Zircolite

Repo açıklaması, sahibi tarafından yazılmıştırA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

Aktif son commit bugün

Son 52 haftanın 26 haftasında commit var

Güvenlik duyuruları

Geliştiricilerin GitHub'da yayınladığı duyurular. Yalnızca başka yerde, örneğin NVD'de bildirilen açıklar dahil değil.

GHSA-vhhg-j629-5552 Orta 3 Eki 2026
Rich markup injection from evidence content aborts a Zircolite run and spoofs console output
GHSA-9vjj-w2rg-2m48 Orta 3 Eki 2026
Split field names taken from log values overwrite event fields and row_id (detection evasion, analysis denial of service)
GHSA-f5jh-7mx7-wwrq Orta 3 Eki 2026
ZircoGui data template lets a log field override the rule title, level, file and description
GHSA-r5c4-46jg-wgjh Orta 3 Eki 2026
DOM XSS in the bundled ZircoGui (Mini-GUI) via log-controlled field names, values and titles
GHSA-42q5-fmjv-w4px Orta 3 Eki 2026
Unbounded regex backtracking in the SQLite `regexp` function lets one crafted log line stall a Zircolite run (ReDoS)
GHSA-2hq2-3w3j-6pc9 Düşük 3 Eki 2026
--generate-config follows a symlink planted at the output path (check-then-open TOCTOU)
GHSA-95jp-m2hj-j5mf Düşük 3 Eki 2026
CSV formula injection through the header row of `--csv` detection reports
GHSA-q2qh-vgfr-h3q9 Düşük 3 Eki 2026
Quadratic regex backtracking in auditd line parsing (ReDoS)
GHSA-rxv3-q96p-qqwh Düşük 3 Eki 2026
7-Zip log-type auto-detection decompresses the whole first member into memory (decompression bomb)
GHSA-f8r2-xpcw-c4gh Düşük 3 Eki 2026
Archive password can only be passed on the command line, exposing it to other local users
GHSA-m3h8-pcx6-6wqx Yüksek 3 Eki 2026
Transform sandbox escape: config-supplied transform code runs with full interpreter privileges