Aggregator

Gitlab CVE-2023-2825 一个罕见的目录穿越漏洞

白帽酱の博客
2 years 2 months ago
前言

昨天 GitLab 出了一个版本目录穿越漏洞(CVE-2023-2825)，可以任意读取文件。当时我进行了黑盒测试并复现了该漏洞。

“ An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups. “

这个漏洞的利用条件非常特殊,需要一个至少嵌套了五层group的公开项目”。
看到这个描述，我就觉得这个漏洞非常有趣。很容易想到一种奇怪的情况，即构造五层目录后，再利用五次”../“，恰好到达根目录。
修复漏洞的commit:
https://gitlab.com/gitlab-org/gitlab/-/commit/2ddbf5464954addce7b8c82102377f0f137b604f

白帽酱

从0到1的ChatGPT - 进阶篇（五）- Embeddings

LoRexxar's Blog
2 years 2 months ago

在前面的文章中，无论是各种prompt技巧，又或者是对话技巧，更或者是各种数据集训练，都逃不开两个致命的问题。

1、ChatGPT只能处理文字

2、无论是上下文参考，还是单条对话都有token限制

所以在ChatGPT中，很多应用方向遇到的第一个问题就是如何把问题用文字的方式描述出来，其中最典型的场景就是代码分析。

所以ChatGPT也鼓励使用Embeddings来做类似搜索、分类或者异常检测的分析，这篇文章就讲讲这个。

LoRexxar

Barracuda Zero-Day Vulnerability

X-Force Exchange - Collection Feed
2 years 2 months ago
Summary IBM X-Force is monitoring a zero-day vulnerability in Barracuda Email Security Gateway (ESG) appliances. This vulnerability has been seen being exploited in the wild. Threat Type Vulnerability Overview IBM X-Force is monitoring the disclosure of a vulnerability in the email attachment screening module from Barracuda. CVE-2023-2868 was initially discovered on May 19, 2023 and has since been patched. At this time, the vulnerability does not have a CVSS score but looks to be critical as exploitation le

Managed ad