每日安全动态推送(8-3)

渗透技巧 11个月前 admin
198 0 0
Tencent Security Xuanwu Lab Daily News

• Splunk SOAR Unauthenticated Log Injection Let attackers Execute Malicious Code:
https://cybersecuritynews.com/splunk-soar-log-injection/

   ・ Splunk SOAR中未经身份验证的日志注入 – SecTodayBot


• Zero-Day Vulnerabilities Discovered in Global Emergency Services Communications Protocol:
https://bit.ly/3KBP60L

   ・ 全球紧急服务通信协议 Terrestrial Trunked Radio (TETRA) 算法中的一个后门,影响依赖 TEa1 来实现机密性和完整性的网络,攻击者可以对其进行暴力攻击,并侦听通信而不被发现 – SecTodayBot


• Putting the “You” in CPU:
https://cpu.land/

   ・ 计算机硬件及操作系统原理介绍 – SecTodayBot


• CVE-2023-28130 – Hostname injection leads to Remote Code Execution RCE (Authenticated):
https://seclists.org/fulldisclosure/2023/Aug/4

   ・ Check Point Gaia Portal 存在一个漏洞,允许对 DNS 设置具有写入权限的经过身份验证的用户在 cgi 脚本中注入命令,从而导致在操作系统上远程执行代码。 – SecTodayBot


• WordPress Stripe Payment Plugin For WooCommerce 3.7.7 Authentication Bypass ≈ Packet Storm:
https://packetstormsecurity.com/files/173884

   ・ WordPress 的 Stripe Payment Plugin for WooCommerce 插件在 3.7.7 及以下版本中容易受到身份验证绕过。这是由于在通过插件进行 Stripe 结帐时提供的用户验证不足。这允许未经身份验证的攻击者以有订单的用户身份登录 – SecTodayBot


• Bad news: Another data-leaking CPU flaw. Good news: It’s utterly impractical:
http://dlvr.it/St3VTV

   ・ 又出现了一个CPU缓存相关的数据泄露漏洞 – SecTodayBot


• CVE-2023-2008 – Analyzing and exploiting a bug in the udmabuf driver:
https://labs.bluefrostsecurity.de/blog/cve-2023-2008.html

   ・ udmabuf 驱动中的漏洞利用分析 – SecTodayBot


• CakeFuzzer:
https://github.com/Zigrin-Security/CakeFuzzer

   ・ 基于 CakePHP 框架的 Web 应用程序中漏洞发现的自动化过程 – SecTodayBot


• The first iOS Downgrade Using BlackBird by Pangu was Achieved! – iDevice Central:
https://idevicecentral.com/ios-downgrade/the-first-ios-downgrade-using-blackbird-pangu-achieved/

   ・ 利用盘古开发的 BlackBird 实现 iOS 系统降级 – SecTodayBot


• Asking Android Developers About Security:
https://www.youtube.com/watch?v=-X03UKo_obE

   ・ Asking Android Developers About Security – lanying37


* 查看或搜索历史推送内容请访问:
https://sec.today

* 新浪微博账号:腾讯玄武实验室
https://weibo.com/xuanwulab


原文始发于微信公众号(腾讯玄武实验室):每日安全动态推送(8-3)

版权声明:admin 发表于 2023年8月3日 上午10:25。
转载请注明:每日安全动态推送(8-3) | CTF导航

相关文章

暂无评论

您必须登录才能参与评论!
立即登录
暂无评论...