棱角社区 – Telegram

#漏洞 CVE-2021-32030：ASUS GT-AC2900身份验证绕过
https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass

CVE-2021-32030: ASUS GT-AC2900 Authentication Bypass — Atredis Partners

In a previous blog post I had presented a creative method to resurrect a bricked device, in this post I will go over an authentication bypass vulnerability discovered within the running firmware.

80 views16:15

棱角社区

#漏洞 Another Windows Installer Local Privilege Escalation Bug Gets a Micropatch (CVE-2021-26415)
https://blog.0patch.com/2021/05/another-windows-installer-local.html

0Patch

Another Windows Installer Local Privilege Escalation Bug Gets a Micropatch (CVE-2021-26415)

by Mitja Kolsek, the 0patch Team On April 21, security researcher Adrian Denkiewicz published an in-depth analysis of a local privilege...

80 views16:36

棱角社区

#漏洞 Apache Solr<= 8.8.2 (最新) 任意文件删除
https://mp.weixin.qq.com/s/dECH74n5qjrWT9lok8IkPQ

Weixin Official Accounts Platform

Apache Solr<= 8.8.2 (最新) 任意文件删除

David Smiley gg真是伤了我的心

74 views12:09

棱角社区

#漏洞 Ivanti Avalanche 目录遍历漏洞
https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/

SSD Secure Disclosure

SSD Advisory – Ivanti Avalanche Directory Traversal - SSD Secure Disclosure

Find out how a directory traversal vulnerability in Ivanti Avalanche allows remote unauthenticated user to access files that reside outside the 'image' folder.

63 views08:36

棱角社区

#漏洞 ExifTool 任意代码执行漏洞 (CVE-2021-22204)
https://github.com/rapid7/metasploit-framework/pull/15185

GitHub

Add CVE-2021-22204 ExifTool ANT perl injection by justinsteven · Pull Request #15185 · rapid7/metasploit-framework

The cat's out of the bag via https://www.openwall.com/lists/oss-security/2021/05/10/5
This module uses a slightly different injection primitive using \c to eat ExifTool's cleansing \
It cou...

61 views08:37

棱角社区

#漏洞 Xmind 2020 XSS漏洞导致命令执行
https://sploitus.com/exploit?id=EDB-ID:49827

Sploitus

💀 Exploit Xmind 2020 - XSS to RCE

Xmind 2020 - XSS to RCE | Sploitus | Exploit & Hacktool Search Engine

63 views08:37

棱角社区

#漏洞 ERPNext 13.0.0/12.18.0 中的多个XSS漏洞
https://trovent.io/security-advisory-2103-02

Trovent Security GmbH

Security Advisory 2103-02 - Trovent Security GmbH

Trovent Security GmbH discovered multiple Cross-Site-Scripting vulnerabilities in ERPNext 13.0.0/12.18.0

65 views12:27

棱角社区

#漏洞 ERPNext 13.0.0/12.18.0 中的SQL注入漏洞
https://trovent.io/security-advisory-2103-01

Trovent Security GmbH

Security Advisory 2103-01 - Trovent Security GmbH

Trovent Security GmbH discovered an SQL Injection vulnerability

69 views12:28

棱角社区

#漏洞【漏洞分析】CVE-2021-29200 Apache OFBiz RMI Bypass RCE 分析
https://mp.weixin.qq.com/s/vM0pXZ5mhusFBsj1xD-2zw

Weixin Official Accounts Platform

【漏洞分析】CVE-2021-29200 Apache OFBiz RMI Bypass RCE 分析

CVE-2021-29200 Apache OFBiz RMI Bypass RCE ，通过黑名单绕过，从而造成一个反序列化远程命令执行漏洞

68 views12:29

棱角社区

#漏洞 zzzcms 远程代码执行漏洞（CVE-2021-32605）
https://srcincite.io/advisories/src-2021-0015/

64 views01:53

棱角社区

#漏洞 Dell BIOS驱动权限提升漏洞（CVE-2021-21551）
https://github.com/rapid7/metasploit-framework/pull/15190

GitHub

Add Exploit For CVE-2021-21551 (Dell DBUtil_2_3 IOCTL) by zeroSteiner · Pull Request #15190 · rapid7/metasploit-framework

This adds an exploit for CVE-2021-21551 which is an IOCTL that is provided by the DBUtil_2_3.sys driver distributed by Dell that can be abused to perform kernel-mode memory read and write operation...

