Aggregator

雷神众测漏洞周报2024.4.15-2024.4.21

雷神众测
11 months 4 weeks ago
雷神众测拥有该文章的修改和解释权。如欲转载或传播此文章，必须保证此文章的副本，包括版权声明等全部内容。声明雷神众测允许，不得任意修改或增减此文章内容，不得以任何方式将其用于商业目的。

RASP：9大应用场景，20条选型Checklist

青藤云安全
11 months 4 weeks ago
在用户比以往更注重应用安全的今天，如何保护应用程序免受威胁是当前组织迫切需要解决的问题。RASP与应用代码紧密耦合，使用上下文，无需黑名单或白名单就可检测威胁，是应用程序的最后一道防线。青藤自主研发的一款RASP产品将于4月25日正式发布！

Grafana backend sql injection affected all version

fdvoid0's blog
11 months 4 weeks ago
Grafana backend sql injection affected all versionVuln Description

The open-source platform for monitoring and observability

to exploit this sql injection vulnerability, someone must use a valid account login to the grafana web backend, then send malicious POST request to /api/ds/query “rawSql” entry.

if attackers login to the grafana web backend, they can use a post request to /api/ds/query api, then they can modify the “rawSql” filed to execute Malicious sql strings leading to time-based blind sql injection vulnerability, then leak data from databases.

253

Managed ad