Hello Folks , I hope everyone is doing well in this pandemic & making full use of it for learning new stuff in their daily life . so this a…

By Sergi Martinez This post analyzes and exploits CVE-2021-21017, a heap buffer overflow reported in Adobe Acrobat Reader DC prior to versions 2021.001.20135. This vulnerability was anonymously reported to Adobe and patched on February 9th, 2021. A publicly…

I would like to report Server-side Template Injection in lodash.js (_.template function)
It allows the execution of code on the server

# Module

**module name:** lodash
**version:** 4.17.15
**npm...

I would like to report prototype pollution vulnerability in noble.
It allows attackers to pollute the Object.prototype object of an application running noble, possibly through Bluetooth.

#...

Detectify Crowdsource ethical hackers found an undocumented authentication bypass in Adobe Experience Manager. Comments from Adobe added.

Introduction Microsoft Windows Graphics Device Interface+, also known as GDI+, allows various applications to use different graphics functionality on

While participating in one private bug bounty program, I discovered a pre-auth RCE in ForgeRock OpenAM server - a popular access management solution for web applications. In this blog post, I'm going

In October 2020, researcher Abdelhamid Naceri, also known as halov, submitted a unique vulnerability to the ZDI. This vulnerability in Windows 10 allows a low-privileged user to wipe out arbitrary files needed for UEFI boot. The attack can even be conducted…

背景本月的微软更新包含一个spool的打印机服务本地提权漏洞，自从去年cve-2020-1048被公开以来，似乎许多人开始关注到这一模块的漏洞。鉴于此这个漏洞刚公布出来时，并没有太仔细关注。直到后面关注到绿盟的微信公众号的演示视频，显示这个漏洞可能在域环境特定情况下执行任意代码。所以认为有必要对其原理以及适用范围情况进行分析。 补丁分析通过补丁对比，可以确定该漏洞触发原理应该是一个在添加打印机驱动的过程中RpcAddPrinterDriverEx()绕过某些检查的漏洞。 根据API文档，RpcAddPrinterDriverEx…

SecIN是启明星辰云众可信旗下的信息安全技术社区。社区理念：共享·链接，与每一个志同道合的人；纯粹·安全，听自己愿意听见的声音；协作·发展，是信息安全生态的力量。

Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527 - hlldz/CVE-2021-1675-LPE

2.关键词：在/app/system/entrance.php看到了配置文件的定义，全局搜索这’PATH_CONFIG‘参数。

Securify provides reality checks to lower security risks and build up resilience against threats. Agile Security, Pentesting (scenario-based) and Red Teaming.

Vendor: Dell Vendor URL: Versions affected: Prior to version 3.3 Systems Affected: Any Author: Stephen Tomkinson stephen.tomkinson@nccgroup.com Advisory URL / CVE Identifier: CVE-2021-21586, CVE-20…

✨PoC for SSRF in IBM QRadar SIEM (CVE-2020-4786)✨ GET /console/chartServer?output=image&data=http://127.0.0.1:8080

Find out how a cross site scripting vulnerability in SmarterMail allows remote attackers to obtain the JWT token used to authenticate the user.

After investigating Impacket, the Checkmarx Security Research Team discovered a Path Traversal vulnerability, which could allow an attacker to write malicious files to any path on the target and achieve Remote Code Execution (RCE).