Vidar-Stealer-Reverse-Engineering

Análisis de Ingeniería Inversa de Vidar Stealer 2.0 Resumen Este análisis cubre una ingeniería inversa en profundidad de Vidar Stealer 2.0 , un sofisticado ladrón de información que utiliza técnicas avanzadas de evasión para pasar desapercibido. Los hallazgos clave incluyen: Manipulación del...

MAL-2026-17565 Malicious code in typesens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738 package.json declares postinstall wscript.exe 4444.vbs, which runs automatically on npm install. The shipped 4444.vbs 765 KB contains a multi-layer...

Malicious code in typesens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738 package.json declares postinstall wscript.exe 4444.vbs, which runs automatically on npm install. The shipped 4444.vbs 765 KB contains a multi-layer...

super-trouper

Super Trouper Un servidor MCP para el kit de herramientas de ingeniería inversa Frida. Super Trouper ejecuta un servidor MCP sobre STDIO que expone las capacidades de Frida como herramientas para agentes de programación. Puede conectarse a dispositivos locales, USB y remotos; inspeccionar...

CVE-2021-44909

CVE-2021-44909 Título del Exploit: orangescrum 1.8.0 - Ejecución Remota de Comandos RCE no autenticado Fecha: 03/12/2021 Página del proveedor: https://www.orangescrum.org/ Enlace del software: https://github.com/Orangescrum/orangescrum Versión: 1.8.0 Probado en: Windows 10 x64 usando XAMPP 7.4.23...

CVE-2017-11610

CVE-2017-11610 Shell inverso no autenticado RCE para Supervisor 3.0a1 - 3.3.2 Exploit independiente Python ≥3.6 de RCE no autenticado para Supervisor 3.0a1 a 3.3.2, reescrito a partir de este módulo de Metasploit. Artículo explicativo aquí. Probado con Python 3.7 en este objetivo ejecutando...

PT-2026-106239

Name of the Vulnerable Software and Affected Versions Camunda versions 7.24.0 through 7.24.14 Description An incorrect authorization issue exists in the Admin web application's first-run setup endpoint. The SetupResource incorrectly determines if the setup process is available by counting only...

CVE-2026-49933: Access of Uninitialized Pointer

In handlelemonitordeviceevent of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2026-106228

Name of the Vulnerable Software and Affected Versions Newell Brands DYMO ID versions prior to 1.6.0 Description The software resolves its plugin Modules directory relative to the process working directory. This allows an attacker to store a job file alongside malicious modules or DLLs. When a...

PT-2026-106149

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth affected versions not specified Description An uninitialized pointer dereference in the handle le monitor device event function within msft.cc allows for a control-flow hijack in the privileged bluetooth process. This issue...

The vulnerability of the software platform for conducting marketing campaigns in Adobe Campaign Classic lies in the authentication procedures’ deficiencies, which allow a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2026-106225

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

Cisco ASA Command Injection (CVE-2021-1488)

A vulnerability in the upgrade process of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying operating system OS. This...

Malicious code in lite-matte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7b0ae9e42c334c1c22627e60add7a2c5a0d558a2ab65a3af0043e27bb0e686 package.json declares "postinstall": "wscript.exe 4444.vbs", causing npm install to auto-execute a 765KB Windows Script Host file shipped in the...

MAL-2026-17512 Malicious code in lite-matte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7b0ae9e42c334c1c22627e60add7a2c5a0d558a2ab65a3af0043e27bb0e686 package.json declares "postinstall": "wscript.exe 4444.vbs", causing npm install to auto-execute a 765KB Windows Script Host file shipped in the...

MAL-2026-17511 Malicious code in lite-mater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 532663c4102d3cf7310e29ca1eb2b389c5c32c1e541da219b7c4364968f4e807 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs automatically on npm install on Windows hosts. The shipped 4444.vbs...

MAL-2026-17523 Malicious code in studiocode_tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 261d413c0847b530c9a452c209c25e0a7d9123f9b0f20b26d0afcc41a929c74a package.json declares a postinstall hook that runs wscript.exe 4444.vbs, auto-executing on npm install on Windows. The shipped 4444.vbs contains...

Malicious code in studiocode_tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 261d413c0847b530c9a452c209c25e0a7d9123f9b0f20b26d0afcc41a929c74a package.json declares a postinstall hook that runs wscript.exe 4444.vbs, auto-executing on npm install on Windows. The shipped 4444.vbs contains...

Malicious code in core-js-gnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937 On install, package.json runs node init.js as a postinstall hook. init.js collects host identifiers os.hostname, os.userInfo.username, os.platform,...

CVE-2024-41453_CVE-2024-41454

CVE-2024-41453 CVE-2024-41454 ProcessMaker Vulnerabilidades solo para educación: @ryancooley @velkymx @nolanpro @caleeli instala ProcessMaker 4 Core Docker Instance desde este repositorio: https://github.com/ProcessMaker/pm4core-docker esta es la última versión de pm docker PMVERSION=4.1.21, la...