棱角社区 – Telegram

棱角社区

83 subscribers

12 photos

444 links

网络安全事件推送.

Download Telegram

About

Blog

Apps

Platform

#漏洞 Vulnerability Spotlight: A deep dive into macOS SMB server
https://blog.talosintelligence.com/2021/06/vuln-spotlight-smb-mac-deep-dive.html

Cisco Talos Blog

Vulnerability Spotlight: A deep dive into macOS SMB server

By Aleksandar Nikolich.

Executive summary

Cisco Talos recently discovered multiple vulnerabilities in macOS’s implementation of SMB server. An adversary could exploit these vulnerabilities to carry out a variety of malicious actions, including revealing…

60 views14:19

#漏洞 CVE-2021-31181: MICROSOFT SHAREPOINT WEBPART INTERPRETATION CONFLICT REMOTE CODE EXECUTION VULNERABILITY
https://www.zerodayinitiative.com/blog/2021/6/1/cve-2021-31181-microsoft-sharepoint-webpart-interpretation-conflict-remote-code-execution-vulnerability

Zero Day Initiative

Zero Day Initiative — CVE-2021-31181: Microsoft SharePoint WebPart Interpretation Conflict Remote Code Execution Vulnerability

In May of 2021, Microsoft released a patch to correct CVE-2021-31181 – a remote code execution bug in the supported versions of Microsoft SharePoint Server. This bug was reported to the ZDI program by an anonymous researcher and is also known as ZDI-21…

57 views01:40

#漏洞利用 Apple Safari 中的 0Day WebAssembly 漏洞 (CVE-2021-30734)
https://blog.ret2.io/2021/06/02/pwn2own-2021-jsc-exploit/

RET2 Systems Blog

32 bits, 32 gigs, 1 click...

In this post we will examine a vulnerability in the WebAssembly subsystem of JavaScriptCore, the JavaScript engine used in WebKit and Apple Safari. The issue...

60 views03:36

#漏洞 Persistant Arbitrary code execution in mattermost android
https://hackerone.com/reports/1115864

Mattermost disclosed on HackerOne: Persistant Arbitrary code...

## Summary:
Activity `com.mattermost.share.ShareActivity` is is exported and is designed to allow file sharing from third party application to mattermost android app.
```
<activity...

58 views15:51

#漏洞 CVE-2021–22201：在 Gitlab 上读取任意文件
https://tradahacking.vn/cve-2021-22201-arbitrary-file-read-on-gitlab-d84d77cd83e3

62 views16:04

#漏洞 XSS in the AWS Console
https://frichetten.com/blog/xss_in_aws_console/

XSS in the AWS Console

Writeup for a cross-site scripting bug I found in the AWS Console.

68 views02:21

#漏洞 vCenter Server CVE-2021-21985 RCE分析
https://www.anquanke.com/post/id/243098

vCenter Server CVE-2021-21985 RCE分析 - 安全客，安全资讯平台

VMware官方发布了VMware vCenter Server远程代码执行漏洞的风险通告，该漏洞是由360 Noah Lab的安全研究员Ricter Z发现的。

69 views06:41

#漏洞 Huawei无线上网卡权限提升漏洞
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/huawei-lte-usb-stick-e3372-file-overwrite-to-code-execution/

62 views13:27

#漏洞 CVE-2020-27301 - CVE-2020-27302: Realtek Critical Wi-Fi Vulnerabilities, elevated privileges and hijack wireless communications
https://www.vdoo.com/blog/realtek-wifi-vulnerabilities-zero-day

63 views13:39

#漏洞 VCSA 6.5-7.0 远程代码执行 CVE-2021-21985 漏洞分析
http://noahblog.360.cn/vcenter-cve-2021-2021-21985/

VCSA 6.5-7.0 远程代码执行 CVE-2021-21985 漏洞分析

vSphere vCenter Server 的 vsphere-ui 基于 OSGi 框架，包含上百个 bundle。前几日爆出的任意文件写入漏洞即为 vrops 相关的 bundle 出现的问题。在针对其他 bundle 审计的过程中，发现 h5-vsan 相关的 bundle 提供了一些 API 端点，并且未经过授权即可访问。通过进一步的利用，发现其中某个端点存在安全问题，可以执行任意 Spring Bean 的方法，从而导致命令执行。漏洞时间线： 2021/04/13 - 发现漏洞并实现 RCE；2021/04/16…

66 views02:49

#漏洞 POC Exploit from a CVE: Apache Airflow 1.10.10. RCE
https://infosecwriteups.com/poc-exploit-from-a-cve-apache-airflow-1-10-10-rce-e2c764f2a6f0

POC Exploit from a CVE: Apache Airflow 1.10.10. RCE

A quick overview how to write an poc exploit from a CVE in Apache Airflow 1.10.10

66 views12:53

#漏洞 Lucee Server 未授权RCE漏洞（CVE-2021-21307）
https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md

writeups/Apple-RCE.md at main · httpvoid/writeups

Contribute to httpvoid/writeups development by creating an account on GitHub.

66 views05:06

#漏洞 CVE-2021-30724：macOS 和 iOS 中的 CVMServer 漏洞
https://www.trendmicro.com/en_us/research/21/f/CVE-2021-30724_CVMServer_Vulnerability_in_macOS_and_iOS.html

CVE-2021-30724: CVMServer Vulnerability in macOS and iOS

We analyze the patched CVE-2021-30724 vulnerability, affecting macOS, iOS, and iPadOS. If exploited, this flaw can allow privilege escalation.

63 views01:21

#漏洞 https://therecord.media/microsoft-patches-six-windows-zero-days-including-a-commercial-exploit/

therecord.media

Microsoft patches six Windows zero-days, including a commercial exploit

Microsoft has released today its monthly batch of security updates, known in the industry as Patch Tuesday.

68 views01:30

#漏洞 https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/

71 views01:40

#漏洞安全评估工具整理、分类：
https://forum.ywhack.com/center.php

[~]#棱角 ::Edge.Forum*

70 views06:32

#漏洞 Atlassian Jira 用户名枚举（CVE-2020-36289）
https://twitter.com/ptswarm/status/1402644004781633540

Atlassian Jira Unauth User Enumeration (CVE-2020-36289) discovered by our researcher Mikhail Klyuchnikov. Jira < 8.5.13 8.6.0 ≤ Jira < 8.13.5 8.14.0 ≤ Jira < 8.15.1 PoC: /secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin Advisory: jira.…

62 views13:22

#漏洞 CVE-2021-26868 LPE & CVE-2021-33739 POC：
https://github.com/mavillon1/CVE-2021-33739-POC

68 views13:22

#漏洞用友NC Cloud SQL注入漏洞（CNVD-2021-34249）
https://mp.weixin.qq.com/s/jsfWasjaV_n7vI7_VDA83A

69 views13:22

#漏洞 Jetty 通用 Servlets 组件 ConcatServlet 信息泄露漏洞（CVE-2021-28169）
https://github.com/vulhub/vulhub/blob/master/jetty/CVE-2021-28169/README.zh-cn.md

vulhub/jetty/CVE-2021-28169/README.zh-cn.md at master · vulhub/vulhub

Pre-Built Vulnerable Environments Based on Docker-Compose - vulhub/vulhub

73 views13:23

#漏洞聊聊 Synology NAS Audio Station 套件未授权 RCE 调试及 EXP 构造
https://paper.seebug.org/1604/

75 views13:23