TripleCross

TripleCross TripleCross — это руткит для Linux на основе eBPF, демонстрирующий наступательные возможности технологии eBPF. TripleCross вдохновлён предыдущими разработками в этой области, в частности работами Джеффа Дилео на DEFCON 271, Пэта Хогана на DEFCON 292, Гийома Фурнье и Сильвена Афшена...

CVE-2026-42228

GHSA-f77h-j2v7-g6mw — n8n 인증되지 않은 채팅 실행 하이재킹 CVE: CVE-2026-42228 심각도: 높음 영향 버전: n8n 1.123.32 수정 버전: n8n 1.123.32 / 2.17.4 / 2.18.1 취약점 요약 chat-service.ts :: startSession은 WebSocket 쿼리 문자열에서 executionId를 수락하고 해당 실행이 데이터베이스에 존재하는지만 확인합니다. 호출자가 해당 실행에 접근할 권한이 있는지는 절대 검증하지 않습니다. waiting 상태의 실행에 대한 유효...

CVE-2026-2450: .NET Misconfiguration: Use of Impersonation

.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0...

CVE-2026-30856

WeKnora CVE-2026-30856: Pre-0.3.0 versions are vulnerable to a tool-name collision and indirect prompt injection via an MCP client naming convention (mcp_{service}_{tool}), allowing a remote MCP server to hijack tool execution and potentially exfiltrate prompts/context or run other tools with use...

CVE-2026-30856 WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming...

CVE-2026-30856: Use of Incorrectly-Resolved Name or Reference

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming...

WeKnora 安全漏洞

WeKnora is an open-source framework based on LLM developed by Tencent. It features deep document understanding using the RAG paradigm, semantic retrieval, and context-aware answers. Prior to version 0.3.0, WeKnora had security vulnerabilities. These vulnerabilities were caused by tool name...

EUVD-2017-7292

Malware in sbrugna...

From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents

The growing adoption of large language models LLMs has led to a new paradigm in mobile computing--LLM-powered mobile AI agents--capable of decomposing and automating complex tasks directly on smartphones. However, the security implications of these agents remain largely unexplored. In this paper,...

New PoolParty Process Injection Techniques Outsmart Top EDR Solutions

A new collection of eight process injection techniques, collectively dubbed PoolParty, could be exploited to achieve code execution in Windows systems while evading endpoint detection and response EDR systems. SafeBreach researcher Alon Leviev said the methods are "capable of working across all...

PT-2023-18897 · Ciq Api · Ciq Api

Name of the Vulnerable Software and Affected Versions: CIQ API versions 1.2.0 through 4.1.7 Description: The Toybox.GenericChannel.setDeviceConfig API method does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call t...

TripleCross - A Linux eBPF Rootkit With A Backdoor, C2, Library Injection, Execution Hijacking, Persistence And Stealth Capabilities.

TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology. TripleCross is inspired by previous implant designs in this area, notably the works of Jeff Dileo at DEFCON 271, Pat Hogan at DEFCON 292, Guillaume Fournier and Sylvain Afchain also at DEFCON...

TripleCross 安全漏洞

TripleCross is a Linux eBPF rootkit with backdoor, C2, library injection, execution hijacking, persistence, and steganography from the individual developer Marcos Bajo in Spain. A security vulnerability exists in TripleCross version v0.1.0, which stems from a segmentation fault that occurs when...

ThreadBoat - Program Uses Thread Execution Hijacking To Inject Native Shell-code Into A Standard Win32 Application

Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. About I developed this small project to continue my experiences of different code injection methods and to allow RedTeam security professionals to utilize this method as a unique way to perform software...

Q&A: Insights from the Red Canary 2020 Threat Detection Report

In light of the latest update to the MITRE ATT&CK framework, Red Canary has developed a Threat Detection Report uncovering the top techniques attackers use to target your organization. To understand the significance of the report, we turned to two of VMware Carbon Black’s top threat experts, Greg...

Design/Logic Flaw

Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileges via vectors involving "image path execution hijacking."...

CVE-2017-15870

Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileges via vectors involving "image path execution hijacking."...

CVE-2017-15870

CVE-2017-15870 affects Palo Alto Networks GlobalProtect Client/App on macOS up to version 4.0.2 (before 4.0.3). The vulnerability is a local privilege escalation via an image path execution hijacking vector. Exploitation requires local administrative privileges on the compromised host and can gra...

CVE-2017-15870

Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileges via vectors involving "image path execution hijacking."...

CVE-2017-15870: Undefined Security Weakness

Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileges via vectors involving "image path execution hijacking."...