ColdWer

A cold war on your endpoint. 🥶 ColdWer ColdWer leverages WerFaultSecure.exe PPL bypass to freeze EDR/AV processes and dump LSASS memory on modern Windows systems. root@kitploit: C O L D W E R └─┴─┴── WerFaultSecure └─┴──────── LSASS Dump └─┴──────────── Cold Freeze Freeze your EDR/AV. Extract wha...

EDR-Freeze

EDR-Freeze 这是一个利用 WerFaultSecure 的软件漏洞来挂起 EDR 和反恶意软件进程的工具，无需使用 BYOVD（自带易受攻击驱动程序）攻击方法。 EDR-Freeze 在用户模式下运行，因此您无需安装任何额外的驱动程序。它可以在最新版本的 Windows 上运行。 实验是在项目创建时最新版本的 Windows 上进行的：Windows 11 24H2 命令行语法 EDR-Freeze.exe TargetPID SleepTime 示例：EDR-Freeze.exe 1234 10000 将目标冻结 10000 毫秒 链接 EDR-Freeze：让 EDR...

proposal-symbol-proto

原型污染缓解 / Symbol.proto 作者 ：Santiago Díaz（Google） 提案负责人 ：Shu-yu Guo（Google） 阶段 ：1 目录 问题描述 鬼魅般的超距作用 纯数据攻击 freeze、seal 和 preventExtensions 的问题 覆盖错误 粗粒度 冻结点 应用类型 建议方案 提供反射 API 选择启用特性 自动重构 删除意味着什么？ 不兼容的代码库 附录 构造函数污染呢？ 压缩 JS 中的计算访问 漏洞示例 tl;dr...

mirth-connect-security-poc

PoCs de vulnerabilidades de NextGen Connect 4.5.2 Exploits de prueba de concepto funcionales para tres vulnerabilidades alcanzables por red en NextGen Connect Mirth Connect 4.5.2. Los arneses ejecutan la imagen de contenedor oficial, crean únicamente la configuración de canal necesaria para el...

Freeze

THIS REPOSITORY HAS BEEN ARCHIVED To view the latest version of Freeze or to submit an issue, reference https://github.com/Tylous/Freeze. Freeze More Information If you want to learn more about the techniques utilized in this framework, please take a look at SourceZero Blog Description Freeze is ...

CVE-2026-26903-PoC

CVE-2026-26903 PoC Denial-of-service via unbounded recursion in TanStack Query'sreplaceEqualDeep function A single crafted query update with deeply nested objects can freeze the JavaScript thread indefinitely , causing complete application unresponsiveness. No authentication or special permission...

RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

Summary A Denial of Service DoS vulnerability exists in the AMQP client's connection negotiation logic. The AMQP specification explicitly mandates a strict minimum frame size of 4096 bytes to prevent pathological packet fragmentation. While the library defines a frameMinSize = 4096 constant, the...

GHSA-XWWF-M8FG-P9Q2 RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

Summary A Denial of Service DoS vulnerability exists in the AMQP client's connection negotiation logic. The AMQP specification explicitly mandates a strict minimum frame size of 4096 bytes to prevent pathological packet fragmentation. While the library defines a frameMinSize = 4096 constant, the...

GHSA-RW4J-R22C-9GC3 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client or SSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied value verbatim...

EUVD-2026-81093

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSHMSGCHANNELOPEN / OPENCONFIRMATION...

CVE-2026-92949

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze and vm.readonly protections. Attackers can use Object.getOwnPropertyDescriptor or lookupSetter to extract and invoke host object setters...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: virtionet: Fixed the issue with xdprxqinfo after suspend/resume. The following sequence currently causes a driver bug warning when using virtionet: bash ip link set eth0 up echo mem /sys/power/state or e.g. rtcwake -s 10 -m mem i...

Astra Linux – Vulnerability in Linux 5.10

A race condition was detected in the Linux kernel’s ebpf verifier between bpfmapupdateelem and bpfmapfreeze, due to a missing lock in the kernel/bpf/syscall.c file. In this flaw, a local user with special privileges capsysadmin or capbpf can modify the frozen mapped address space. This flaw affec...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: BPF: Avoid holding the freezemutex during the mmap operation. We use the map-freezemutex to prevent race conditions between the mapfreeze function and memory mapping operations with writable permissions. The way we currently hand...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: virtio-blk: Do not keep the queue frozen during system suspension. The commit 4ce6e2db00de “virtio-blk: Ensure no requests are in the virtqueues before deleting the vqs.” replaces “queue quiesce” with “queue freeze” in virtio-blk...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

CVE-2020-37277 PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...