每日安全动态推送(5-18)

Tencent Security Xuanwu Lab Daily News

• CVE-2023-32243.:
https://github.com/RandomRobbieBF/CVE-2023-32243

   ・ Elementor 5.4.0-5.7.1 存在未经身份验证的权限提升漏洞 – SecTodayBot

• 关于linkedin2username:
https://www.freebuf.com/articles/network/366272.html

   ・ linkedin2username是一款强大的OSINT公共资源情报收集工具，可以帮助研究人员根据LinkedIn的企业信息快速生成用户名列表。 – SecTodayBot

• Multiple vulnerabilities in Jenkins plugins:
https://seclists.org/oss-sec/2023/q2/163

   ・ Jenkins 多个插件存在漏洞：Ansible Plugin 、AppSpider、Azure VM Agents Plugin  – SecTodayBot

• SID filter as security boundary between domains? (Part 6) – Schema change trust attack – from child to parent:
https://improsec.com/tech-blog/sid-filter-as-security-boundary-between-domains-part-6-schema-change-trust-attack-from-child-to-parent

   ・ Active Directory Schema 攻击理论 – SecTodayBot

• CS:GO: From Zero to 0-day:
https://neodyme.io/blog/csgo_from_zero_to_0day/

   ・ CS:GO 客户端 RCE 漏洞 – SecTodayBot

• Dynamic Debugging of dotnet Without Source Code:
https://pulsesecurity.co.nz/articles/dotnet-dynamic-analysis

   ・ 在无源码的情况下动态调试 dotnet 软件 – WireFish

• privateGPT:
https://github.com/imartinez/privateGPT

   ・ privateGPT 使用 LLM 的强大功能，在没有互联网连接的情况下回答您的问题。100% 私有，任何时候都没有数据离开您的执行环境。使用 LangChain 和 GPT4All 以及 LlamaCpp 创建 – SecTodayBot

• Hack symptoms:
https://kas.pr/ny97

   ・ 卡巴斯基分析假硬件钱包盗币事件 – WireFish

• 黑盒 fuzz 工具 Jackalope 的使用:
https://paper.seebug.org/2070/

   ・ Jackalope 是专用于 Windows/Macos 的黑盒 Fuzz 开源工具。与 WinAfl 相比，它的受欢迎程度要低得多；Amorio Instrumentation Tool，可以处理复杂的插装需求 – SecTodayBot

• Escaping Parallels Desktop with Plist Injection:
https://pwn.win/2023/05/08/parallels-escape.html

   ・ 从 Parallels 桌面虚拟机中逃逸 – SecTodayBot

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(5-18)