Cybersecurity information flow

有新的漏洞组件被发现啦,组件ID:Docker
Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will attempt to retrieve this file in whole. If it can be retrieved, it may be stored on the file system in whole (leading to possible disk consumption), however the more likely scenario given resource limitations is that the container will OOM during file retrieval if the target file size is greater than the allocated memory of the container. At best this can be used to force the container to infinitely restart due to OOM (if so configured in `docker-compose.yml), or at worst this can be used to force the Mealie container to crash and remain offline. In the event that the file can be retrieved, the lack of rate limiting on this endpoint also permits an attacker to generate ongoing requests to any target of their choice, potentially contributing to an external-facing DoS attack. This vulnerability is fixed in 1.4.0.

有新的漏洞组件被发现啦,组件ID:Docker
In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files. The vulnerability could allow a sudo privileged user on the host OS to read and write access to these files.

有新的漏洞组件被发现啦,组件ID:Docker
Docker instances in Brocade SANnav before v2.3.1 and v2.3.0a have an insecure architecture and configuration that leads to multiple vulnerabilities. Docker daemons are exposed to the WAN interface, and other vulnerabilities allow total control over the Ova appliance. A Docker instance could access any other instances, and a few could access sensitive files. The vulnerability could allow a sudo privileged user on the underlying OS to access and modify these files.

有新的漏洞组件被发现啦,组件ID:Docker
Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded keys used by Docker to reach remote registries over TLS. TLS connections with an exposed key allow an attacker to MITM the traffic. Note: Brocade SANnav doesn't have access to remote Docker registries.

有新的漏洞组件被发现啦,组件ID:Flask
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.

有新的漏洞组件被发现啦,组件ID:F5
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the set_encoder_id function in /fftools/ffmpeg_enc.c component.

有新的漏洞组件被发现啦,组件ID:F5
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.

有新的漏洞组件被发现啦,组件ID:F5
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the av_malloc function in libavutil/mem.c:105:9 component.

有新的漏洞组件被发现啦,组件ID:F5
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via theav_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component.

有新的漏洞组件被发现啦,组件ID:F5
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component.

有新的漏洞组件被发现啦,组件ID:F5
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.

密码生成工具 password maker password generator

Memoro是一款功能强大的堆栈数据细节分析工具，该工具可以提供关于堆内存数据的详细信息，并给出分析数据。

前言
这是南大软件分析课程的第八个实验，需要在实验A6（上下文敏感的过程间指针分析）的基础上实现污点分析。详细实验说明见官方网站。涉及到的主要课程知识为：
南大软分课程笔记｜13 静态分析在安全领域的应用。
实验说明中包含很多课上没有提到的细节，需要仔细阅读。大体的实现策略如下：
在原指针分析中处理invoke语句的地方添加对source和污点传播规则的实现。
借助原指针分析的工作流实现“taint作为普通对象”的常规传播。
指针分析结束后，在collectTaintFlows方法中进行sink规则的实现（生成taintflow）。
我最初实现的版本能够通过除了StringAppend.java测试用例外的所有本地测试，并找到OJ平台上所有测试用例一共29条taintflow中的23条，但是我始终不知道问题出在哪里。经过一天多的调试（中间的健身、休息、跟彭老师的诗词交流起到了重要作用！），我终于发现问题出在污点传播上，详情见后文。最终，我的代码能够通过OJ平台上所有测试用例，FP和FN均为0。当然，这并不能证明代码是完全正确的——至少，我的代码并没有主动考虑污点类型的变化（如StringBuilder到String）。
Source、Sink与污点传播规则
Source和sink的生成规则比较简单：
类型
语句
规则（上下文$c$）
Call (Source)
l: r = x.k(a1, ..., an)
Call (Sink)
l: r = x.k(a1, ..., an)
除了常规的对象传播外，污点传播还包括基于invoke语句的传播，因为目前的分析算法并不了解调用的API的语义。这部分的传播规则需要我们直接给出。对此，实验手册给出了三条传播规则，很好理解：
类型
语句
规则（上下文$c$）
Call (base-to-result)
l: r = x.k(a1, ... ,an)
Call (arg-to-base)
l: r = x.k(a1, ... ,an)
Call (arg-to-result)
l: r = x.k(a1, ... ,an)
初次实现的版本
Solver.java
StmtProcessor
在处理静态方法调用时增加对source和污点传播规则的处理：
private class StmtProcessor implements StmtVisitor<Void> { // .

最近复现了两个栈溢出漏洞的cve，分别是CVE-2017-9430和CVE-2017-13089，简单记录一下real wrold中的栈溢出...

一个成功的蜜罐往往会伪装成很有诱惑力的系统，攻击者进入以后，可能会获取他们想要的重要数据。

攻击者在其发布项目的环境依赖文件requirements.txt中添加恶意URL，以获取其恶意篡改的流行开源模块，从而在受害者电脑中植入窃密...

显示在2023年有49.6%的互联网流量竟来自机器人，比上一年增长 2%，达到自2013年以来观察到的最高水平。

Impacket专注于提供对数据包的简单编程访问，以及协议实现本身的某些协议（例如SMB1-3和MSRPC）。

The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning

A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Fixes for PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 are in development and are expected to be released by April 14, 2024. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. All other versions of PAN-OS are also not impacted.
[GitHub]Extract useful information from PANOS support file for CVE-2024-3400

" 全球保护功能中存在命令注入漏洞，特定版本的PAN-OS软件以及独特的功能配置可能使未经身份验证的攻击者能够在防火墙上下执行具有root权限的任意代码。PAN-OS 10.2、PAN-OS 11.0和PAN-OS 11.1的修复程序正在开发中，预计将于2024年4月14日发布。云NGFW、Panorama设备和服务器接入不受此漏洞影响。所有其他版本的PAN-OS也不会受到影响。\n\n[GitHub]从PANOS支持文件中提取有关CVE-2024-3400的有用信息。"

Read text section bytes and format it for shellcode (64bit ELF only)

影响厂商:Revive Adserver 奖励: 危险等级:None
" 登录页面密码猜测攻击"

影响厂商:b'Revive Adserver'(https://hackerone.com/revive_adserver) 
" 登录页面密码猜测攻击"