棱角社区 – Telegram

棱角社区

83 subscribers

12 photos

444 links

网络安全事件推送.

Download Telegram

About

Blog

Apps

Platform

#漏洞用友NC Cloud SQL注入漏洞（CNVD-2021-34249）
https://mp.weixin.qq.com/s/jsfWasjaV_n7vI7_VDA83A

69 views13:22

#漏洞 Jetty 通用 Servlets 组件 ConcatServlet 信息泄露漏洞（CVE-2021-28169）
https://github.com/vulhub/vulhub/blob/master/jetty/CVE-2021-28169/README.zh-cn.md

vulhub/jetty/CVE-2021-28169/README.zh-cn.md at master · vulhub/vulhub

Pre-Built Vulnerable Environments Based on Docker-Compose - vulhub/vulhub

73 views13:23

#漏洞聊聊 Synology NAS Audio Station 套件未授权 RCE 调试及 EXP 构造
https://paper.seebug.org/1604/

75 views13:23

#漏洞 About the Unsuccessful Quest for a Deserialization Gadget (or: How I found CVE-2021-21481)
https://codewhitesec.blogspot.com/2021/06/about-unsuccessful-quest-for.html

CODE WHITE | Blog: About the Unsuccessful Quest for a Deserialization Gadget (or: How I found CVE-2021-21481)

This blog post describes the research on SAP J2EE Engine 7.50 I did between October 2020 and January 2021. The first part describes how I se...

73 views07:12

#漏洞 Citrix Application Delivery Controller访问控制错误漏洞（CVE-2020-8300）
https://github.com/stuartcarroll/CitrixADC-CVE-2020-8300

GitHub - stuartcarroll/CitrixADC-CVE-2020-8300: Detect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020…

Detect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020-8300 using Citrix ADC NITRO API - stuartcarroll/CitrixADC-CVE-2020-8300

66 views02:27

#漏洞 Unauthenticated Gitlab SSRF
https://vin01.github.io/piptagole/gitlab/ssrf/security/2021/06/15/gitlab-ssrf.html

65 views02:27

#漏洞 IPFire 2.25 远程代码执行（CVE-2021-33393）
https://packetstormsecurity.com/files/163158/ipfire_pakfire_exec.rb.txt

Packetstormsecurity

IPFire 2.25 Remote Code Execution ≈ Packet Storm

Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers

66 views02:28

#漏洞 PageKit CMS 1.0.18 存储型 XSS（CVE-2021-32245）
https://github.com/pagekit/pagekit/issues/963

A stored XSS has been found in PageKit CMS affecting versions 1.0.18. · Issue #963 · pagekit/pagekit

Problem A user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or fil...

68 views02:28

#漏洞 Plain Credentials in DIR-2640-US Router
https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204

CVE/2021/CVE-2021-34204 at main · secnotes/CVE

Some Awesome and Simple CVE. Contribute to secnotes/CVE development by creating an account on GitHub.

72 views02:28

#漏洞 CVE-2021-31585: Accellion kiteworks - Web administrator to remote code execution
https://zxsecurity.co.nz/research/accellion-kiteworks-CVE-2021-31585/

CVE-2021-31585: Accellion kiteworks - Web administrator to remote code execution

Introduction ZX Security performed security testing of Accellion’s kiteworks application. The review was performed with a copy of the kiteworks virtual machine (VM), as well as access to a client pre-production instance.

74 views03:17

#漏洞 Quick Analysis for the SSID Format String Bug
https://blog.chichou.me/2021/06/20/quick-analysis-wifid/

66 views13:54

#漏洞 Microsoft SharePoint远程代码执行漏洞（CVE-2021-31181）
https://packetstormsecurity.com/files/163208/sharepoint_unsafe_control.rb.txt

Packetstormsecurity

Microsoft SharePoint Unsafe Control And ViewState Remote Code Execution ≈ Packet Storm

Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers

60 views13:55

#漏洞 CVE-2021–20226 a reference counting bug which leads to local privilege escalation in io_uring.
https://flattsecurity.medium.com/cve-2021-20226-a-reference-counting-bug-which-leads-to-local-privilege-escalation-in-io-uring-e946bd69177a

CVE-2021–20226 a reference counting bug which leads to local privilege escalation in io_uring.

Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.

64 views01:58

#漏洞 Gitlab CI Lint API未授权 SSRF漏洞 (CVE-2021-22214)

https://github.com/r0ckysec/CVE-2021-22214

58 views04:38

#漏洞 Apache Airflow 错误的会话验证漏洞（CVE-2020-17526）利用
https://mp.weixin.qq.com/s/gq5AE--wqQNuuWilj73qvw

Weixin Official Accounts Platform

Apache Airflow 错误的会话验证漏洞（CVE-2020-17526）利用

漏洞描述 Apache 官方在2020年12月21日发布的邮件中披露Apache Airflow 存在一个由

57 views12:07

#漏洞 CiviCRM 5.22.0 - Code Execution Vulnerability Chain Explained
https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained

CiviCRM 5.22.0 - Code Execution Vulnerability Chain Explained

We discovered critical code vulnerabilities in CiviCRM, a popular CRM plugin for Wordpress, Joomla and Drupal. Learn more about how to find and patch these issues.

60 views22:50

#漏洞 CVE-2021-31939

Outlook, Office • <= 16.0.13628.20274 • Use After Free
https://cpr-zero.checkpoint.com/vulns/cprid-2164/

CPR-Zero: CVE-2021-31939

Check Point Research Vulnerability Repository

64 views23:00

#工具整理的一些各种类型的工具合集、漏洞情报、在线工具、安全资料等：
https://forum.ywhack.com/center.php

[~]#棱角 ::Edge.Forum*

62 views14:32

收集的一些在线工具列表：https://forum.ywhack.com/bountytips.php?tools
一些好用的在线字典系列：https://forum.ywhack.com/wordlists.php
反弹shell在线命令生成：https://forum.ywhack.com/shell.php
文件下载快捷命令生成：https://forum.ywhack.com/bountytips.php?download
工具合集/安全资料/漏洞情报：https://forum.ywhack.com/center.php
各种技巧，赏金姿势、工具等：https://forum.ywhack.com/bountytips.php

[~]#棱角 ::Edge.Forum*

63 views14:37

#漏洞 Multiple pre-auth RCEs in Apache Dubbo - CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, CVE-2021-32824
https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo/

GitHub Security Lab

GHSL-2021-034_043: Multiple pre-auth RCEs in Apache Dubbo - CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, CVE…

Multiple vulnerabilities have been found in Apache Dubbo enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers.

67 views01:29

#漏洞 CVE-2021-1497: CISCO HYPERFLEX HX AUTH HANDLING REMOTE COMMAND EXECUTION
https://www.zerodayinitiative.com/blog/2021/6/23/cve-2021-1497-cisco-hyperflex-hx-auth-handling-remote-command-execution

Zero Day Initiative

Zero Day Initiative — CVE-2021-1497: Cisco HyperFlex HX Auth Handling Remote Command Execution

In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Kc Udonsi and Yazhi Wang of the Trend Micro Research Team detail a recent code execution vulnerability in the Cisco HyperFlex HX Data Platform. The bug was originally discovered…

70 views02:00