Cybersecurity information flow

The pattern matching swiss knife

"凌武杯" D^3CTF 2024 wp

该漏洞是HTTP/HTTPS代理工具中一个未修补的重要安全漏洞，被追踪为 CVE-2023-49606，CVSS 得分 9.8。

数据分类分级，本质上代表的是数据识别的能力，企业需要具备。

月海 (Sea Moon) 是一款 FaaS/BaaS 实现的 Serverless 网络工具

全球 600 多家顶级厂商展示了各自在网络安全技术方面的最新创新，预计参会人数继续破万。

Collection of community-driven CodeQL query, library and extension packs

新手小白在FreeBuf的第一篇文章，喷的时候轻点哈，作为小白，这个洞有很大的运气加成的。

一个在java中ssrf绕过的小trick！

Recently, many Microsoft employees taking training courses have reported problems accessing documents linked to in those courses in Chrome and Edge. In Edge, the screen looks like this: But the problem isn’t limited to Microsoft’s internal training platform, and can be easily reproduced in Chrome: What’s going on? There are a number of root causesContinue reading "ERR_BLOCKED_BY_CLIENT and HTML5 Sandbox"

" 最近，许多参加微软培训课程的员工报告称，在Chrome和Edge浏览器中无法访问与这些课程相关的文档。在Edge中，屏幕显示如下：但这个问题并不仅限于微软的内部培训平台，在Chrome中也可以轻松重现：究竟是怎么回事？有几个根本原因……\n\nERR_BLOCKED_BY_CLIENT 和 HTML5 沙箱\n\n……\n\n经过分析，问题主要源于微软的内部培训平台使用了一种名为“HTML5沙箱”的技术。这种技术旨在保护用户免受恶意网站的侵害，但在此情况下，它却阻止了用户正常访问培训课程的相关文档。\n\n为了解决这个问题，您可以尝试以下方法：\n\n1. 检查您的网络设置，确保允许访问受限制的网站。\n2. 如果您使用的是企业网络，请联系您的网络管理员，了解是否可以调整安全策略。\n3. 尝试使用其他浏览器（如Firefox）访问受影响的文档，看是否能正常显示。\n4. 如果您仍然遇到问题，请考虑与微软支持团队联系，以获取更多帮助。\n\n此外，我们建议微软考虑调整内部培训平台的相关设置，以便在保护用户安全的同时，不影响正常的学习进程。我们希望这个问题能够尽快得到解决，让广大员工能够顺利进行培训课程。"

为了治理DNS顽疾，微软推出了一套安全DNS框架。零信任DNS企业可在Windows网络内部锁定域名解析。

kkFileView任意文件上传

DnsClientX is an async C# library for DNS over UDP, TCP, HTTPS (DoH), and TLS (DoT). It also has a PowerShell module that can be used to query DNS …

C++ rewrite of PPPwn

Multi-client network fileserver with integrated shell functionality, crafted in C using system calls for efficient and direct file and command proc…

DnsClientX is an async C# library for DNS over UDP, TCP, HTTPS (DoH), and TLS (DoT). It also has a PowerShell module that can be used to query DNS …

随着人工智能应用的持续深入和普及，我们有必要考虑它对各种团队的影响。这些团队会遇到哪些挑战和风险，人工智能如何帮助解决这些领域的问题？

发布时间:2024-05-02 演讲时间:0000-00-00 12:00am 演讲时长:40-Minute
Tags:['Exploit Development & Vulnerability Discovery', 'Application Security: Offense'] 无附件
Instant messaging application (such as iMessage and WhatsApp) is an important remote attack surface for smartphones, often used by spyware as the first step in APT attacks, and has received great attention in the past.<br><br>Carrier Based video calling, as a native video calling feature of mobile phones, is also a major remote attack surface for smartphones.<br><br>We have discovered fatal 0-day vulnerabilities in some native Carrier Based video calling of mobile phones, which have been present for at least 7 years. As long as the target accepts our video call invitation, we can exploit these vulnerabilities to remotely obtain code execution permissions for the target phone's system. <br><br>In this session, we will introduce this remote attack surface we have discovered and provide a few examples to illustrate the potential issues and impacts that may arise withi

发布时间:2024-05-02 演讲时间:0000-00-00 12:00am 演讲时长:40-Minute
Tags:['Mobile', 'Exploit Development & Vulnerability Discovery'] 无附件
<div><span>During our previous research on Android File-Based encryption, we studied the boot chain of some Samsung devices based on Mediatek system on chips. Our objective was to exploit a known boot ROM vulnerability to bypass the secure boot and ultimately retrieve the required ingredients to brute force the user credentials. Once we became familiar with this boot chain, we decided to take a closer look at a component coming later in the process: the Little Kernel bootloader (LK, also called BL3-3).</span></div><div><span><br></span></div><div><span>We begin our bug-hunting journey in LK from a jpeg parser that was introduced by the vendor. Then we will show how, thanks to reverse engineering and fuzzing, we discovered two vulnerabilities leading to code execution in the context of the bootloader, and how they can be used to bypass the secure boot and take full control over the Androi

Entra to on-prem (@_dirkjan), new bloodhound edges (@Jonas_B_K ), Chrome type confusion (@_manfp), GitHub RCE via actions (@Creastery), and more!

