5927 matches found
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: Wait for previous GC cycles when removing a port. The syzbot encountered a use-after-free issue1. This issue occurs because the bridge does not ensure that all previous garbage collection cycles are completed...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fixed a race condition between namespace cleanup and garbage collection for the list:set type. Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and garbage collection of...
Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10
In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: Defer the garbage collection of registered files to iouring’s responsibility. Instead of having unixgc handle the registered files of iouring, we want iouring to handle them itself. The key here is to consider the...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftsetrbtree: Fixed an issue with overlapping expiration walks. The lazy garbage collection during insertion, which should remove entries when the timeout occurs, fails to properly release the remaining part of the...
Astra Linux – Vulnerability in Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: The commit mutex should not be released during the critical section between nftgcseqBegin and nftgcseqEnd. Otherwise, the async GC worker could collect expired objects and obtain the released commit lock with...
Astra Linux – Vulnerability in Firefox and Thunderbird
After a Garbage Collector compaction, weak maps might have been accessed before they were properly traced. This led to memory corruption and potentially exploitable crashes. This vulnerability affects Firefox 112, Focus for Android 112, Firefox ESR 102.10, Firefox for Android 112, and Thunderbird...
Astra Linux – Vulnerability in Tomcat9
Improper resource shutdown or release vulnerabilities in Apache Tomcat. If an error occurs including exceeding limits during the processing of a multipart upload, temporary copies of the uploaded parts that were written to disk are not deleted immediately but are left for the garbage collection...
FLAIR
F-Secure 轻量级事件响应取证采集工具（FLAIR） 本文档描述了 FLAIR 采集脚本的用途和基本操作。 用途 在调查客户环境中的安全事件时，有时客户环境中并未部署 EDR 解决方案，导致 IR 团队无法利用其在整个环境中收集取证工件。FLAIR 正是为了对目标主机上的若干关键工件执行半自动化采集而创建的。 FLAIR 填补了主机完整取证镜像所能提供的深层数据与 EDR 解决方案所提供的更具针对性和交互性的方法之间的空白。 设计 FLAIR 基于以下原则创建： 尽可能仅使用 Microsoft Windows 系统自带的工具，即仅使用操作系统“内置”的程序...
ESFang
ESFang 这是一个专为在 macOS 环境中模块化消费 EndpointSecurity Framework ESF 事件而设计的工具。这是我尝试解决现有工具中遇到的诸多问题的一次努力，这些问题包括静默数据丢失、严格的事件类型消费、缺乏对替代数据事件类型的支持以及文件访问处理器过载等。 该工具在很大程度上借鉴了 Chris Ross、Omark-Ikram 以及 Objective-See 团队在其工具 ProcessMonitor、Appmon 和 EndpointSecurityDemo 中所做的出色工作。我对 ESF...
macOSTriageCollectionScript
macOSTriageCollectionScript 一个用于 macOS 的取证数据收集脚本，利用 sysdiagnose 并附加少量功能来收集调查所需的取证数据。 该脚本收集哪些数据？ 收集的数据包括： sysdiagnose ，一种在多种 macOS/iOS 操作系统中可用的实用程序，用于收集“系统级诊断信息”。此处主要用于获取其收集的日志文件和实时数据。 文件列表，由于 APFS 不像 NTFS 那样拥有主文件表（MFT），为了了解文件系统上存在哪些内容，我们使用 stat 、 shasum 和 file 的组合创建多个 CSV...
CVE-2023-24288
A flaw was found in Portable Puzzle Collection. A local attacker could exploit this vulnerability by creating an excessive amount of save states. This could lead to a Denial of Service DoS, making the application unavailable to legitimate users. Mitigation Mitigation for this issue is either not...
CVE-2023-24291
A flaw was found in Portable Puzzle Collection. A buffer overflow vulnerability exists when processing the record length parameter. A local attacker could exploit this flaw, with high attack complexity, to trigger a denial of service, making the application unavailable. Mitigation Mitigation for...
Security update for ansible-core
This update for ansible-core fixes the following issues: CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
Concierge
Concierge Toolkit: 物理アクセス制御の識別と悪用 Concierge Toolkit は、物理アクセス制御および監視システムの識別と悪用を支援するためのさまざまなスクリプトとリソースのコレクションです。 Concierge は現在、以下のベンダー向けのテストおよび/またはエクスプロイトを含んでいます: HID AMAG Mercury Security OEM Mercury、Lenel、Honeywell など 汎用/ベンダーニュートラル インストール Concierge モジュールには libsnmp-dev が必要です: root@kitploit: apt-ge...
webshell
webshell | English | Türkiye これはwebshell収集プロジェクトです。 人にバラを贈れば、手には余り香が残る。このプロジェクトをダウンロードした方は、ぜひshellを提出してください。 このプロジェクトは、さまざまなよく使われるスクリプトを網羅しています。 例：asp,aspx,php,jsp,pl,py webshellを提出する場合、名前とパスワードは変更しないでください。 注意：すべてのshellについてバックドアが含まれているかどうかは保証できません。ただし、私がアップロードしたものに故意にバックドアを仕込むことは絶対にありません。...
CVE-2023-24286
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter...
CVE-2023-24285
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed...