Aggregator

Summary A post from Veeam details vulnerabilities in its backup and replication solution. The vulnerability could lead to remote code execution (RCE) in versions 9.5, 10, and 11. Threat Type Vulnerability Overview Vulnerabilities in Veeam's backup and replication software have the potential to be used for RCE and eventual gaining control over the target system. Scoring 9.8 on the CVSS v3 scale, these vulnerabilities are critical. Patches have been issued for versions 10 and 11. Version 9.5 is no longer sup

震惊！看完这篇《如何设定合理的安全工作指标》后，80%的安全人员惊呼：后悔知道的太迟了！

震惊！看完这篇《如何设定合理的安全工作指标》后，80%的安全人员惊呼：后悔知道的太迟了！

震惊！看完这篇《如何设定合理的安全工作指标》后，80%的安全人员惊呼：后悔知道的太迟了！

震惊！看完这篇《如何设定合理的安全工作指标》后，80%的安全人员惊呼：后悔知道的太迟了！

震惊！看完这篇《如何设定合理的安全工作指标》后，80%的安全人员惊呼：后悔知道的太迟了！

#今日读书笔记# 如何在业务侧通晒“负面数据”是安全TL必修课

#今日读书笔记# 如何在业务侧通晒“负面数据”是安全TL必修课

One area that I have encountered quite often over the years is that during recon phase of a bug bounty hunt or pentest a set of AWS access keys are being discovered. Let’s say you found 50 AWS access keys by drooling and hunting through public Github repos and using other nifty tricks and means. How do you go about checking their validity? And what do they have access to and provide the Bug Bounty Program or Blue Team the dates, times, and IP address when those keys were used?

在即将春暖花开的日子，祝福每一位朋友都能守护好自己和家人，远离疫情。

在即将春暖花开的日子，祝福每一位朋友都能守护好自己和家人，远离疫情。

攻击者知识图谱作为一个数据中心，当数据累积到一定量级，可能完成数据、情报中心向决策中心的进化。

攻击者知识图谱作为一个数据中心，当数据累积到一定量级，可能完成数据、情报中心向决策中心的进化。

攻击者知识图谱作为一个数据中心，当数据累积到一定量级，可能完成数据、情报中心向决策中心的进化。

攻击者知识图谱作为一个数据中心，当数据累积到一定量级，可能完成数据、情报中心向决策中心的进化。

“备周则意怠；常见则不疑。阴在阳之内，不在阳之对。” 《三十六计·瞒天过海》 0x00 前言 关于这篇文章其实源自逛先知的一次经历，看到@4ra1n师傅写的一篇《从一个被Tomcat拒绝的漏洞到特殊内存马》，原文链接是：https://xz.aliyun.com/t/10577。看完之后顿时就提起了

In May 2021, following a number of high-profile security incidents, U.S. President Biden issued an executive order that set out a high-level agenda to modernize and improve the government?s cyber resilience. This January, the U.S. Office of Management and Budget (OMB) issued a memo to the heads of executive departments and agencies that gave much more detail on how the U.S. government will move toward Zero Trust security principles.

End-to-end 'modern' browser exploitation on Windows beginning with configuring a browser exploitation environment, exploring JavaScript intrinsics, and understanding type confusion vulnerabilities.

End-to-end 'modern' browser exploitation on Windows beginning with configuring a browser exploitation environment, exploring JavaScript intrinsics, and understanding type confusion vulnerabilities.