noir

코드 속 모든 엔드포인트를 추적하고, 섀도우 API를 발굴하며, 공격 표면을 매핑하세요. 문서 • 설치 • 사용법 • 기여하기 • 변경 로그 Noir는 소스 코드를 읽고 애플리케이션이 노출하는 엔드포인트경로, 메서드, 파라미터, 헤더, 쿠키 및 그 뒤에 있는 소스 파일를 추출하는 SAST 도구입니다. 섀도우 API, 더 이상 사용되지 않는 라우트, 문서화되지 않은 핸들러도 동일한 인벤토리의 일부로 추출됩니다. 별도의 모드가 필요하지 않습니다. 인벤토리는 세 가지 대상에 제공됩니다. 인간 리뷰어. 보안 엔지니어와 코드 감사자는 ...

alibi

alibi 攻撃サーフェスのビューを相互照合し、互いを裏付けられないエンドポイントを見つけ出します。 エンドポイントはそれ自体を説明できるべきです。コードにあるなら、契約がそれを記述しているはずです。契約にあるなら、何かがそれを実装しているはずです。実際のトラフィックを受けているなら、どこかに存在しているはずです。あるビューがエンドポイントを認識しているのに、他のビューが認識していないとき、そのギャップが発見です。 alibi は OWASP noir を実行し、その JSON を読み、ビュー同士を比較します。 これが別のツールである理由 Noir はすでに同じサーフェスに対する 5...

o1js-scan

o1js-scan Community package: o1js-scan is listed in the official o1js Community Packages directory. Latest: 0.20.0 — the analyzer now reads contracts that extends TokenContract. Until this release the contract gate matched SmartContract alone, so every fungible token, NFT collection and AMM pool ...

noir v1.3.1

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface. Documentation • Installation • Usage • Contributing • Changelog Noir is a SAST tool that reads source code and extracts the endpoints an application exposes — paths, methods, parameters, headers, cookies, and the source...

CVE-2026-41197

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA...

CVE-2026-41197

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA...

CVE-2026-41197

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA...

CVE-2026-41197 Brillig: Heap corruption in foreign call results with nested tuple arrays

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA...

CVE-2026-41197

CVE-2026-41197 concerns Brillig/Noir: a bug in allocate_foreign_call_result_array when handling nested arrays (e.g., [(u32,u32);3]) during foreign calls. The code discards inner element types and uses the semantic length of the nested array, yielding under-allocation of semi-flattened size for co...

Noir 安全漏洞

Noir is an open-source domain-specific language developed by noir-lang, used for SNARK proofs. Versions of Noir prior to 1.0.0-beta.19 contained a security vulnerability, caused by a nested array memory allocation error, which could lead to damage to the Brillig VM heap...

CVE-2026-41197: Incorrect Calculation of Buffer Size

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA...

GHSA-JJ7C-X25R-R8R3 Brillig: Heap corruption in foreign call results with nested tuple arrays

Description Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compileblock. When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes...

Malicious code in kestrel_h4008_qgrcu_noir (npm)

The package kestrelh4008qgrcunoir was found to contain malicious code...

Malicious code in noir_wy1pj_4hzbb_night (npm)

The package noirwy1pj4hzbbnight was found to contain malicious code...

en-noir-et-blanc.com XSS vulnerability

Open Bug Bounty ID: OBB-715745 Description| Value ---|--- Affected Website:| en-noir-et-blanc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

pabo.be XSS vulnerability

Open Bug Bounty ID: OBB-673818 Description| Value ---|--- Affected Website:| pabo.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CM Browser SOP Bypass

Vulnerability: CM Browser Same Origin Policy Bypass Impact: High/Critical Authors: Rafay Baloch Company: RHAinfoSEC Website: http://rhainfosec.com & http://rafayhackingarticles.net Introduction Same Origin Policy SOP is one of the most important security mechanisms that are applied in modern...

PHP Director 0.2 - SQL Injection

No description provided by source. Exploit Title: PHP Director 0.2 Sql Injection. Date: 05/06/2010 Author: Mr.Rat [email protected] Software Link: www.phpdirector.co.uk Version: 0.2 Tested on: Windows Xp SP2 Code :...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter to 1 Vert/index.php, 2 Noir/index.php, and 3 Bleu/index.php in template/, different vectors than CVE-2008-0645...

CVE-2007-1957

Multiple PHP remote file inclusion vulnerabilities in Guernion Sylvain Portail Web Php aka Gsylvain35 Portail Web, PwP allow remote attackers to execute arbitrary PHP code via a URL in the pageAll parameter to index.php in 1 template/Vert/, or 2 template/Noir/...