Support & Share :

T.me/UndercodeTesting

Many companies are trying to give employees benefits instead of rights.
#International

Axiomtek is launching the AIE100-903-FL-NX AI Edge framework that can perform in rugged conditions.
#Technologies

🔵URI.js input validation error vulnerability:

https://dailycve.com/node/16

🔵Multiple vulnerabilities in Aterm SA3500G provided by NEC Corporation:

https://dailycve.com/node/17

OnePlus 9: a concept available at an insane price on eBay.
#International

Value SIM: You could get rich if you had this phone number.
#International

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🚀 Bring your favorite shell wherever you go through the ssh:

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽

PyPi 3
1) pip3 install xxh-xxh

pipx - good alternative to brew and pip, read comparision

2) pipx install xxh-xxh

Conda-forge feedstock

3) conda config --add channels conda-forge
conda install xxh-xxh

» Homebrew

> brew install xxh

» Linux portable binary

1) mkdir ~/xxh && cd ~/xxh

2) wget https://github.com/xxh/xxh-portable/raw/master/result/xxh-portable-musl-alpine-Linux-x86_64.tar.gz

3) tar -xzf xxh-portable-musl-alpine-Linux-x86_64.tar.gz

4) ./xxh

> >Linux AppImage

1) mkdir ~/xxh && cd ~/xxh

2) wget -O xxh https://github.com/xxh/xxh-appimage/releases/
download/continuous/xxh-release-x86_64.AppImage

3) chmod +x xxh && ./xxh

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

The price of Bitcoin is over $30,000 and its market cap is above $560 billion.
#Updates

CEO Ericsson: If Huawei's suspension ever remains, Ericsson would leave Sweden.
#International

🔵Plone XXE attacks:

https://dailycve.com/node/18

🦑free recommended project Haka:


An open source security oriented language which allows to describe protocols and apply security policies on (live) captured traffic. The scope of Haka language is twofold. First of all, it allows to write security rules in order to filter/alter/drop unwanted packets and log and report malicious activities. Second, Haka features a grammar enabling to specify network protocols and their underlying state machine.

» http://www.haka-security.org

🔵Seo Panel reflected XSS:

https://dailycve.com/node/19

After Life, Education, Peaky Blinders: Netflix floods us with news.
#Updates

The truth of the 'phantom market merger' of NEC / Fujitsu, the Hinomaru Union set up by NTTT.
#International

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Hack/ Pentesting ios browser's with bug: guide

https://bugs.chromium.org/p/project-zero/issues/detail?id=1858

1) The class _NSDataFileBackedFuture can be deserialized even if secure encoding is enabled.

2) This class is a file-backed NSData object that loads a local file into memory when the [NSData bytes] selector is called.

3) This presents two problems. First, it could potentially allow undesired access to local files if the code deserializing the buffer ever shares it (this is more likely to cause problems in components that use serialized objects to communicate locally than in iMessage).

4) Second, it allows an NSData object to be created with a length that is different than the length of its byte array. This violates a very basic property that should always be true of NSData objects. This can allow out of bounds reads, and could also potentially lead to out-of-bounds writes, as it is now possible to create NSData objects with very large sizes that would not be possible if the buffer was backed.

🦑To reproduce the issue with the files in filebacked.zip:

1) install frida (pip3 install frida)

2) open sendMessage.py, and replace the sample receiver with the phone number or email of the target device
in injectMessage.js replace the marker "PATH" with the path of the obj file

3) in the local directory, run:

4) python3 sendMessage.py

Please note that the attached repro case is a simple example to demonstrate the reach-ability of the class in Springboard. The actual consequences of the bug are likely more serious. This PoC only works on devices with iOS 12 or later.


code/ref :

https://github.com/TinToSer/ios-RCE-Vulnerability

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🔵Umbraco path traversal vulnerability:

https://dailycve.com/node/20

Galaxy Note 20 Challenger: renderings of Moto G Stylus 2021 appear.
#Technologies

Office Lens deleted from the Windows Store by Microsoft.
#Updates