autotimeliner

AutoTimeliner 揮発性メモリダンプからフォレンジックタイムラインを自動的に抽出します。 AutoTimeliner は、Windows、Linux、macOS のメモリイメージに対して複数の Volatility3 プラグインを実行し、その出力を単一のソートされた CSV タイムラインにマージします。 汎用タイムラインプラグイン プラグイン| 取得内容 ---|--- timeliner| クロスプラグインのタイムスタンプイベント（サポートされている場合、すべてのOSファミリ） Windows プラグインセット プラグイン| 取得内容 ---|--- timeliner|...

CVE-2023-32784-EXPLOIT-REPORT

CVE-2023-32784 漏洞利用演示 项目概述 本仓库演示了 CVE-2023-32784，这是 KeePass 2.54 之前版本中存在的一个严重漏洞。该漏洞可通过内存转储恢复主密码，从而暴露存储的凭据。本文档逐步说明了如何搭建漏洞利用环境、执行 PoC 工具以及理解缓解策略。 漏洞详情 描述 CVE-2023-32784 是 KeePass 2.0 至 2.53 版本中存在的一个内存泄漏漏洞，源于 KeePass 的 Secure Textbox EX 组件对字符串处理不当。主密码中输入的每个字符都会在内存中留下痕迹，从而可通过内存转储恢复密码。 主要特征： 严重性：高...

Vol3xp

Vol3xp、Volatility 3 エクスプローラ プラグイン WinObj - Windowsカーネルオブジェクトエクスプローラ、https://github.com/kslgroup/WinObj の改良版 volatility 3用、winobj.py WinObj（WinObj sysinternals と非常に類似）は、Struct Analyzer と VolExp の WinObjGui もサポートします。 RAMMap - 物理アドレスマッピング pfn.py RAMMap（Rammap SysInternals...

ShellCodeEmulator

ユニコーンフレームワーク（unicorn framework）に基づくWindowsシェルコードエミュレーションツール ShellcodeEmulatorは、windbgプロセスメモリダンプを利用してWindowsシェルコードをエミュレートします。任意のWindowsプロセスダンプイメージを使用して、解析するシェルコードを提供できます。このツールは、シェルコードのバイトと提供されたダンプイメージを使用して、ユーザーランドコードを可能な限りエミュレートします。...

rip_raw

Rip Raw Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile. This ...

rip_raw

Rip Raw Rip Rawは、侵害されたLinuxシステムのメモリを分析するための小さなツールです。目的はBulk Extractorと似ていますが、特にLinuxシステムのメモリダンプからシステムログを抽出することに重点を置いています。これにより、プロファイルを生成することなくシステムを分析できます。 これは、プロファイルを使用してより構造化されたメモリ分析を実行するRekallやVolatilityなどのツールの代替にはなりません。 Rip Rawは、メモリダンプなどのRaw Binaryを取得し、以下を使用してファイルとログをカービングします。 テキスト/バイナリの境界...

Rockwell Automation ControlLogix Ethernet Modules Insecure Default Initialization of Resource (CVE-2025-7353)

The affected ControlLogix Ethernet modules ship with a web-based debugger WDB agent enabled by default. A remote attacker who can reach the module using a specific IP address can connect to the WDB agent and perform memory dumps, modify memory, and control the execution flow of the module. This...

Security Bulletin: Security Vulnerability in the IBM Java Runtime Environment (JRE) affect the 3592 Enterprise Tape Controller

Summary Vulnerabilities in in the IBM Java Runtime Environment JRE , affect the 3592 Enterprise Tape Controller. These vulnerabilities were disclosed in the Java Critical Patch Updates for July and October 2015 Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified vulnerability a...

hdd-toolkit

HDD Firmware Toolkit A comprehensive Python toolkit for dumpi...

CVE-2026-33448

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump the contents of a small portion of memory to the log files potentially revealing secrets...

CVE-2026-33448

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump the contents of a small portion of memory to the log files potentially revealing secrets...

CVE-2026-33448 Format string vulnerability in MacOS clients prior to 14.50

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump the contents of a small portion of memory to the log files potentially revealing secrets...

CVE-2026-24319

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue results in a high...

CVE-2026-24319

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue results in a high...

SAP Business One 安全漏洞

SAP Business One is a business management software developed by the German company SAP. This software includes functions such as financial management, operational management, and human resource management. There is a security vulnerability in SAP Business One, which stems from sensitive informati...

PT-2026-7218

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue results in a high...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in SQL Server A malicious party can exploit the vulnerability to gain unauthorized access to DEBUG functionality and thereby generate, among other things, memory dumps. These dumps can also involve memory outside the scope of SQL Server, allowing the malicious...

CVE-2025-66910

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login,...

PT-2025-52456

Name of the Vulnerable Software and Affected Versions Turms Server versions prior to 0.10.0-SNAPSHOT Description The software stores administrator passwords in plaintext within memory, specifically in the rawPassword field of AdminInfo objects, to improve authentication speed. This bypasses the...

EUVD-2025-204537

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login,...