棱角社区 – Telegram

55 views02:36

#漏洞 mongo-express中的远程代码执行-CVE-2020-24391
https://securitylab.github.com/advisories/GHSL-2020-131-mongo-express/

GHSL-2020-131: Remote Code Execution in mongo-express - CVE-2020-24391

Mongo-express uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to RCE in the context of the node server.

61 views04:38

棱角社区

#漏洞 Jellyfin 任意文件读取（CVE-2021-21402）
https://securitylab.github.com/advisories/GHSL-2021-050-jellyfin/

GitHub Security Lab

GHSL-2021-050: Unauthenticated arbitrary file read in Jellyfin - CVE-2021-21402

Jellyfin allows unauthenticated arbitrary file read.

61 views04:38

棱角社区

#漏洞 Zero click vulnerability in Apple’s macOS Mail
https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c

Medium

Zero click vulnerability in Apple’s macOS Mail

Zero-Click Zip TL;DR

64 views15:15

棱角社区

#漏洞金和OA C6 后台越权敏感文件遍历漏洞 (没啥用的0day~)
https://mp.weixin.qq.com/s/90HM3LqODBN35iqRBRE1HA

Weixin Official Accounts Platform

金和OA C6 后台越权敏感文件遍历漏洞 (没啥用的0day~)

67 views16:10

棱角社区

#bountytip Beyond SQLi: Obfuscate and Bypass
https://www.exploit-db.com/papers/17934

Exploit Database

Beyond SQLi: Obfuscate and Bypass

72 views04:49

棱角社区

#漏洞银澎云计算好视通视频会议系统任意文件下载
https://mp.weixin.qq.com/s/F-M21PT0xn9QOuwoC8llKA

Weixin Official Accounts Platform

银澎云计算好视通视频会议系统任意文件下载(0day来啦~)

66 views02:18

棱角社区

#工具 Eeyes(棱眼)-快速筛选真实IP并整理为C段
https://github.com/EdgeSecurityTeam/Eeyes

GitHub

GitHub - EdgeSecurityTeam/Eeyes: Eeyes(棱眼)-快速筛选真实IP并整理为C段

Eeyes(棱眼)-快速筛选真实IP并整理为C段. Contribute to EdgeSecurityTeam/Eeyes development by creating an account on GitHub.

68 views05:39

棱角社区

#漏洞锐捷Smartweb管理系统密码信息泄露漏洞 CNVD-2021-17369
https://mp.weixin.qq.com/s/EICYTqRWDRB8OfXKHxCBfQ

Weixin Official Accounts Platform

锐捷Smartweb管理系统密码信息泄露漏洞 CNVD-2021-17369

70 views06:37

棱角社区

#漏洞 Mark Text Markdown 编辑器RCE（CVE-2021-29996）
https://github.com/marktext/marktext/issues/2548

GitHub

XSS vulnerability could result in RCE - CVE-2021-29996 · Issue #2548 · marktext/marktext

Description Cross Site Scripting (XSS) vulnerability that could result in Remote Code Execution (RCE). CVE-2021-29996 was assigned for this issue. Steps to reproduce Create a .md file that contains...

68 views12:28

棱角社区

#bountytip I Built a TV That Plays All of Your Private YouTube Videos
https://bugs.xdavidhu.me/google/2021/04/05/i-built-a-tv-that-plays-all-of-your-private-youtube-videos/

bugs.xdavidhu.me

I Built a TV That Plays All of Your Private YouTube Videos

David Schütz's bug bounty writeups

69 views13:04

棱角社区

#漏洞 WordPress插件Tutor LMS SQL注入漏洞（CVE-2021-24186）
https://wpscan.com/vulnerability/5f5c0c6c-6f76-4366-b590-0aab557f8c60

69 views07:50

棱角社区

#漏洞 WordPress WP Super Cache 插件 < 1.7.2 RCE（CVE-2021-24209）
https://wpscan.com/vulnerability/733d8a02-0d44-4b78-bbb2-37e447acd2f3

WPScan

WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)

See details on WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE) CVE 2021-24209. View the latest Plugin Vulnerabilities on WPScan.

70 views07:50

棱角社区

#漏洞 WordPress Elementor Page Builder Plus插件身份验证绕过（CVE-2021-24175）
https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89

71 views11:50

棱角社区

#漏洞 Ruby目录遍历漏洞（CVE-2021-28966）
https://hackerone.com/reports/302298

HackerOne

Ruby disclosed on HackerOne: Unintentional file creation caused at...

The Tempfile argument of `basename` can use `../` without escaping.
Therefore, directory traversal may occur and unintended files may be generated.

#### create file...

72 views15:23

棱角社区

#漏洞某VPN客户端远程下载文件执行挖掘（已修复）

https://mp.weixin.qq.com/s/XbsxziIFKx8VhGd-pv0Ghg

Weixin Official Accounts Platform

某VPN客户端远程下载文件执行挖掘（已修复）

74 views16:18

棱角社区

#漏洞 Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys.
https://github.com/0vercl0k/CVE-2021-24086

GitHub

GitHub - 0vercl0k/CVE-2021-24086: Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely. - 0vercl0k/CVE-2021-24086

76 views13:13

棱角社区

#漏洞 BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution
https://google.github.io/security-research/pocs/linux/bleedingtooth/

security-research

BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

81 views14:11

棱角社区

#漏洞 nc1day 反序列化漏洞的武器级利用
https://mp.weixin.qq.com/s/IdXYbjNVGVIasuwQH48Q1w

Weixin Official Accounts Platform

某C 1day 反序列化漏洞的武器级利用

虽然打厚码，但是好兄弟们依旧知道我在说什么。至于这个是不是你们说的0day/1day

83 views09:01

棱角社区

#漏洞 Nagios Network Analyzer SQL 注入漏洞（CVE-2021-28925）
https://medium.com/stolabs/issues-found-on-nagios-network-analyzer-2-4-2-50ec4ffb5e25

Medium

Issues Found on Nagios Network Analyzer 2.4.2

During the time of 2020, I was preparing for a certification called OSWE. The path has been long and with curves, because sometimes we…

77 views12:21

棱角社区

#漏洞 Gogs Git Hooks 远程代码执行漏洞（CVE-2020-15867）
https://packetstormsecurity.com/files/162123/gogs_git_hooks_rce.rb.txt

Packetstormsecurity

Gogs Git Hooks Remote Code Execution ≈ Packet Storm

Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers

81 views12:21

About

Blog

Apps

Platform