棱角社区
@EdgeSecurity
83 subscribers
12 photos
444 links
网络安全事件推送.
Download Telegram
About
Blog
Apps
Platform
Join
棱角社区
83 subscribers
棱角社区
#漏洞 CVE-2021-31181: MICROSOFT SHAREPOINT WEBPART INTERPRETATION CONFLICT REMOTE CODE EXECUTION VULNERABILITY
https://www.zerodayinitiative.com/blog/2021/6/1/cve-2021-31181-microsoft-sharepoint-webpart-interpretation-conflict-remote-code-execution-vulnerability
Zero Day Initiative
Zero Day Initiative — CVE-2021-31181: Microsoft SharePoint WebPart Interpretation Conflict Remote Code Execution Vulnerability
In May of 2021, Microsoft released a patch to correct CVE-2021-31181 – a remote code execution bug in the supported versions of Microsoft SharePoint Server. This bug was reported to the ZDI program by an anonymous researcher and is also known as ZDI-21…
57 views
棱角社区
#漏洞 利用 Apple Safari 中的 0Day WebAssembly 漏洞 (CVE-2021-30734)
https://blog.ret2.io/2021/06/02/pwn2own-2021-jsc-exploit/
RET2 Systems Blog
32 bits, 32 gigs, 1 click...
In this post we will examine a vulnerability in the WebAssembly subsystem of JavaScriptCore, the JavaScript engine used in WebKit and Apple Safari. The issue...
60 views
棱角社区
#漏洞 Persistant Arbitrary code execution in mattermost android
https://hackerone.com/reports/1115864
HackerOne
Mattermost disclosed on HackerOne: Persistant Arbitrary code...
## Summary:
Activity `com.mattermost.share.ShareActivity` is is exported and is designed to allow file sharing from third party application to mattermost android app.
```
<activity...
58 views
棱角社区
#漏洞 CVE-2021–22201：在 Gitlab 上读取任意文件
https://tradahacking.vn/cve-2021-22201-arbitrary-file-read-on-gitlab-d84d77cd83e3
62 views
棱角社区
#漏洞 XSS in the AWS Console
https://frichetten.com/blog/xss_in_aws_console/
Frichetten
XSS in the AWS Console
Writeup for a cross-site scripting bug I found in the AWS Console.
68 views
棱角社区
#漏洞 vCenter Server CVE-2021-21985 RCE分析
https://www.anquanke.com/post/id/243098
Anquanke
vCenter Server CVE-2021-21985 RCE分析 - 安全客，安全资讯平台
VMware官方发布了VMware vCenter Server远程代码执行漏洞的风险通告，该漏洞是由360 Noah Lab的安全研究员Ricter Z发现的。
69 views
棱角社区
#漏洞 Huawei无线上网卡权限提升漏洞
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/huawei-lte-usb-stick-e3372-file-overwrite-to-code-execution/
62 views
棱角社区
#漏洞 CVE-2020-27301 - CVE-2020-27302: Realtek Critical Wi-Fi Vulnerabilities, elevated privileges and hijack wireless communications
https://www.vdoo.com/blog/realtek-wifi-vulnerabilities-zero-day
63 views
棱角社区
#漏洞 VCSA 6.5-7.0 远程代码执行 CVE-2021-21985 漏洞分析
http://noahblog.360.cn/vcenter-cve-2021-2021-21985/
Noah Lab
VCSA 6.5-7.0 远程代码执行 CVE-2021-21985 漏洞分析
vSphere vCenter Server 的 vsphere-ui 基于 OSGi 框架，包含上百个 bundle。前几日爆出的任意文件写入漏洞即为 vrops 相关的 bundle 出现的问题。在针对其他 bundle 审计的过程中，发现 h5-vsan 相关的 bundle 提供了一些 API 端点，并且未经过授权即可访问。通过进一步的利用，发现其中某个端点存在安全问题，可以执行任意 Spring Bean 的方法，从而导致命令执行。漏洞时间线： 2021/04/13 - 发现漏洞并实现 RCE；2021/04/16…
66 views
棱角社区
#漏洞 POC Exploit from a CVE: Apache Airflow 1.10.10. RCE
https://infosecwriteups.com/poc-exploit-from-a-cve-apache-airflow-1-10-10-rce-e2c764f2a6f0
Medium
POC Exploit from a CVE: Apache Airflow 1.10.10. RCE
A quick overview how to write an poc exploit from a CVE in Apache Airflow 1.10.10
66 views
棱角社区
#漏洞 Lucee Server 未授权RCE漏洞（CVE-2021-21307）
https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md
GitHub
writeups/Apple-RCE.md at main · httpvoid/writeups
Contribute to httpvoid/writeups development by creating an account on GitHub.
