CVE-2023-41717

CVE-2023-41717 Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions. Executive Summary During the summer of 2022, I have found a vulnerability affecting the ZScaler proxy versions 3.6.1.25 and prior. This...

testing-handbook

Trail of Bits Testing Handbook The Trail of Bits Testing Handbook is a resource for developers and security professionals on configuring, optimizing, and automating many static and dynamic analysis tools we use at Trail of Bits. Preview Testing Handbook: https://appsec.guide 🌐 Why is this needed?...

Astra Linux – Vulnerability in p7zip

7-Zip 22.01 does not report an error for certain invalid xz files that involve stream flags and reserved bits. Some later versions are unaffected...

RogueWinRM

RogueWinRM RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account with SeImpersonatePrivilege to Local System account if WinRM service is not running default on Win10 but NOT on Windows Server 2019. Briefly, it will listen for incoming connection on port...

publications

Publications from Trail of Bits Publications from Trail of Bits Academic Papers White Papers Guides and Handbooks Conference Presentations Automated bug finding and exploitation Blockchain Compilers Cryptography Engineering Education Infrastructure Machine Learning Mobile security Programming Sid...

LOLBITS

root@kitploit: ██╗ ██████╗ ██╗ ██████╗ ██╗████████╗███████╗ ██║ ██╔═══██╗██║ ██╔══██╗██║╚══██╔══╝██╔════╝ ██║ ██║ ██║██║ ██████╔╝██║ ██║ ███████╗ ██║ ██║ ██║██║ ██╔══██╗██║ ██║ ╚════██║ ███████╗╚██████╔╝███████╗██████╔╝██║ ██║ ███████║ ╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ Table of...

publications

Publicaciones de Trail of Bits Publicaciones de Trail of Bits Artículos académicos Libros blancos Guías y manuales Presentaciones de conferencias Detección y explotación automatizada de bugs Blockchain Compiladores Criptografía Ingeniería Educación Infraestructura Aprendizaje automático Seguridad...

skills

Mercado de Habilidades de Trail of Bits Un mercado de complementos de Claude Code de Trail of Bits que proporciona habilidades para mejorar el análisis de seguridad asistido por IA, las pruebas y los flujos de trabajo de desarrollo. Codex puede cargar este mercado a través de su compatibilidad co...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

http-protocol-exfil

http-protocol-exfil Usa la versión del protocolo HTTP para enviar un archivo bit a bit "HTTP/1.0" es un 0 y "HTTP/1.1" es un 1. Utiliza peticiones GET, por lo que el Blue Team solo vería las solicitudes a tu dirección IP. Sin embargo, se necesita mucho tiempo para enviar archivos grandes; por...

claude-code-devcontainer

开发容器中的 Claude Code 一个沙盒化开发环境，可安全启用 bypassPermissions 运行 Claude Code。由 Trail of Bits 为安全审计工作流构建。 为何使用此方案？ 在宿主机上使用 bypassPermissions 运行 Claude 存在风险——它可以在不确认的情况下执行任何命令。此开发容器提供了文件系统隔离 ，让你既能享受无限制 Claude 带来的生产力提升，又不会危及宿主机安全。 适用场景： 安全审计 ：审查客户端代码而不危及宿主机 不可信仓库 ：安全探索未知代码库 实验性工作 ：让 Claude 在隔离环境中自由修改代码 多仓库协作...

shepard

SHEPARD BITS 这是一个利用 Windows 后台智能传输服务（BITS）的持久化工具。 功能 文件下载、文件外传、文件下载 + 持久化执行 用法 以管理员身份运行 shepard.exe，并附带以下命令行参数： -d ：将文件常规下载到你选择的本地路径 -e ：从你选择的本地路径常规上传文件（仅发送到 IIS 服务器，这是 BITS 的限制） -dr optionalFileArgs ：将文件下载到你选择的路径，并尝试维持持久化。下载的文件将尝试以 optionalFileArgs 参数运行，BITS 每 30 秒检查一次，确保文件仍在受感染系统上运行。...

CVE-2026-89558

A flaw was found in the Linux kernel's md/raid10 RAID10 driver. This vulnerability occurs when a RAID10 array is in a degraded state and a device is being recovered while another mirror is still missing. Due to an inverted boolean value, the system incorrectly clears necessary bitmap bits, causin...

CVE-2026-89638

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

manticore

⚠️ Project is archived ⚠️ Este proyecto ya no se desarrolla ni mantiene internamente. Manticore...

CVE-2026-80921

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

DEBIAN-CVE-2026-80921

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

AZL-99950 CVE-2026-80921 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

CVE-2026-80921

CVE-2026-80921 affects the Linux kernel in the KVM s390 vsie (Virtual SIE) subsystem. When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), bits 64–255 retain stale values from the vsie page, potentially allowing a nested guest to access a device no longer available . The CVSS 3.1...

EUVD-2026-75098

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...