zyrox

Zyrox LLVM Obfuscator plugin di compilazione e link-time di llvm per offuscare codice nativo Perché perché no ¯\ツ/¯ Uno dei miei progetti più grandi, in cui ho imparato molto sugli internals di LLVM, formati binari, assembly e tecniche di offuscamento. Credo che imparare costruendo sia il modo...

obfuscation_detection

Obfuscation Detection v2.4 Autor: Tim Blazytko Erkennen Sie automatisch verschleierten Code und andere interessante Codekonstrukte Beschreibung: Obfuscation Detection ist ein Binary-Ninja-Plugin zur Erkennung von verschleiertem Code und interessanten Codekonstrukten z. B. Zustandsautomaten in...

binprotect

Bauanweisungen Siehe 4. Bauen für Bauanweisungen. Inhalt 1. Einleitung 2. Binär-Rewriter 2.1. Relative Adressverfolgung 2.2. Disassemblierung 2.2.1. Basisblock-Aufteilung 2.2.2. Indirekter Kontrollfluss 2.2.2.1. Sprungtabellen 2.2.2.1.1. Begrenzte Sprungtabellen 2.2.2.1.2. Unbegrenzte...

Alcatraz

Alcatraz Alcatraz è un offuscatore binario x64 in grado di offuscare vari file PE, inclusi: .exe .dll .sys Panoramica Alcatraz Requisiti Utilizzo Funzionalità Offuscamento dei movimenti immediati Appiattimento del flusso di controllo Mutazione ADD Offuscamento del punto di ingresso Offuscamento L...

obfuscation_detection

Obfuscation Detection v2.4 Author: Tim Blazytko Automatically detect obfuscated code and other interesting code constructs Description: Obfuscation Detection is a Binary Ninja plugin to detect obfuscated code and interesting code constructs e.g., state machines in binaries. Given a binary, the...

CVE-2026-54284

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

PT-2026-76749

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group parenthesis and group case, causing quadratic CPU consumption through sqlparse.parse,...

EEF-CVE-2026-68750 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Summary Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html\sanitize\ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2...

Improper Handling of Exceptional Conditions

Overview valibot is a The modular and type safe schema library for validating structural data Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions in the flatten process. An attacker can cause the application to throw a TypeError and disrupt normal error...

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

Summary Issue 1: EXIF orientation not normalized → The image orientation processed by the model differs from how humans view it, introducing interpretation bias. Issue 2: PNG tRNS not explicitly flattened before converting to RGB → After conversion, transparent/semi-transparent pixels are rendere...

Astra Linux – Vulnerability in SQLite3

In SQLite before version 3.32.3, select.c improperly handled the query-flattener optimization, resulting in a multiSelectOrderBy heap overflow due to the misuse of transitive properties for constant propagation...

LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

Summary LiquidJS's memoryLimit security mechanism can be completely bypassed by using reverse range expressions e.g., 100000000..1, allowing an attacker to allocate unlimited memory. Combined with a string flattening operation e.g., replace filter, this causes a V8 Fatal error that crashes the...

PT-2026-28162

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.25.1 Description LiquidJS’s memoryLimit security feature can be bypassed using reverse range expressions e.g., 100000000..1, allowing an attacker to allocate unlimited memory. When combined with a string flattenin...

GHSA-RCMH-QJQH-P98V Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

Summary A DoS can occur that immediately halts the system due to the use of an unsafe function. Details According to RFC 5322, nested group structures a group inside another group are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested...

EUVD-2022-1054

Malicious code in bioql PyPI...

"Digital Camouflage": the LLVM Challenge in LLM-Based Malware Detection

Large Language Models LLMs have emerged as promising tools for malware detection by analyzing code semantics, identifying vulnerabilities, and adapting to evolving threats. However, their reliability under adversarial compiler-level obfuscation is yet to be discovered. In this study, we empirical...

CVE-2024-52276

User Interface UI Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer flattened version, which is provided when the "Print" option is used. 2. Displayed version does not show the layer flattened version, which...

VulnCheck KEV: CVE-2024-52271

User Interface UI Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed e.g. via Google Chrome - Examine the print preview: Will render the vulnerability only, not...

SUSE CVE-2020-15358

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation...

SUSE CVE-2022-23632

Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security TLS configuration when the host header is a fully qualified domain name FQDN. For a request, the TLS configuration choice can be different than the router choice, which...