431 Copy Fail — x86-64 어셈블리어 분석 및 개발 Theori에 게시된 소스 코드를 기반으로, 완전히 순수 어셈블리 언어외부 라이브러리 없음로 변환할 때까지 여러 연습을 수행할 것입니다.python !/usr/bin/env python3 Archivo: copyfail.py import os as g,zlib,socket as s def dx:return bytes.fromhexx def cf,t,c:...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI 익스플로잇 ⚠️ 면책 조항 이 도구는 교육 목적 및 승인된 보안 테스트 전용입니다. 이 개념 증명 익스플로잇은 보안 전문가가 취약점을 이해하고 시스템을 보호할 수 있도록 교육 목적으로 제공됩니다. 승인되지 않은 컴퓨터 시스템 접근은 불법입니다. 저자는 이 도구의 오용이나 손해에 대해 어떠한 책임도 지지 않습니다. 테스트 전에 시스템 소유자로부터 명시적인 서면 허가를 받아야 합니다. 이 도구를 사용함으로써 귀하는 모든 관련 법률을...

Java-Compressed-file-security

Java-Compressed-file-security Java 웹 압축 파일 보안 취약점 테스트 환경: Windows For Apache Tomcat/8.5.16 0x01 디렉터리 트래버설 악성 압축 파일 제작 코드: coding=utf-8 import zipfile import sys if name == "main": try: with open"404.jsp", "r" as f: binary = f.read zipFile = zipfile.ZipFile"test.zip", "a", zipfile.ZIPDEFLATED info...