Aggregator

文章探讨通过压力测试合法浏览器功能发现Chrome漏洞的过程,揭示防御性研究在遵守伦理边界下发现关键缺陷的重要性,并分析浏览器处理敏感数据的关键作用及特性带来的安全风险。

作者在测试电商平台时发现一个逻辑漏洞，攻击者可借此操控定价算法，在闪购系统中造成重大损失。该漏洞源于开发者与用户行为之间的认知差异，并未触发安全警告。此类逻辑问题占电商高危财务漏洞的42%，需重视业务流程中的潜在风险。

作者通过理解业务流程发现电商平台逻辑漏洞,利用价格算法缺陷使系统受损,并获得750美元赏金。研究显示此类漏洞占高影响金融问题的42%。

谷神星是小行星带最大天体，NASA黎明号探测器提供观测数据。研究显示其内部早期有足够热量维持地下水库和热水供应，类似地球深海热泉。最可能的宜居时期为约25亿至40亿年前。现因热能耗尽而不再宜居。

谷神星是小行星带最大的天体，NASA 黎明号（Dawn）探测器在 2015 年进入谷神星的公转轨道，为科学家提供小行星的近距离的观测资料。研究人员通过重建谷神星内部热模型和化学模型，模拟了谷神星内部温度和成分随时间的变化。他们发现大约 25 亿年前谷神星内部放射性元素衰变产生的热能不仅足以使地下水库存在，还能不断供应热水给地下水库。而热水中含有溶解的气体，气体便从岩石核心的变质岩中向上流动，相当类似地球深海的海底热泉。研究估计谷神星最有可能的宜居时期是它形成后的 5 亿到 20 亿年之间，也就是大约 25 亿到 40 亿年前。尽管谷神星以前对于微生物来说可能很宜居，现在的谷神星早已耗尽了它的热能。不但水大量结冰，残留的液体也已经变成了浓缩的盐水。

作者通过被动枚举和历史资产收集等方法，在凌晨3点的recon中发现了一个废弃的子域名，并利用其DNS记录获取了重大收获。

作者通过被动枚举、历史资产收集和爬虫工具发现了一个废弃子域名，并成功利用该资产获取重大成果。

Abhijeet Kumawat, a cybersecurity enthusiast and bug bounty hunter, shares insights in his series "Bug Bounty from Scratch," emphasizing HTTP as a key tool in ethical hacking. He explains GET requests and aims to guide newcomers into the field.

文章介绍了HTTP基础知识及其在网络攻击中的应用，通过GET请求示例讲解了HTTP请求的基本结构和参数使用方法。

研究人员发现一个未更新4年的npm包仍被17,000个项目使用，存在严重漏洞可能导致远程代码执行。现代开发中过度依赖开源组件，许多看似维护的包实际已废弃且存有安全隐患。

一位开发者在审计客户网站时发现一个未更新四年的npm包仍在17,000个项目中使用，该包存在严重漏洞可能导致大规模远程代码执行。文章揭示了现代开发生态系统中开源依赖的安全隐患：许多看似“受维护”的包实际上已被废弃且仍存在关键漏洞。

文章描述了通过nmap扫描发现HTTP服务后, 使用Netcat连接并植入反向shell以获取初始访问权限. 随后通过查找邮件和.git仓库获取用户凭证, 并SSH登录. 接着利用Python脚本暴力破解admin密码, 最终获得root权限.

A vulnerability has been found in Cisco Small Business RV016, Small Business RV042, Small Business RV042G, Small Business RV082, Small Business R320 and Small Business RV325 and classified as problematic. Affected by this issue is some unknown functionality of the component Web-based Management Interface. Performing manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2023-20143. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in Cisco Small Business RV016, Small Business RV042, Small Business RV042G, Small Business RV082, Small Business R320 and Small Business RV325. Affected by this vulnerability is an unknown functionality of the component Web-based Management Interface. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2023-20142. The attack may be performed from a remote location. There is no available exploit. You should upgrade the affected component.

多款密码管理器被发现存在点击劫持漏洞，可能导致用户敏感信息泄露。研究人员建议禁用自动填充功能或使用独立2FA验证工具以提高安全性，但会影响便利性。

A vulnerability classified as problematic has been found in QEMU. Affected is the function uefi_vars_write of the file hw/uefi/var-service-core.c of the component uefi. Performing manipulation results in information disclosure. This vulnerability was named CVE-2025-8860. The attack needs to be approached within the local network. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

A vulnerability described as critical has been identified in Custom Query Shortcode Plugin up to 0.4.0 on WordPress. This impacts an unknown function. Such manipulation of the argument lens leads to path traversal. This vulnerability is uniquely identified as CVE-2025-8562. The attack can be launched remotely. No exploit exists.

Satellites play a huge role in our daily lives, supporting everything from global communications to navigation, business, and national security. As space becomes more crowded and commercial satellite use grows, these systems are facing new cyber threats. The challenge is even greater because many satellites still in service were designed decades ago, at a time when cybersecurity wasn’t a focus, which leaves them with limited defenses. In this Help Net Security interview, Brett Loubert, leader … More →

The post Why satellite cybersecurity threats matter to everyone appeared first on Help Net Security.

美国卫生部长小肯尼迪要求撤回一篇关于疫苗铝化合物的研究论文。该研究显示铝化合物未显著增加儿童患自身免疫、过敏或神经发育障碍的风险。小肯尼迪质疑结论，而疫苗怀疑论者曾声称铝与自闭症有关。期刊拒绝撤稿，专家指出此举不寻常。

反疫苗的美国卫生部长小肯尼迪（Robert F. Kennedy Jr）要求《Annals of Internal Medicine》期刊撤回丹麦研究人员发表的一篇论文《Aluminum-Adsorbed Vaccines and Chronic Diseases in Childhood: A Nationwide Cohort Study》，对丹麦过去逾 20年来出生的 120 万名儿童的分析发现，疫苗中的铝化合物并不显著增加罹患自身免疫性、过敏性或神经发育障碍的风险。小肯尼迪对研究结论提出了质疑。疫苗怀疑论者曾宣称铝化合物 与自闭症等儿童疾病发病率上升有关，而 WHO 等机构早就驳斥过此类观点。以盐形式存在的铝广泛用于疫苗，没有证据表明疫苗中少量的铝会引起严重的副作用。对于小肯尼迪的要求，期刊表示无意撤稿。Retraction Watch 联合创始人 Ivan Oransky 指出，公共卫生官员很少要求撤稿，小肯尼迪此举是想要科学期刊屈服于他的意志。