iMonitorSDK

中文 Introduction iMonitorSDK est un kit de développement qui fournit une surveillance du comportement système pour les endpoints et la sécurité cloud. Il est conçu pour aider les applications industrielles telles que la sécurité, la gestion des endpoints et l'audit à implémenter rapidement les...

openedr

OpenEDR Chez OpenEDR, nous croyons en la création d'une plateforme de cybersécurité dont le code source est ouvertement accessible au public, où les produits et services peuvent être provisionnés et gérés ensemble. L'EDR est notre point de départ. OpenEDR est une capacité EDR complète. C'est l'un...

wazuh

Wazuh Wazuh — это бесплатная платформа с открытым исходным кодом, используемая для предотвращения, обнаружения и реагирования на угрозы. Она способна защищать рабочие нагрузки в локальных, виртуализированных, контейнерных и облачных средах. Решение Wazuh состоит из агента безопасности конечных...

mac-monitor

🎉 Bienvenue dans le nouveau foyer officiel de Mac Monitor ! Mac Monitor est un outil de surveillance système avancé et autonome, spécialement conçu pour la recherche en sécurité macOS, le triage de malwares et le dépannage système. Tirant parti des API Endpoint Security ES et System Extension...

santamon

Santamon Облегченный сайдкар обнаружения для macOS для Santa, который локально оценивает телеметрию Endpoint Security с помощью правил CEL и пересылает только совпавшие сигналы обнаружения на сервер бэкенда. Экспериментальный. Создан для домашних лабораторий и небольших парков устройств. Ранний...

powerob

Powerob An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity. This only obfuscates functions and removes found in PowerShell scripts. Roadmap includes bfuscating variables. Pull requests and collaborative welcomed. About This was built out of the need ...

WhiteBeam

Прозрачная безопасность конечных точек Возможности Блокировка и обнаружение сложных атак Современная проверенная криптография: RustCrypto для хеширования и шифрования Высокая совместимость: разработка ориентирована на все платформы включая устаревшие и архитектуры Исходный код доступен: аудиты...

Crescendo

Содержание 1. Начало работы 2. Требования 3. Компоненты 4. Тестирование и разработка 5. Подписание 6. Сборка 7. Проблемы/Ошибки/Функции 8. Устранение неполадок 9. Список задач Начало работы Apple представила несколько новых механизмов безопасности, которые нам необходимо включить для работы...

tfc

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

autoresponder

AutoResponder Carbon Black Response IR tool for hunting threats in an environment What is it? AutoResponder is a tool aimed to help people to carry out their Incident Response tasks WITH the help of Carbon Black Response's awesome capabilities and WITHOUT much bothering IT/System/Network Teams Wh...

shad0w

SHAD0W SHAD0W is a modular C2 framework designed to successfully operate on mature environments. It uses a range of methods to evade EDR and AV while allowing the operator to continue using tooling and tradecraft they are familiar with. Its powered by Python 3.8 and C, and uses Donut for payload...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

sinter

Sinter Sinter est un agent de sécurité des terminaux 100 % en mode utilisateur pour macOS 10.15 et versions ultérieures, écrit en Swift. Sinter utilise l'API EndpointSecurity en mode utilisateur pour s'abonner et recevoir des rappels d'autorisation du noyau macOS, pour un ensemble de types...

CVE-2025-62314

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

CVE-2025-62314 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

CVE-2026-47133 ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store /Library/Application Support/clearancekit/store.db is verified using an ECDSA signature stored in the datasignatures table. T...

CVE-2026-50658 Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability

...

Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability

Time-of-check time-of-use toctou race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally...

9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

Summary The /api/settings/database endpoint allows full database export containing all credentials, API keys, OAuth tokens, and settings and full database import complete overwrite without any authentication requirement beyond the ALWAYSPROTECTED middleware check, which only validates JWT or CLI...