Aggregator

这篇文章将介绍作者在 Hackerone 的私人项目中发现的一个漏洞，该漏洞允许我接管任何用户的账户。

这篇文章将介绍作者在 Hackerone 的私人项目中发现的一个漏洞，该漏洞允许我接管任何用户的账户。在开始之前，我想先提供一些关于 Host 头的小基础知识。什么是 HTTP Host 头？ HTT

A vulnerability, which was classified as critical, was found in GNU Mailutils 0.5/0.6. Affected is an unknown function. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2005-1523. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in PHP. Affected by this vulnerability is the function ZipArchive::getArchiveComment. The manipulation leads to improper input validation. This vulnerability is known as CVE-2010-3709. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability classified as critical was found in Backstage up to 0.15.9. Affected by this vulnerability is an unknown functionality of the component plugin-scaffolder-backend. The manipulation leads to path traversal. This vulnerability is known as CVE-2021-43783. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

愿我们始终能够感受并践行内心的方向。

愿我们始终能够感受并践行内心的方向。

愿我们始终能够感受并践行内心的方向。

愿我们始终能够感受并践行内心的方向。

愿我们始终能够感受并践行内心的方向。

愿我们始终能够感受并践行内心的方向。

愿我们始终能够感受并践行内心的方向。

Effective Public Key Infrastructure (PKI) management needs to combine ways of handling PKI infrastructure along with the recommended best practices. In many cases, management of digital signatures or certificates is not that widely understood and can often lead to an outage that could have been proactively prevented. This mismanagement of certificates can also impact safe […]

The post Addressing PKI Management Pitfalls: From Chaos to Clarity appeared first on Security Boulevard.

A vulnerability was found in Silverpeas 6.4.1. It has been rated as critical. Affected by this issue is the function findbywhereclause. The manipulation of the argument ViewType leads to sql injection. This vulnerability is handled as CVE-2024-48814. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

The growing complexity of cyber threats, paired with limited resources, makes it essential for companies to adopt a more comprehensive approach that combines human vigilance with AI's capabilities.

Atos Group has denied the ransomware group Space Bears' claims of compromising its database, calling the allegations unfounded

A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. This vulnerability is known as CVE-2024-13129. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

保持我们的简单、认真、诚恳、诚实，保持我们的迭代——这些是我们能做到的。如果运气还能继续不错，我们就还能继续走下去。​

Submit #468530 / VDB-290149