Cybersecurity information flow

作者:Swaroop Yermalkar (@swaroopsy) 程序:- 漏洞类型:iOS,Insecure deserialization,SSL pinning bypass 赏金:-

It's online. It's offline. It's a Service Worker!

在该工具的帮助下，广大研究人员能够轻松从源代码层面检测目标应用程序的潜在攻击面。

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2 (V1.31.460 and prior)
[GitHub]A PoC exploit for CVE-2022-34753 - OS Command Injection in SpaceLogic C-Bus Home Controller

State machines and statecharts for the modern web.

AI on the command line

Malware persistence is a crucial aspect of cyber threats that often goes unnoticed by unsuspecting users. In the realm of cybersecurity, it refers to the ability of malicious software to establish a foothold on a targeted system, allowing it to maintain its presence over an extended period. This persistence is achieved through various covert techniques, […]

本文讲解如何通过 Contract Size Check 判断调用者身份。

🍺 Scaffolding your Chrome extension! Boilerplates: react \ vue \ svelte \ solid \ preact \ alpine \ lit \ stencil \ inferno \ vanilla

Apache Shiro 是一个可执行身份验证、授权、加密和会话管理的 Java 安全框架。

Microsoft is proud to be recognized as a Leader in The Forrester Wave™: Zero Trust Platform Providers, Q3 2023 report.
The post Forrester names Microsoft a Leader in the 2023 Zero Trust Platform Providers Wave™ report appeared first on Microsoft Security Blog.

For the fifth consecutive year, Microsoft 365 Defender demonstrated leading extended detection and response (XDR) capabilities in the independent MITRE Engenuity ATT&CK® Evaluations: Enterprise. The attack used during the test highlights the importance of a unified XDR platform and showcases Microsoft 365 Defender as a leading solution, enabled by next-gen protection, industry-first capabilities like automatic attack disruption, and more.
The post Microsoft 365 Defender demonstrates 100 percent protection coverage in the 2023 MITRE Engenuity ATT&CK® Evaluations: Enterprise  appeared first on Microsoft Security Blog.

Today, Microsoft announced several major innovations to empower people across work and life and redefine how we live and work with AI.
The post New Microsoft security tools to protect families and businesses appeared first on Microsoft Security Blog.

.NET port of Leron Gray's azbelt tool.

总结推荐本周的热点资讯、安全事件、一周好文和省心工具，保证大家不错过本周的每一个重点！

SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
[GitHub]SQL injection vulnerbility in jeecgboot jeecg-boot v. allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.

该项目在执行read模块时会从内核堆地址中拷贝信息到用户空间中去，但是这里的拷贝没有对长度做限制，因此存在着越界读的漏洞。

The post Talkin’ About Infosec News – 9/18/2023 appeared first on Black Hills Information Security.

影响厂商:LinkedIn 奖励: 危险等级:critical

影响厂商:Nord Security 奖励:250.0USD 危险等级:medium