61 views01:51

棱角社区

#漏洞 Open Distro for Elasticsearch SSRF漏洞（CVE-2021-31828）
https://rotem-bar.com/ssrf-in-open-distro-for-elasticsearch-cve-2021-31828?guid=none&deviceId=8277082d-b611-40d0-9c28-e15797f0ab39

My Publications

CVE-2021-31828 - SSRF in Open Distro for ElasticSearch

61 views08:22

棱角社区

#漏洞泛微OA E-cology WorkflowServiceXml 远程代码执行漏洞
https://www.anquanke.com/post/id/239865

60 views13:45

棱角社区

#漏洞 CVE‑2021‑1079 – NVIDIA GeForce Experience命令执行
https://voidsec.com/nvidia-geforce-experience-command-execution/

VoidSec

CVE‑2021‑1079 - NVIDIA GeForce Experience Command Execution - VoidSec

CVE-2021-1079: NVIDIA GeForce Experience (GFE) v.<= 3.21 is affected by an Arbitrary File Write vulnerability which lead to Command Execution.

63 views15:41

棱角社区

#漏洞 Dell BIOS驱动权限提升漏洞（CVE-2021-21551）
https://github.com/waldo-irc/CVE-2021-21551

GitHub

GitHub - waldo-irc/CVE-2021-21551: Exploit to SYSTEM for CVE-2021-21551

Exploit to SYSTEM for CVE-2021-21551. Contribute to waldo-irc/CVE-2021-21551 development by creating an account on GitHub.

61 views01:08

棱角社区

#漏洞 AWS CloudShell中的终端逸出注入
https://bugs.chromium.org/p/project-zero/issues/detail?id=2154

57 views01:16

棱角社区

#漏洞 Cisco RV34X系列权限提升漏洞（CVE-2021-1520）
https://www.iot-inspector.com/blog/advisory-cisco-rv34x-series-privilege-escalation-vpntimer/

ONEKEY

Advisory: Cisco RV34X Series - Privilege Escalation in vpnTimer - ONEKEY

IoT Inspector detected a rare security vulnerability in Cisco's RV34X Series. Read the full root analysis on the blog!

56 views06:16

棱角社区

#漏洞前端JS框架Aurelia不安全默认值可导致XSS
https://www.gosecure.net/blog/2021/05/12/aurelia-framework-insecure-default-allows-xss/

GoSecure

24/7 managed detection, response, and expert cybersecurity services - GoSecure

We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.

63 views12:59

棱角社区

#漏洞代码审计之youdiancms最新版getshell漏洞
https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247489940&idx=1&sn=3911278a0b88362eb410c80ebccae9a2

Weixin Official Accounts Platform

代码审计之youdiancms最新版getshell漏洞

本文首发于奇安信攻防社区。其中包括未授权SQL注入漏洞、绕过后台登录漏洞、后台getshell漏洞的审计过程。

68 views13:05

棱角社区

#漏洞 XStream远程代码执行漏洞（CVE-2021-29505）
https://x-stream.github.io/CVE-2021-29505.html

71 views02:53

棱角社区

#漏洞 Pega Infinity登陆绕过漏洞（CVE-2021-27651）
https://github.com/samwcyo/CVE-2021-27651-PoC/blob/main/RCE.md

GitHub

CVE-2021-27651-PoC/RCE.md at main · samwcyo/CVE-2021-27651-PoC

RCE for Pega Infinity >= 8.2.1, Pega Infinity <= 8.5.2 - samwcyo/CVE-2021-27651-PoC

73 views02:55

About

Blog

Apps

Platform