Aggregator

解读NCorr-FP论文分析NCorr-FP方案的实现

这篇文章主要介绍了自定义 String 哈希算法的定义、特点以及应用场景，特别详细地讲解了两种常见的算法：ROTR32 和 CRC32。

在 Web 开发中，注入用户提供的 HTML 代码需求普遍存在，但这一过程伴随显著的安全风险，尤其需防范跨站脚本攻击（XSS）。尽管业界已有成熟的 XSS 过滤器（如 DOMPurify），但其配置不当或机制缺陷仍可能被利用。本文聚焦于命名空间混淆、MXSS（突变 XSS）、DOM Clobbering等前沿攻击技术，通过解析基础概念与实战案例，揭示两次 DOMPurify 绕过的核心原理，旨在帮

Неужели наш загадочный сосед — самоубийца?

A vulnerability classified as problematic has been found in Gonzalo Maser Com Artforms 2.1b7.2. Affected is an unknown function of the file index.php. The manipulation of the argument afmsg leads to cross site scripting. This vulnerability is traded as CVE-2010-2846. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

Daily Sparks 是一款轻量级 iPhone 应用（2.7 MB），通过桌面小组件显示重要事项，并支持每日最多 16 次提醒通知。开发者原意用于保存语录，但用户可将其用于重要事项提醒。测试中未见通知推送，需注意可能的频繁打扰。

A vulnerability was found in Moodle. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Database Auto-linking. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2023-28331. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Moodle. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Service Token List. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2021-36398. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in answerdev answer up to 1.0.5. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2023-1245. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in cockpit up to 2.4.0. This affects an unknown part. The manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2023-1313. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in answer up to 1.0.5 and classified as problematic. This issue affects some unknown processing. The manipulation leads to observable response discrepancy. The identification of this vulnerability is CVE-2023-1540. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in thorsten phpmyfaq up to 3.1.11. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to code injection. This vulnerability is handled as CVE-2023-1761. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in answerdev answer up to 1.0.5 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2023-1238. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in eZ Platform Ibexa Kernel 1.3.1.1. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to observable timing discrepancy. This vulnerability was named CVE-2022-48366. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Microsoft Windows. Affected by this vulnerability is an unknown functionality in the library win32k.sys. The manipulation leads to improper access controls. This vulnerability is known as CVE-2012-0181. The attack needs to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

文章描述了一名安全研究人员如何通过结合开放重定向漏洞和SSRF（服务器端请求伪造）漏洞来绕过SSRF防护机制的过程。具体来说，研究人员利用第三方域的一个开放重定向漏洞将请求重定向到目标网站的内部资源（如localhost），从而触发SSRF攻击。这种攻击允许攻击者访问内部服务、扫描网络端口或获取敏感数据。文章还讨论了如何修复此类漏洞，并强调了严格限制允许的域名、验证最终目标地址以及避免开放重定向的重要性。

Pratik Dabhi分享了如何通过结合第三方开放重定向绕过SSRF保护机制的方法。他详细描述了利用目标网站的缩略图服务和第三方域名上的开放重定向漏洞来触发SSRF的过程，并讨论了修复建议。

开源情报(OSINT)通过公开资源收集信息以识别风险或提升安全。HaveIBeenPwned等免费工具可检测数据泄露，帮助保护个人信息或进行安全研究。