Artemis

Artemis Descripción general Una herramienta para encontrar infraestructuras de APK. Presentado por: HADESS realiza servicios de ciberseguridad ofensiva a través de infraestructuras y software que incluyen análisis de vulnerabilidades, planificación de escenarios de ataque e implementación de...

GetBlocked

GetBlocked! Páginas más limpias. Menos rastreadores. Solo local. GetBlocked! es una extensión ligera y solo local para Chrome que ayuda a reducir el seguimiento común de terceros en sitios web bloqueando peticiones de rastreadores conocidos, limpiando enlaces de seguimiento y explicando los...

neto

Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...

neto

Project Neto: Un conjunto de herramientas para analizar complementos del navegador Descripción general Project Neto es un paquete de Python 3 concebido para analizar y desvelar características ocultas de complementos y extensiones del navegador para navegadores conocidos como Firefox y Chrome...

tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

truegaze

truegaze A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only...

uacscript

Vulnerabilidad de omisión de UAC en Windows Script Host Los ejecutables de Windows Script Host sufren una vulnerabilidad debido a que falta un manifiesto incrustado. Utilizando otro exploit, la combinación de los archivos "wusa.exe" y "makecab.exe" se puede copiar en la carpeta de Windows. Las...

CVE-2026-89065

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

CVE-2026-89065

projen before 0.101.37 is affected by a relative path traversal in its generated file manifest cleanup component . Crafted entries in the version-controlled file manifest, consumed during project synthesis, can cause recursive deletion of files and directories outside the project directory that a...

CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

CVE-2026-64633

CVE-2026-64633 Analysis Payloads Files payloads/ — generated payload documents treatment + control variants payloads/manifest.json — payload manifest with pids / pairs...

go-pillage-registries

go-pillage-registries Este proyecto toma un registro Docker y saquea el manifiesto y la configuración de cada imagen en su catálogo. Utiliza el paquete del comando crane de Google, que debería seguir la semántica de keychain de Docker. Si desea anular esto, simplemente cambie authn.DefaultKeychai...

Ollama - Remote Code Execution

Ollama before 0.1.34 does not validate the format of the digest sha256 with 64 hex digits when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring. id: CVE-2024-37032 info: name: Ollama ...

vex-repo-spec

Especificación del Repositorio VEX v0.1 Especificación del Repositorio VEX v0.1 1. Versionado 2. Manifiesto del Repositorio 2.1 Descripción General 2.2 Ubicación del Archivo 2.3 Esquema 2.4 Ejemplo 2.5 Descripciones de Campos y Notas de Uso Campos Principales Subcampos de versions Subcampos de...

springhound

springhound Creado tras el lanzamiento de CVE-2022-22965 y CVE-2022-22963. Script Bash que detecta ocurrencias de Spring Framework en tus proyectos y sistemas, permitiéndote obtener información sobre las versiones utilizadas. Desempaqueta JARs y analiza sus archivos Manifest. Uso: ./springhound.s...

CVE-2026-85622

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object...

CVE-2026-85622

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership in the establish_ws_connection_v2 WebSocket handler. This allows any authenticated user to bind a session to a workspace they do not belong to, then send sync Manifest messages with victim object identifiers to read full documen...

EUVD-2026-71229

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object...

CVE-2026-84810 claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan

claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...

CVE-2026-84810

claude-skill-antivirus (v2.1.3) performs a manifest-only scan of local skill directories, reading only the SKILL.md file while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills embedding malicious executable payloads in non-manifest fi...