Tencent Security Xuanwu Lab Daily News
• 年轻人如何挖掘第一个RCE:
http://paper.seebug.org/1809/
・ 年轻人如何挖掘第一个RCE.
– lanying37
• Remote Code Execution in Google Cloud Dataflow:
https://mbrancato.github.io/2021/12/28/rce-dataflow.html
・ Remote Code Execution in Google Cloud Dataflow
– Jett
• [Browser] CVE-2021-38000: Chrome Intents Logic Flaw:
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-38000.html
・ CVE-2021-38000: Chrome Intents Logic Flaw
– Jett
• README.md:
https://github.com/ioncodes/ceload
・ ceload – 加载 CheatEngine 签名驱动的工具
– Jett
• [Malware] Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit:
https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce
・ Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit
– Jett
• EDR Parallel-asis through Analysis:
https://www.mdsec.co.uk/2022/01/edr-parallel-asis-through-analysis/
・ 检测 Syscall Number 的新方法
– Jett
• Fuzzing101 with LibAFL – Part IV: Fuzzing LibTIFF:
https://epi052.gitlab.io/notes-to-self/blog/2021-11-26-fuzzing-101-with-libafl-part-4/
・ Fuzzing101 with LibAFL – Part IV: Fuzzing LibTIFF
– Jett
• My first impressions of web3:
https://moxie.org/2022/01/07/web3-first-impressions.html
・ My first impressions of web3
– Jett
• NeoDiff/roots21-2.pdf:
https://github.com/fgsect/NeoDiff/blob/main/roots21-2.pdf
・ 利用差异模糊测试的方案挖掘智能合约虚拟机的漏洞
– Jett
• NPM might be executing malicious code in your CI without your knowledge:
https://medium.com/cider-sec/npm-might-be-executing-malicious-code-in-your-ci-without-your-knowledge-e5e45bab2fed
・ 通过配置特殊配置文件，可以在 NPM CI 过程中执行任意命令
– Jett
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(01-10)