66 views
棱角社区
#漏洞 CVE-2021-30724：macOS 和 iOS 中的 CVMServer 漏洞
https://www.trendmicro.com/en_us/research/21/f/CVE-2021-30724_CVMServer_Vulnerability_in_macOS_and_iOS.html
Trend Micro
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS
We analyze the patched CVE-2021-30724 vulnerability, affecting macOS, iOS, and iPadOS. If exploited, this flaw can allow privilege escalation.
63 views
棱角社区
#漏洞 https://therecord.media/microsoft-patches-six-windows-zero-days-including-a-commercial-exploit/
therecord.media
Microsoft patches six Windows zero-days, including a commercial exploit
Microsoft has released today its monthly batch of security updates, known in the industry as Patch Tuesday.
68 views
棱角社区
#漏洞 https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/
71 views
棱角社区
#漏洞 安全评估工具整理、分类：
https://forum.ywhack.com/center.php
Ywhack
[~]#棱角 ::Edge.Forum*
70 views
棱角社区
#漏洞 Atlassian Jira 用户名枚举（CVE-2020-36289）
https://twitter.com/ptswarm/status/1402644004781633540
Twitter
PT SWARM
Atlassian Jira Unauth User Enumeration (CVE-2020-36289) discovered by our researcher Mikhail Klyuchnikov. Jira < 8.5.13 8.6.0 ≤ Jira < 8.13.5 8.14.0 ≤ Jira < 8.15.1 PoC: /secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin Advisory: jira.…
62 views
棱角社区
#漏洞 CVE-2021-26868 LPE & CVE-2021-33739 POC：
https://github.com/mavillon1/CVE-2021-33739-POC
68 views
棱角社区
#漏洞 用友NC Cloud SQL注入漏洞（CNVD-2021-34249）
https://mp.weixin.qq.com/s/jsfWasjaV_n7vI7_VDA83A
69 views
棱角社区
#漏洞 Jetty 通用 Servlets 组件 ConcatServlet 信息泄露漏洞（CVE-2021-28169）
https://github.com/vulhub/vulhub/blob/master/jetty/CVE-2021-28169/README.zh-cn.md
GitHub
vulhub/jetty/CVE-2021-28169/README.zh-cn.md at master · vulhub/vulhub
Pre-Built Vulnerable Environments Based on Docker-Compose - vulhub/vulhub
73 views
棱角社区
#漏洞 聊聊 Synology NAS Audio Station 套件未授权 RCE 调试及 EXP 构造
https://paper.seebug.org/1604/
75 views
棱角社区
#漏洞 About the Unsuccessful Quest for a Deserialization Gadget (or: How I found CVE-2021-21481)
https://codewhitesec.blogspot.com/2021/06/about-unsuccessful-quest-for.html
Blogspot
CODE WHITE | Blog: About the Unsuccessful Quest for a Deserialization Gadget (or: How I found CVE-2021-21481)
This blog post describes the research on SAP J2EE Engine 7.50 I did between October 2020 and January 2021. The first part describes how I se...
73 views