棱角社区 – Telegram

棱角社区

#漏洞 ERPNext 13.0.0/12.18.0 中的SQL注入漏洞
https://trovent.io/security-advisory-2103-01

Trovent Security GmbH

Security Advisory 2103-01 - Trovent Security GmbH

Trovent Security GmbH discovered an SQL Injection vulnerability

69 views12:28

棱角社区

#漏洞【漏洞分析】CVE-2021-29200 Apache OFBiz RMI Bypass RCE 分析
https://mp.weixin.qq.com/s/vM0pXZ5mhusFBsj1xD-2zw

Weixin Official Accounts Platform

【漏洞分析】CVE-2021-29200 Apache OFBiz RMI Bypass RCE 分析

CVE-2021-29200 Apache OFBiz RMI Bypass RCE ，通过黑名单绕过，从而造成一个反序列化远程命令执行漏洞

68 views12:29

棱角社区

#漏洞 zzzcms 远程代码执行漏洞（CVE-2021-32605）
https://srcincite.io/advisories/src-2021-0015/

64 views01:53

棱角社区

#漏洞 Dell BIOS驱动权限提升漏洞（CVE-2021-21551）
https://github.com/rapid7/metasploit-framework/pull/15190

GitHub

Add Exploit For CVE-2021-21551 (Dell DBUtil_2_3 IOCTL) by zeroSteiner · Pull Request #15190 · rapid7/metasploit-framework

This adds an exploit for CVE-2021-21551 which is an IOCTL that is provided by the DBUtil_2_3.sys driver distributed by Dell that can be abused to perform kernel-mode memory read and write operation...

61 views01:51

棱角社区

#漏洞 Open Distro for Elasticsearch SSRF漏洞（CVE-2021-31828）
https://rotem-bar.com/ssrf-in-open-distro-for-elasticsearch-cve-2021-31828?guid=none&deviceId=8277082d-b611-40d0-9c28-e15797f0ab39

My Publications

CVE-2021-31828 - SSRF in Open Distro for ElasticSearch

61 views08:22

棱角社区

#漏洞泛微OA E-cology WorkflowServiceXml 远程代码执行漏洞
https://www.anquanke.com/post/id/239865

60 views13:45

棱角社区

#漏洞 CVE‑2021‑1079 – NVIDIA GeForce Experience命令执行
https://voidsec.com/nvidia-geforce-experience-command-execution/

VoidSec

CVE‑2021‑1079 - NVIDIA GeForce Experience Command Execution - VoidSec

CVE-2021-1079: NVIDIA GeForce Experience (GFE) v.<= 3.21 is affected by an Arbitrary File Write vulnerability which lead to Command Execution.

63 views15:41

棱角社区

#漏洞 Dell BIOS驱动权限提升漏洞（CVE-2021-21551）
https://github.com/waldo-irc/CVE-2021-21551

GitHub

GitHub - waldo-irc/CVE-2021-21551: Exploit to SYSTEM for CVE-2021-21551

Exploit to SYSTEM for CVE-2021-21551. Contribute to waldo-irc/CVE-2021-21551 development by creating an account on GitHub.

61 views01:08

棱角社区

#漏洞 AWS CloudShell中的终端逸出注入
https://bugs.chromium.org/p/project-zero/issues/detail?id=2154

57 views01:16

棱角社区

#漏洞 Cisco RV34X系列权限提升漏洞（CVE-2021-1520）
https://www.iot-inspector.com/blog/advisory-cisco-rv34x-series-privilege-escalation-vpntimer/

ONEKEY

Advisory: Cisco RV34X Series - Privilege Escalation in vpnTimer - ONEKEY

IoT Inspector detected a rare security vulnerability in Cisco's RV34X Series. Read the full root analysis on the blog!

56 views06:16

棱角社区

#漏洞前端JS框架Aurelia不安全默认值可导致XSS
https://www.gosecure.net/blog/2021/05/12/aurelia-framework-insecure-default-allows-xss/

GoSecure

24/7 managed detection, response, and expert cybersecurity services - GoSecure

We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.

63 views12:59

棱角社区

#漏洞代码审计之youdiancms最新版getshell漏洞
https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247489940&idx=1&sn=3911278a0b88362eb410c80ebccae9a2

Weixin Official Accounts Platform

代码审计之youdiancms最新版getshell漏洞

本文首发于奇安信攻防社区。其中包括未授权SQL注入漏洞、绕过后台登录漏洞、后台getshell漏洞的审计过程。

68 views13:05

棱角社区

#漏洞 XStream远程代码执行漏洞（CVE-2021-29505）
https://x-stream.github.io/CVE-2021-29505.html

71 views02:53

棱角社区

#漏洞 Pega Infinity登陆绕过漏洞（CVE-2021-27651）
https://github.com/samwcyo/CVE-2021-27651-PoC/blob/main/RCE.md

GitHub

CVE-2021-27651-PoC/RCE.md at main · samwcyo/CVE-2021-27651-PoC

RCE for Pega Infinity >= 8.2.1, Pega Infinity <= 8.5.2 - samwcyo/CVE-2021-27651-PoC

73 views02:55

棱角社区

#漏洞 NoSQL Injections in Rocket.Chat 3.12.1: How A Small Leak Grounds A Rocket
https://blog.sonarsource.com/nosql-injections-in-rocket-chat/

Sonarsource

NoSQL Injections in Rocket.Chat 3.12.1: How A Small Leak Grounds A Rocket

We recently discovered vulnerabilities in Rocket.Chat, a popular team communications solution, that could be used to take over Rock.Chat instances.

62 views01:43

棱角社区

#漏洞 (u)rxvt terminal (+bash) remoteish code execution 0day
https://seclists.org/fulldisclosure/2021/May/33

seclists.org

Full Disclosure: (u)rxvt terminal (+bash) remoteish code execution 0day

58 views13:44

棱角社区

#漏洞蓝海卓越计费管理系统远程命令执行漏洞
https://mp.weixin.qq.com/s/CVe7GSRzCKcYXj5Pj8W5SA

Weixin Official Accounts Platform

蓝海卓越计费管理系统 debug.php 远程命令执行漏洞

60 views13:45

棱角社区

#漏洞 Drupal 默认配置导致的密码重置中毒
https://www.drupal.org/project/drupal/issues/2221699

Drupal.org

HTTP_HOST header cannot be trusted

This issue has been handled by the Drupal Security Team in private and it was decided that this security hardening issue can be handled in public. See also, Handbook for Protecting against HTTP HOST Header attacks. Problem/Motivation An attacker can construct…

61 views13:46

棱角社区

#漏洞 H3C IMC dynamiccontent.properties.xhtm 远程命令执行
https://mp.weixin.qq.com/s/BP9_H3lpluqIwL5OMIJlIw

Weixin Official Accounts Platform

H3C IMC dynamiccontent.properties.xhtm 远程命令执行

64 views13:46

棱角社区

#漏洞 Vulnerability项目20210522更新了132条漏洞信息，其中部分为0day，项目地址：
https://github.com/EdgeSecurityTeam/Vulnerability

61 views16:17

棱角社区

#漏洞 WordPress XXE Vulnerability in Media Library – CVE-2021-29447
https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/

WPSec

WordPress XXE Vulnerability in Media Library - CVE-2021-29447 - WPSec

WordPress versions 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11 are affected to XML eXternal Entity vulnerability where an authenticated user with the ability to upload files in the Media Library can upload a malicious WAVE file that could lead to remote arbitrary file…

67 views16:31

About

Blog

Apps

Platform