NovaHypervisor

NovaHypervisor Descrizione NovaHypervisor è un hypervisor difensivo basato su host Intel x64. L'obiettivo di questo progetto è proteggere da attacchi a livello kernel tramite Bring Your Own Vulnerable Driver BYOVD o altri mezzi salvaguardando i prodotti di difesa Antivirus / Protezione endpoint e...

ossec-hids

OSSEC v4.3.0 Informazioni su OSSEC OSSEC è una piattaforma completa per monitorare e controllare i tuoi sistemi. Combina insieme tutti gli aspetti di HIDS host-based intrusion detection, monitoraggio dei log e SIM/SIEM in una soluzione semplice, potente e open source. Visita il nostro sito web pe...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

velociraptor

Velociraptor - Strumento di visibilità e raccolta degli endpoint. Velociraptor è uno strumento per la raccolta di informazioni sullo stato dell'host utilizzando le query del Velociraptor Query Language VQL. Per saperne di più su Velociraptor, leggi la documentazione su:...

spyre

Spyre ...un semplice scanner IOC modulare e autonomo basato su host Spyre è un semplice scanner IOC basato su host, costruito attorno al motore di pattern matching YARA e ad altri moduli di scansione. L'obiettivo principale di questo progetto è la facile messa in opera delle regole YARA e di altr...

antipwny

antipwny Autoren: Rohan Vazarkar, David Bitner Ein hostbasierter IDS/IPS, geschrieben in C und gezielt gegen Metasploit-Payloads. Anleitung AntiPwny benötigt .NET Framework 4.5, erhältlich hier. Ein Offline-Installer ist verfügbar hier http://www.microsoft.com/en-us/download/details.aspx?id=40779...

vulners-scanner

vulners-scanner Descrizione PoC di uno scanner di vulnerabilità basato su host, che utilizza l'API di vulners.com. Rileva il sistema operativo, raccoglie i pacchetti installati e verifica le vulnerabilità in essi. Sistemi operativi supportati Attualmente supporta la raccolta di pacchetti per ques...

CVE-2025-55182

CVE-2025-55182 Regole di rilevamento basate su host per la vulnerabilità RCE nel framework JavaScript React...

vulners-scanner

vulners-scanner Descrizione Proof of Concept di uno scanner di vulnerabilità basato su host, che utilizza l'API di vulners.com. Rileva il sistema operativo, raccoglie i pacchetti installati e ne controlla le vulnerabilità. Sistemi operativi supportati Attualmente supporta la raccolta di pacchetti...

EagleEye

EagleEye - hostbasiertes IDS- und Netzwerküberwachungssystem Dieses Projekt braucht noch viel Arbeit, um einsatzbereit zu sein, da es mein Abschlussprojekt ist. Es ist also nicht benutzerfreundlich, nur für erfahrene Benutzer gedacht, eine Betaversion, und ich habe es nur zu Bildungszwecken...

EUVD-2026-52445

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

OSSEC HIDS 4.2.0

OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. This is the source code release...

OSSEC HIDS 4.1.0

OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. This is the source code release...

HIDBench: Benchmarking Large Language Models for Host-Based Intrusion Detection

Recent benchmark efforts have advanced the evaluation of large language models LLMs in cybersecurity, including tasks such as penetration testing and vulnerability identification. However, a critical cybersecurity task, namely intrusion detection from system logs, remains unexplored. In this work...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssh (UTSA-2026-016492)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016492 advisory. OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted ...

util-linux: util-linux: Access control bypass due to improper hostname canonicalization

A flaw was found in util-linux. Improper hostname canonicalization in the login1 utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAMRHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing...

EUVD-2026-18817

A flaw was found in util-linux. Improper hostname canonicalization in the login1 utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAMRHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing...

CVE-2026-3184

A flaw was found in util-linux. Improper hostname canonicalization in the login1 utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAMRHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing...

CVE-2026-3184

Affects util-linux, specifically the login(1) utility when invoked with -h. The root cause is improper hostname canonicalization, which can modify the supplied remote hostname before setting PAM_RHOST. This weakness can bypass host-based PAM access control rules that rely on fully qualified domai...

CVE-2026-3184 Util-linux: util-linux: access control bypass due to improper hostname canonicalization

A flaw was found in util-linux. Improper hostname canonicalization in the login1 utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAMRHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing...