Cybersecurity Flow

This Metasploit module creates a local user with a username/password and root-level privileges. Note that a root-level account is not required to do this, which makes it a privilege escalation issue. Note that this is pretty noisy, since it creates a user account and creates log files and such. Additionally, most (if not all) vulnerabilities in F5 grant root access anyways.

Dirty Cow arbitrary file write local privilege escalation exploit for macOS.

This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes.

Oracle Database version 12.1.0.2 suffers from a privilege escalation vulnerability that achieves DBA access via the Spatial component.

Ubuntu Security Notice 5841-1 - It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. This issue was only fixed in Ubuntu 14.04 ESM. It was discovered that LibTIFF was incorrectly accessing a data structure when processing data with the tiffcrop tool, which could lead to a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

We examine the Log4Shell disclosure through the lens of the Black Duck Knowledge Base to understand how organizations respond to high-profile vulnerabilities.

FUSE file system for archives and compressed files (ZIP, RAR, 7Z, ISO, TGZ, XZ...)

A simple "database" that use JSON file for Node.JS.

The fastest and simplest library for SQLite3 in Node.js.

[GitHub]Aspera Faspex Pre Auth RCE

各种数据库的利用姿势

各种数据库的利用姿势

CVE-2022-44268 ImageMagick Arbitrary File Read - Payload Generator

A tool that shows detailed information about named pipes in Windows

ESET发布2022年最后一个季度APT活动总结报告

WithSecure发布的关于lazarus APT活动各个阶段的分析与总结

该名单中有超过150万条记录，数据包括姓名、出生日期等

《为什么要把复杂的联表操作拆成多个单表查询？》我们在系统优化的时候，常见的一个操作，就是把复杂的联表操作，拆解成多个单表操作，然后在应用程序中进行联接。为什么要这样做呢？相信大家都可以列出几点。不过《高性能MySQL 第四版》对此有很好的总结，值得细品。摘录如下...

A formatter for Python files

A tool that shows detailed information about named pipes in Windows