" 欢迎来到本次议题：入驻本地服务器 (@_dirkjan)，新成员血猎犬边缘 (@Jonas_B_K)，Chrome 类型混淆 (@_manfp)，GitHub 通过行动进行远程代码执行 (@Creastery)，以及更多精彩内容！"

Topic: Live2D Cubism Heap Corruption Risk: High Text:Live2D Cubism is the dominant "vtuber" software suite for 2D avatars for use in livestreaming and integrating them in other sof...

" 主题：Live2D Cubism堆损坏风险：高\n\n文本：Live2D Cubism是一款占据主导地位的“虚拟主播”软件套件，适用于2D虚拟主播在直播场景中的使用，以及将它们整合到其他软件中。由于其在直播行业的普及，潜在的堆损坏风险也相应提高。在使用Live2D Cubism时，请务必注意规避风险，确保直播过程稳定和安全。"

Topic: Docker Privileged Container Kernel Escape Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

" 主题：Docker 权限容器内核逃逸风险：高\n\n文本：## # 此模块需要 Metasploit：https://metasploit.com/download\n# 当前来源：https://github.com/rapid7/metasploit-framework\n\nDocker 权限容器内核逃逸是一种高度风险的安全漏洞，攻击者可以通过该漏洞获取操作系统的最高权限。在使用 Docker 容器时，务必确保容器内的应用程序不需要特权，以避免潜在的安全风险。以下是关于 Docker 权限容器内核逃逸风险的详细信息：\n\n1. 概述：Docker 容器允许用户在其内部运行特权应用程序，从而使容器变得更有攻击性。攻击者可能会利用这些特权应用程序逃逸容器内核，从而获得操作系统的最高权限。\n\n2. 风险评估：Docker 权限容器内核逃逸风险极高。如果攻击者成功逃逸，他们将能够控制系统，窃取敏感数据，执行恶意代码，甚至阻止系统访问。\n\n3. 防范措施：\n\n   - 确保特权应用程序必要：仅在绝对必要时，才在容器内运行特权应用程序。对于非特权应用程序，避免使用 Docker 容器。\n\n   - 限制特权：使用 Docker 命令行选项或 Dockerfile 限制容器内的特权。例如，使用 `--cap-add` 命令添加能力，或使用 `RUN` 指令在容器启动时删除不必要的能力。\n\n   - 更新和监控：定期更新 Docker 容器和基础操作系统，以确保已应用最新安全补丁。监控容器内的活动，以尽早发现异常行为。\n\n   - 配置防火墙：使用防火墙限制容器对外部网络的访问，以降低攻击风险。\n\n   - 严格控制网络访问：限制容器对宿主系统的网络访问，确保攻击者无法通过容器入侵宿主系统。\n\n4. 总结：Docker 权限容器内核逃逸风险严重，企业和个人用户应采取相应措施确保安全。在使用 Docker

Topic: Kobiz Design - Sql Injection Risk: Medium Text:********************************************************* #Exploit Title: Kobiz Design - Sql Injection #Date: 2024-05-05 #Ex...

Topic: Systemd Insecure PTY Handling Risk: Medium Text:Systemd Insecure PTY Handling Vulnerability = CVSSv3.BaseScore: 5.8 CVSSv3.Vector: AV:L/AC:H/PR:H/UI:R/S:C/C:H...

" 主题：系统的不安全PTY处理风险：中等\n文本：系统的不安全PTY处理漏洞 = CVSSv3.BaseScore：5.8 CVSSv3.Vector：AV：L/AC：H/PR：H/UI：R/S：C/C：H...\n\n翻译：\n主题：系统的不安全PTY处理漏洞\n风险：中等\n文本：系统的不安全PTY处理漏洞（CVSSv3.BaseScore：5.8，CVSSv3.Vector：AV：L/AC：H/PR：H/UI：R/S：C/C：H）"

[GitHub]LINKSYS AC1900 EA7500v3 IGD UPnP Stack Buffer Overflow Remote Code Execution Vulnerability

" [GitHub] LINKSYS AC1900 EA7500v3 IGD UPnP Stack Buffer Overflow 远程代码执行漏洞"

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
[GitHub]Fix open source package uses tough-cookie 2.5.0 - CVE-2023-26136,

" 版本在4.1.3之前的tough-cookie软件包容易受到原型污染漏洞，原因是在使用CookieJar时，rejectPublicSuffixes=false模式下对Cookie处理不当。此问题源于对象初始化的方式。\n[GitHub]修复开源软件包中使用的tough-cookie 2.5.0 - CVE-2023-26136，"

影响厂商:IBM 奖励: 危险等级:medium
" 跨站脚本攻击（XSS）在 Aspera 文档网站"

影响厂商:b'IBM'(https://hackerone.com/ibm) 
" 跨站脚本攻击（XSS）在阿斯佩拉文档网站"

A shadcn table component with server-side sorting, filtering, and pagination.