Malicious code in tx-broadcast-utils (RubyGems)

RubyGems runs this gem's native extension script ext/tx-broadcast-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17612 Malicious code in tx-broadcast-utils (RubyGems)

RubyGems runs this gem's native extension script ext/tx-broadcast-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

CVE-2026-104809

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

SUSE-SU-2026:4442-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055. - CVE-2026-88816: numeric value incorrectly treated as strings in FetchHashKeyName allows for process crash bsc1283056...

Security update for perl-DBI

This update for perl-DBI fixes the following issues: CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055. CVE-2026-88816: numeric value incorrectly treated as strings in FetchHashKeyName allows for process crash bsc1283056. Patch...

Malicious code in ethereum-tx-helper (RubyGems)

RubyGems runs this gem's native extension script ext/ethereum-tx-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

CVE-2025-41244

💻 逐步技术流程 编译程序 bash Compile the C code into an executable gcc -o /tmp/httpd /tmp/CVE-2025-41244.c Make it executable chmod +x /tmp/httpd 测试版本功能 bash Test the -v flag should print version and exit /tmp/httpd -v Test the -V flag should print detailed version and exit /tmp/httpd -V 步骤 4：运行漏洞利用代码 bash...

StealC-Stealer-RuntimeBroker-Hollowing-C2-Extraction-Payload-Extraction-Analysis

1. RuntimeBroker.exe Hollowing & C2 IP Addresses Process Hacker memory analysis reveals that StealC Stealer performs process hollowing on RuntimeBroker.exe and establishes connections to multiple C2 servers. Key Observations: Target Process: RuntimeBroker.exe PID 14900. C2 IP Addresses:...

Vidar-Stealer-Reverse-Engineering

Vidar Stealer 2.0 리버스 엔지니어링 분석 개요 이 분석은 탐지를 피하기 위해 고급 회피 기술을 사용하는 정교한 정보 탈취기인 Vidar Stealer 2.0 에 대한 심층적인 리버스 엔지니어링을 다룹니다. 주요 발견 사항은 다음과 같습니다: 작업 스케줄러 변조: 포렌식 분석을 회피하기 위해 시스템 작업 타임스탬프를 1999로 수정합니다. Explorer.exe 프로세스 할로잉: 합법적인 Windows Explorer 프로세스에 셸코드를 주입합니다. Microsoft Copilot 인젝션: 은밀한 실행을 위해 새로...

Malicious code in typesens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738 package.json declares postinstall wscript.exe 4444.vbs, which runs automatically on npm install. The shipped 4444.vbs 765 KB contains a multi-layer...

MAL-2026-17565 Malicious code in typesens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738 package.json declares postinstall wscript.exe 4444.vbs, which runs automatically on npm install. The shipped 4444.vbs 765 KB contains a multi-layer...

super-trouper

Super Trouper Fridaリバースエンジニアリングツールキット用のMCPサーバーです。 Super Trouper は、STDIO上でMCPサーバーを実行し、Fridaの機能をコーディングエージェント向けのツールとして公開します。ローカル、USB、リモートデバイスに接続でき、アプリケーションやプロセスの検査、プロセスセッションの管理、JavaScriptインストルメンテーションスクリプトの読み込み・評価・メッセージ交換が可能です。また、Frida...

CVE-2021-44909

CVE-2021-44909 漏洞利用标题：orangescrum 1.8.0 - 远程命令执行 RCE（未认证） 日期：2021年12月3日 厂商主页：https://www.orangescrum.org/ 软件链接：https://github.com/Orangescrum/orangescrum 版本：1.8.0 测试环境：Windows 10 x64，使用 XAMPP 7.4.23，Apache/2.4.48 Win64 OpenSSL/1.1.1l PHP/7.4.2 漏洞利用步骤： 1. 打开...

CVE-2017-11610

CVE-2017-11610 Supervisor 3.0a1～3.3.2 向け 未認証リバースシェルRCE Python 3.6以上用のスタンドアロン未認証RCEエクスプロイト。対象はSupervisor 3.0a1～3.3.2。この Metasploitモジュール から書き直したものです。解説 記事はこちら。 Python 3.7で、Supervisor 3.3.2が動作する このターゲット でテスト済み。 使い方: root@Kali:/Infosec/RubyStuff/Supervisor-3.3.2 ./exploit.py -h usage: exploit.py -h...

The vulnerability of the software platform for conducting marketing campaigns in Adobe Campaign Classic lies in the authentication procedures’ deficiencies, which allow a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2026-106239

Name of the Vulnerable Software and Affected Versions Camunda versions 7.24.0 through 7.24.14 Description An incorrect authorization issue exists in the Admin web application's first-run setup endpoint. The SetupResource incorrectly determines if the setup process is available by counting only...

PT-2026-106149

In handle le monitor device event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed fo...

PT-2026-106228

Name of the Vulnerable Software and Affected Versions Newell Brands DYMO ID versions prior to 1.6.0 Description The software resolves its plugin Modules directory relative to the process working directory. This allows an attacker to store a job file alongside malicious modules or DLLs. When a...